六.授权结果处理

一.授权失败处理

1.1.概述

当用户请求资源服务的资源时，需要进行用户的认证和授权检查，当认证或授权检查失败，我们需要要返回自己的失败结果信息，可以通过HttpSecurity设置授权失败结果处理器,内部通过 ExceptionTranslationFilter 调用AuthenticationEntryPoint实现匿名用户授权失败结果处理， ExceptionTranslationFilter 通过 AccessDeniedHandler来处理授权失败结果处理。

1.2.定义认证检查失败处理

1.定义AccessDeniedHandler AccessDeineHandler 用来解决认证过的用户访问无权限资源时的异常

public class DefaultAccessDeniedHandler implements AccessDeniedHandler { @Override public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException { String result = JSON.toJSONString(AjaxResult.me().setSuccess(false).setMessage("无访问权限")); response.setContentType("text/html;charset=utf-8"); PrintWriter writer = response.getWriter(); writer.print(result); writer.flush(); writer.close(); } }

2.定义AuthenticationEntryPoint AuthenticationEntryPoint 用来解决匿名用户访问无权限资源时的异常

public class MyAuthenticationEntryPoint implements AuthenticationEntryPoint { @Override public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException { e.printStackTrace(); httpServletResponse.setContentType("application/json;charset=utf-8"); Map<String,Object> result = new HashMap<>(); result.put("success",false); result.put("message","登录失败，用户名或密码错误["+e.getMessage()+"]"); httpServletResponse.getWriter().print(JSONUtils.toJSONString(result)); } }

3.配置异常处理器

//异常处理 httpSecurity.exceptionHandling() .accessDeniedHandler(new DefaultAccessDeniedHandler ()) .authenticationEntryPoint(new MyAuthenticationEntryPoint()) //身份认证验证失败配置