手工实现HttpBasic校验

 

HttpBasic：

是RFC中定义的一种控制HTTP协议访问资源的方式。具体当HTTP请求受限资源时，就需要在请求头中添加以"Authorization"为key的header，value的具体形式是"Basic <credentials>", 其中<credentials>

是以“${username}:${password}"进行BASE64编码后的字符串。如果携带的这个请求头的信息和服务端保存

的用户名密码信息不匹配，就需要服务端必须返回401的状态码和WWW-Authenticate的返回头，其中值要形如

”Basic realm=testHttpBasic"其中”Basic realm"是固定死的

特性：

是最简单的控制访问方式，不需要cookies啊，session identifiers（session id)啊/login pages什么的。

各大浏览器都会以好RFC定义的约定规则实现对应的逻辑的。

 

实现：

SpringSecurity框架中就包含了HttpBasic的功能，但如果不想依赖这么重的玩意儿，可以自己写一个。

我是写了一个Filter，用于过滤请求，已通过Chrome浏览器验证Ok.

 package org.zeng.test.test.web.httpbasic;

 import javax.servlet.*;
 import javax.servlet.annotation.WebFilter;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 import java.io.IOException;
 import java.util.Base64;

 @WebFilter(servletNames = "authFilter", urlPatterns = "/basic/*")
 public class AuthFilter implements Filter {

     private final String USERNAME = "admin";
     private final String PASSWORD = "123456";

     /**
      * 核心逻辑比较简单，就是：
      * 1.简单的字符串解析
      * 2.解码Base64
      * 3.验证用户名密码
      * 4.将用户标识放入session中
      *
      * @param servletRequest
      * @param servletResponse
      * @param filterChain
      * @throws IOException
      * @throws ServletException
      */
     @Override
     public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
         HttpServletRequest request = (HttpServletRequest)servletRequest;
         HttpSession session = request.getSession();

         if (session.getAttribute("user") == null) {
             String basicValue = request.getHeader("Authorization");

             //打印出了值形如 "Basic YW423222222lalalla"
             System.out.println("Authorization: " + basicValue);

             if (basicValue != null && basicValue.length() > 0) {
                 String[] authorizationValue = basicValue.split(" ");
                 if (authorizationValue.length == 2) {

                     //获取到解码后的值，形如 "admin:123456"
                     String base64Encoded = new String(Base64.getDecoder().decode(authorizationValue[1]));
                     if (authorizationValue != null && base64Encoded.length() > 0) {
                         String userAndPwdArray[] = base64Encoded.split(":");
                         if (userAndPwdArray.length != 2) {
                             checkFailed(servletResponse);
                         } else {
                             String user = userAndPwdArray[0];
                             String password = userAndPwdArray[1];
                             if (USERNAME.equals(user) && PASSWORD.equals(password)) {

                                 //放入session中，下次登录无需再次提示登录框
                                 session.setAttribute("user", USERNAME);

                                 checkSuccess(servletRequest, servletResponse, filterChain);
                             } else {
                                 checkFailed(servletResponse);
                             }
                         }
                     } else {
                         checkFailed(servletResponse);
                     }
                 } else {
                     checkFailed(servletResponse);
                 }
             } else {
                 checkFailed(servletResponse);
             }
         } else {
             checkSuccess(servletRequest, servletResponse, filterChain);
         }
     }

     @Override
     public void init(FilterConfig filterConfig) throws ServletException {

     }

     @Override
     public void destroy() {

     }

     /**
      * 校验成功
      * @param servletRequest
      * @param servletResponse
      * @param filterChain
      * @throws IOException
      * @throws ServletException
      */
     private void checkSuccess(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
         filterChain.doFilter(servletRequest, servletResponse);
     }

     /**
      * 校验失败返回
      * @param servletResponse
      */
     private void checkFailed(ServletResponse servletResponse) {
         HttpServletResponse response = (HttpServletResponse) servletResponse;
         response.setStatus(401);
         response.setHeader("WWW-Authenticate", "Basic realm=anything you can write!");
     }
 }