背景：

其實是要完成一個簡單的呼叫介面的安全驗證。 發現簽名演算法啥的好像都還相對容易，畢竟hmac 之類都封裝好了，定義好規則就好。但是對於不太熟悉spring boot 攔截器 和過濾器的我來說，驗證的aop程式設計成為一個痛點。在此簡單記錄下.. 畢竟我的記憶力不夠好

先宣告：對於我的場景來說Filter 和 Interceptor是都可以實現的。所以下面的兩個方案，在功能上都可以run，但是最終選擇Interceptor是更符合我的需求。

1. Filter：

核心分為兩步 

• STEP1 定義Filter 並實現 
• STEP2 註冊，在Configuration中 （畢竟spring boot 會自動載入）

1.1 Filter的定義與實現

加入maven 依賴

<dependency>
    <groupId>javax.servlet</groupId>
    <artifactId>javax.servlet-api</artifactId>
    <optional>true</optional>
</dependency>

實現Filter介面就行

package auth;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import lombok.extern.slf4j.Slf4j;

@Slf4j
@WebFilter(filterName = "InternalAuth", urlPatterns = "${auth.url:/*}")
public class InternalAuthFilter implements Filter{

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest servletRequest,
                         ServletResponse servletResponse,
                         FilterChain filterChain) throws IOException, ServletException {
        log.debug("doFilter cvcaInternalAuth {}", servletRequest.getLocalName());
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        // 做業務邏輯
    }

    @Override
    public void destroy() {

    }
}
 

1.2 Filter的Config註冊

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-autoconfigure</artifactId>
</dependency>

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-web</artifactId>
 
    <optional>true</optional>
</dependency>

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-web</artifactId>
    <optional>true</optional>
</dependency>

import java.util.Arrays;
import java.util.List;

import javax.servlet.Filter;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Import;

@Configuration
@ConditionalOnWebApplication
@Slf4j
public class RestAppMvcAutoConfiguration {
   
    @Configuration
    @ConditionalOnClass(Filter.class)
    @ConditionalOnExpression("${auth_filter.enable:false}") // 加開關
    public static class AuthFilterConfiguration {
       
        @Bean
        public AuthRegionFilter authFilterBean() {
            AuthFilter filter = new AuthFilter();
            log.info("service auth filter created");
            return filter;
        }
    }
}