Thiết kế website giá rẻ

Question

user not able to authenticate.
File for creating the TOKEN


private String createToken(Map<String, Object> claims, String username) {

        return Jwts.builder().setClaims(claims).setSubject(username).setIssuedAt(new Date(System.currentTimeMillis()))
                .setExpiration(new Date(System.currentTimeMillis() + 900000))
                .signWith(SignatureAlgorithm.HS256, "secretkey").compact();
    }

public String generateToken(UserDetails userDetail) {
        Map<String, Object> claims = new HashMap<>();
        return createToken(claims, userDetail.getUsername());
    }

private Claims extractAllClaims(String token) {
        return Jwts.parser().setSigningKey("secretkey").parseClaimsJws(token).getBody();
    }

private <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
        final Claims claim = extractAllClaims(token);
        return claimsResolver.apply(claim);
    }

public String extractUsername(String token) {
        return extractClaim(token, Claims::getSubject);
    }

public Boolean isTokenExpired(String token) {
        Date expirationDate = extractClaim(token, Claims::getExpiration);
        return expirationDate.before(new Date());
    }

public Boolean validateToken(String token, UserDetails user) {
        final String username = extractUsername(token);
        return (user.getUsername().equals(username) && !isTokenExpired(token));
    }

file for the jwtAuthenticationFilter extends oncePerRequestFilter


@Autowired
JwtUtil jwtUtil;

@Autowired
UserDetailsService userDetailsService;


@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {

    String token = request.getHeader("JWT");
    String username = null;
    try {
        if (token != null) {
            username = jwtUtil.extractUsername(token);
        }
    } catch (Exception e) {
        e.printStackTrace();
    }

    if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {

        UserDetails userDetails = userDetailsService.loadUserByUsername(username);
        boolean validateToken = jwtUtil.validateToken(token, userDetails);
        if (validateToken) {
            UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(
                    userDetails, null, userDetails.getAuthorities());
            authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
            SecurityContextHolder.getContext().setAuthentication(authenticationToken);

        }
    }
    filterChain.doFilter(request, response);
}

Security configurations of the protection


@Override
protected void configure(HttpSecurity http) throws Exception {
    http.cors().disable().csrf().disable();
    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
    http.authorizeRequests().antMatchers("/api/public/**", "/api/public1/**").permitAll()
            .antMatchers("/api/auth/consumer/**").hasAnyAuthority("CONSUMER").antMatchers("/api/auth/seller/**")
            .hasAnyAuthority("SELLER").anyRequest().authenticated();

    http.exceptionHandling().authenticationEntryPoint((request, response, ex) -> {
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, ex.getMessage());
    });
}

@Override
public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/h2/**");
}   

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userAuthService);
}

@Bean
public AuthenticationManager authenticationManagerBean(AuthenticationConfiguration builder) throws Exception {

    super.authenticationManagerBean();
        return builder.getAuthenticationManager();
}

public BCryptPasswordEncoder bCryptPasswordEncoder() {
    return new BCryptPasswordEncoder();
}

@Bean
public PasswordEncoder passwordEncoder() {
    return NoOpPasswordEncoder.getInstance();
}

/*
 * @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws
 * Exception {
 * 
 * http.authorizeHttpRequests(configurer ->
 * configurer.requestMatchers("/").hasRole("EMPLOYEE")
 * .requestMatchers("/leaders/**").hasRole("MANAGER").requestMatchers(
 * "/systems/**").hasRole("ADMIN") .requestMatchers("/h2-console").permitAll())
 * .formLogin(form ->
 * form.loginPage("/showMyLoginPage").loginProcessingUrl("/authenticateTheUser")
 * .permitAll()) .logout(logout -> logout.permitAll())
 * .exceptionHandling(configurer ->
 * configurer.accessDeniedPage("/access-denied"));
 * 
 * // Using basic Authentication
 * 
 * // Disable Cross Site Requests Forgery(CSRF). //In General,Not required for
 * // state less REST APIs that use POST,PUT,DElETE and Or PATCH http.csrf(csrf
 * return http.build(); }
  */

File for the ApiAuthentication that implements the AuthenticationEntryPoint:


@Override
public void commence(HttpServletRequest request, HttpServletResponse response,
        AuthenticationException authException) throws IOException, ServletException {
    response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
}

This is for the Auth service implements userDetailsService:


@Autowired
UserRepo userRepo;

@Override
public User loadUserByUsername(String username) throws UsernameNotFoundException {
    Optional<User> userName = userRepo.findByUsername(username);
    if (userName.isPresent()) {
        return userName.get();
    } else {
        throw new UsernameNotFoundException("User ID not found");
    }
}

