Bagaimana Anda membuat koneksi websocket yang aman dengan Java di sisi klien?

Saya akan memberikan beberapa pedoman untuk otentikasi websocket. Karena websocket ditingkatkan dari http, otentikasi juga didasarkan pada http. Anda dapat melengkapi koneksi http dengan ssl atau basic atau digest auth.

Saya pernah bekerja dengan spring websocket auth sebelumnya, ssl hanya untuk meningkatkan http ke https. Saya akan memposting autentikasi intisari untuk websocket musim semi di sini.

1.Konfigurasi server untuk autentikasi intisari pengguna, keamanan pegas bisa mendapatkannya:

@Configuration  
@EnableWebSecurity  
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {  

    public final static String REALM="MY_REALM";  

    @Autowired  
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {  
        auth.inMemoryAuthentication().withUser("admin").password("admin").roles("ADMIN")  
        .and().withUser("test").password("test").roles("USER");  
    }  

    @Override  
    protected void configure(HttpSecurity http) throws Exception {  
        http.csrf().disable()  
            .authorizeRequests()  
            .anyRequest().authenticated()  
            .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)  
            .and().exceptionHandling().authenticationEntryPoint(getDigestEntryPoint())  
            .and().addFilter(getDigestAuthenticationFilter(getDigestEntryPoint()));  

    }  

    @Bean  
    public MyDigestAuthenticationEntryPoint getDigestEntryPoint() {  
        MyDigestAuthenticationEntryPoint digestAuthenticationEntryPoint = new MyDigestAuthenticationEntryPoint();  
        digestAuthenticationEntryPoint.setKey("mykey");  
        digestAuthenticationEntryPoint.setNonceValiditySeconds(120);  
        digestAuthenticationEntryPoint.setRealmName(REALM);  
        return digestAuthenticationEntryPoint;  
    }  

    public DigestAuthenticationFilter getDigestAuthenticationFilter(  
            MyDigestAuthenticationEntryPoint digestAuthenticationEntryPoint) throws Exception {  
        DigestAuthenticationFilter digestAuthenticationFilter = new DigestAuthenticationFilter();  
        digestAuthenticationFilter.setAuthenticationEntryPoint(digestAuthenticationEntryPoint);  
        digestAuthenticationFilter.setUserDetailsService(userDetailsServiceBean());  
        return digestAuthenticationFilter;  
    }  

    @Override  
    @Bean  
    public UserDetailsService userDetailsServiceBean() throws Exception {  
        return super.userDetailsServiceBean();  
    }  
}  
public class MyDigestAuthenticationEntryPoint extends DigestAuthenticationEntryPoint {  

    @Override  
    public void afterPropertiesSet() throws Exception{  
        super.afterPropertiesSet();  
        setRealmName(WebSecurityConfig.REALM);  
    }  
}  

2.Perluas dari abstractSecurityWebSocketMessageBrokerConfigurer:

@Configuration  
@EnableWebSocketMessageBroker  
public class WssBrokerConfig extends AbstractSecurityWebSocketMessageBrokerConfigurer  {  

    @Override  
    protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {  
        messages  
            .nullDestMatcher().authenticated()  
            .simpSubscribeDestMatchers("/topic/notification").permitAll()  
            .simpDestMatchers("/**").authenticated()  
            .anyMessage().denyAll();  
    }  

    @Override  
    public void configureMessageBroker(MessageBrokerRegistry config) {  
        config.enableSimpleBroker("/topic");  
        config.setApplicationDestinationPrefixes("/ws");  
    }  

    @Override  
    public void registerStompEndpoints(StompEndpointRegistry registry) {  
        registry.addEndpoint("/hpdm-ws").setAllowedOrigins("*").withSockJS();  
    }  

    @Bean  
    public MappingJackson2HttpMessageConverter mappingJackson2HttpMessageConverter() {  
        ObjectMapper mapper = new ObjectMapper();  
        mapper.configure(SerializationFeature.FAIL_ON_EMPTY_BEANS, false);  
        MappingJackson2HttpMessageConverter converter =  
                new MappingJackson2HttpMessageConverter(mapper);  
        return converter;  
    }  

    @Override  
    protected boolean sameOriginDisabled() {  
        return true;  
    }  
}  

3.Otentikasi intisari untuk klien lihat posting ini:

websocket pegas dengan autentikasi intisari