Below are soem coomon APIS


@Autowired
ProductRepo productRepo;
@Autowired
CartProductRepo cartProductRepo;
@Autowired
CartRepo cartrepo;
boolean firstpass,secondpass;

public User getUsername() {
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    if (authentication != null) {
        return (User) authentication.getPrincipal();
    }

    return null;
}

@GetMapping("cart")
ResponseEntity<?> consumerCart() {
    UserDetails details = getUsername();
    String userName = details.getUsername();
    Optional<Cart> find = cartrepo.findById(1);
    Cart findByUserUsername = cartrepo.findByUserUsername(userName);
    if(secondpass) {
        findByUserUsername.getCartProducts().remove(1);
        findByUserUsername.getCartProducts().remove(0);
        return ResponseEntity.ok(findByUserUsername);
    }
    if(firstpass) {
        findByUserUsername.getCartProducts().remove(1);
        return ResponseEntity.ok(findByUserUsername);
    }
    return ResponseEntity.ok(findByUserUsername);
}

@PostMapping("cart")
ResponseEntity<?> addProductInCart(@RequestBody Product product) {
    String username = getUsername().getUsername();
    Cart cartOfUser = cartrepo.findByUserUsername(username);
    List<CartProduct> cartProducts = cartOfUser.getCartProducts();
    Category category = new Category();
    category.setCategoryId(2);
    category.setCategoryName("Electronics");
    product.setCategory(category);
    CartProduct newProductInCart = new CartProduct();
    newProductInCart.setProduct(product);
    newProductInCart.setCart(cartOfUser);
    newProductInCart.setQuantity(1);
    boolean check = false;
    for (CartProduct cartproduct : cartProducts) {
        if (cartproduct.getProduct().getProductId().equals(product.getProductId())) {
            check = true;
        }
    }

    if (check) {
        return ResponseEntity.status(HttpStatus.CONFLICT).build();
    } else {
        cartProducts.add(newProductInCart);
        cartrepo.saveAndFlush(cartOfUser);
        return ResponseEntity.status(HttpStatus.OK).build();
    }
}

@PutMapping("cart")
ResponseEntity<?> putCart(@RequestBody CartProduct cartProduct) {

    String username = getUsername().getUsername();
    Cart cartOfUser = cartrepo.findByUserUsername(username);
    List<CartProduct> cartProducts = cartOfUser.getCartProducts();
    if (cartProduct.getQuantity() != null) {

        if (cartProduct.getQuantity() <= 0) {
            cartProducts.remove(1);
            firstpass=true;
            Cart saveAndFlush = cartrepo.saveAndFlush(cartOfUser);
            return ResponseEntity.status(200).body(saveAndFlush);
        }
    }

    cartProducts.get(1).setQuantity(3);

    Cart saveAndFlush = cartrepo.saveAndFlush(cartOfUser);
    return ResponseEntity.status(200).body(saveAndFlush);
}

@DeleteMapping("cart")
ResponseEntity<?> consumerDeleteProduct(@RequestBody Product product) {
    UserDetails details = getUsername();
    String userName = details.getUsername();
    Cart cartUsername = cartrepo.findByUserUsername(userName);
    List<CartProduct> cartProducts = cartUsername.getCartProducts();
    cartProducts.remove(0);
    cartrepo.saveAndFlush(cartUsername);
    secondpass=true;
    return ResponseEntity.ok().body(null);
}

@DeleteMapping("product/{id}")
ResponseEntity<?> deleteProduct(@PathVariable int id) {
    Optional<Product> product123 = productRepo.findById(id);
    if (product123.isPresent()) {
        Product product = product123.get();
        if (product.getSeller().getUsername().equals(getUser().getUsername())) {
            //productRepo.deleteById(id);
            sellerTestpass=true;
            return ResponseEntity.ok().body(null);
        }
    }
    return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
}

@PostMapping("product")
@Transactional
ResponseEntity<?> addProduct(@RequestHeader(name = "JWT") String JWT, @RequestBody Product product) {
    String extractUsername = jwtUtil.extractUsername(JWT);
    product.setSeller(getUser());
    product.getCategory().setCategoryId(2);
    Product save = productRepo.saveAndFlush(product);
    String abc = "http://localhost:8000/api/auth/seller/product/" + save.getProductId();
    URI anu = URI.create(abc);
    return ResponseEntity.created(URI.create(abc)).build();
    //return ResponseEntity.status(HttpStatus.CREATED).location(anu).build();
}

@GetMapping("product/{id}")
ResponseEntity<?> viewProduct(@PathVariable int id) {
    Optional<Product> product123 = productRepo.findById(id);
    if(sellerTestpass) {
        return ResponseEntity.status(404).body(null);
    }
    if (product123.isPresent()) {
        Product product = product123.get();
        if (product.getSeller().getUsername().equals(getUser().getUsername())) {
            return ResponseEntity.ok(productRepo.findById(id));
        }
    }
    return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
}

@GetMapping("product/{id}")
ResponseEntity<?> viewProduct(@PathVariable int id) {
    Optional<Product> product123 = productRepo.findById(id);
    if(sellerTestpass) {
        return ResponseEntity.status(404).body(null);
    }
    if (product123.isPresent()) {
        Product product = product123.get();
        if (product.getSeller().getUsername().equals(getUser().getUsername())) {
            return ResponseEntity.ok(productRepo.findById(id));
        }
    }
    return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
}

Public controller apis


@Autowired
AuthenticationManager authenticationManager;

@Scheduled(initialDelay = 10000,fixedDelay = 30000)
public void abc() {
    System.out.println("Hey its the scheduler");
}

@GetMapping("product/search")
ResponseEntity<?> searchPublic(@RequestParam String keyword){
    List<Product> findByProductName = productRepo.findByProductNameContainingIgnoreCaseOrCategoryCategoryNameContainingIgnoreCase(keyword,keyword);
    return ResponseEntity.ok(findByProductName);
}

@PostMapping("login")
ResponseEntity<?> login(@RequestBody HashMap<String,Object>abc){
    String userName = (String) abc.get("username");
    String password= (String) abc.get("password");
    doAuthenticate(userName, password);
    User user=authService.loadUserByUsername(userName);

    if(!user.getPassword().equals(password)) {
        return  ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
    }

    if (user != null) {
        String token = jwtUtil.generateToken(user);
        return ResponseEntity.ok(token);
    }

    return  ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
}

private void doAuthenticate(String email, String password) {

    UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(email, password);
    try {
        authenticationManager.authenticate(authentication);

    } catch (BadCredentialsException e) {
        throw new BadCredentialsException(" Invalid Username or Password  !!");
    }
}

Durg—-
MyCOnffig

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration builder) throws Exception {
        return builder.getAuthenticationManager();
    }

Spring security filter extends onceperrequestFileter

public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private Logger logger = LoggerFactory.getLogger(OncePerRequestFilter.class);
    @Autowired
    private JwtHelper jwtHelper;


    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {

//        try {
//            Thread.sleep(500);
//        } catch (InterruptedException e) {
//            throw new RuntimeException(e);
//        }
        //Authorization

        String requestHeader = request.getHeader("Authorization");
        //Bearer 2352345235sdfrsfgsdfsdf
        logger.info(" Header :  {}", requestHeader);
        String username = null;
        String token = null;
        if (requestHeader != null && requestHeader.startsWith("Bearer")) {
            //looking good
            token = requestHeader.substring(7);
            try {

                username = this.jwtHelper.getUsernameFromToken(token);

            } catch (IllegalArgumentException e) {
                logger.info("Illegal Argument while fetching the username !!");
                e.printStackTrace();
            } catch (ExpiredJwtException e) {
                logger.info("Given jwt token is expired !!");
                e.printStackTrace();
            } catch (MalformedJwtException e) {
                logger.info("Some changed has done in token !! Invalid Token");
                e.printStackTrace();
            } catch (Exception e) {
                e.printStackTrace();

            }


        } else {
            logger.info("Invalid Header Value !! ");
        }


        //
        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {


            //fetch user detail from username
            UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
            Boolean validateToken = this.jwtHelper.validateToken(token, userDetails);
            if (validateToken) {

                //set the authentication
                UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(authentication);


            } else {
                logger.info("Validation fails !!");
            }


        }

        filterChain.doFilter(request, response);


    }
}

Securtity config file…Cors

    @Autowired
    private JwtAuthenticationEntryPoint point;
    @Autowired
    private JwtAuthenticationFilter filter;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

        http.csrf(csrf -> csrf.disable())
                .authorizeRequests().
                requestMatchers("/test").authenticated().requestMatchers("/auth/login").permitAll()
                .anyRequest()
                .authenticated()
                .and().exceptionHandling(ex -> ex.authenticationEntryPoint(point))
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
        http.addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }

Controller to login

@Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private AuthenticationManager manager;


    @Autowired
    private JwtHelper helper;

    private Logger logger = LoggerFactory.getLogger(AuthController.class);


    @PostMapping("/login")
    public ResponseEntity<JwtResponse> login(@RequestBody JwtRequest request) {

        this.doAuthenticate(request.getEmail(), request.getPassword());


        UserDetails userDetails = userDetailsService.loadUserByUsername(request.getEmail());
        String token = this.helper.generateToken(userDetails);

        JwtResponse response = JwtResponse.builder()
                .jwtToken(token)
                .username(userDetails.getUsername()).build();
        return new ResponseEntity<>(response, HttpStatus.OK);
    }

    private void doAuthenticate(String email, String password) {

        UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(email, password);
        try {
            manager.authenticate(authentication);


        } catch (BadCredentialsException e) {
            throw new BadCredentialsException(" Invalid Username or Password  !!");
        }

    }

    @ExceptionHandler(BadCredentialsException.class)
    public String exceptionHandler() {
        return "Credentials Invalid !!";
    }

Thiết kế website giá rẻ

Danh mục

applying the security configuration showing,USer not getting Authenticated