cn.watsontech.core.web.spring.security

类 TimeKeyBasedPersistenceTokenService

java.lang.Object

cn.watsontech.core.web.spring.security.TimeKeyBasedPersistenceTokenService

所有已实现的接口:

TokenService, org.springframework.beans.factory.InitializingBean

public class TimeKeyBasedPersistenceTokenService
extends Object
implements TokenService, org.springframework.beans.factory.InitializingBean

Basic implementation of TokenService that is compatible with clusters and across machine restarts, without requiring database persistence.

Keys are produced in the format:

Base64(creationTime + ":" + expireTime + ":" + hex(pseudoRandomNumber) + ":" + extendedInformation + ":" + Sha512Hex(creationTime + ":" + expireTime + ":" + hex(pseudoRandomNumber) + ":" + extendedInformation + ":" + serverSecret) )

In the above, creationTime, tokenKey and extendedInformation are equal to that stored in Token. The Sha512Hex includes the same payload, plus a serverSecret.

The serverSecret varies every millisecond. It relies on two static server-side secrets. The first is a password, and the second is a server integer. Both of these must remain the same for any issued keys to subsequently be recognised. The applicable serverSecret in any millisecond is computed by password + ":" + (creationTime % serverInteger). This approach further obfuscates the actual server secret and renders attempts to compute the server secret more limited in usefulness (as any false tokens would be forced to have a creationTime equal to the computed hash). Recall that framework features depending on token services should reject tokens that are relatively old in any event.

A further consideration of this class is the requirement for cryptographically strong pseudo-random numbers. To this end, the use of SecureRandomFactoryBean is recommended to inject the property.

This implementation uses UTF-8 encoding internally for string manipulation.

作者:

Ben Alex

构造器概要

构造器

构造器和说明
TimeKeyBasedPersistenceTokenService()

方法概要

限定符和类型	方法和说明
void	afterPropertiesSet()
org.springframework.security.core.token.Token	allocateToken(LoginUser loginUser, Long timeToLive) 仅使用loginUser的id和userType
void	setPseudoRandomNumberBytes(int pseudoRandomNumberBytes)
void	setSecureRandom(SecureRandom secureRandom)
void	setServerInteger(Integer serverInteger)
void	setServerSecret(String serverSecret)
org.springframework.security.core.token.Token	verifyToken(String key) Permits verification the Token.getKey() was issued by this TokenService and reconstructs the corresponding Token.

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

构造器详细资料

TimeKeyBasedPersistenceTokenService

public TimeKeyBasedPersistenceTokenService()

方法详细资料

allocateToken

public org.springframework.security.core.token.Token allocateToken(LoginUser loginUser,
                                                                   Long timeToLive)

仅使用loginUser的id和userType

指定者:

allocateToken 在接口中 TokenService

参数:

loginUser - the extended information desired in the token (cannot be null, but can be empty)

timeToLive - time to live in seconds

返回:

verifyToken

public org.springframework.security.core.token.Token verifyToken(String key)

从接口复制的说明: TokenService

Permits verification the Token.getKey() was issued by this TokenService and reconstructs the corresponding Token.

指定者:

verifyToken 在接口中 TokenService

参数:

key - as obtained from Token.getKey() and created by this implementation

返回:

the token, or null if the token was not issued by this TokenService

setServerSecret

public void setServerSecret(String serverSecret)

参数:

serverSecret - the new secret, which can contain a ":" if desired (never being sent to the client)

setSecureRandom

public void setSecureRandom(SecureRandom secureRandom)

setPseudoRandomNumberBytes

public void setPseudoRandomNumberBytes(int pseudoRandomNumberBytes)

参数:

pseudoRandomNumberBytes - changes the number of bytes issued (must be >= 0; defaults to 256)

setServerInteger

public void setServerInteger(Integer serverInteger)

afterPropertiesSet

public void afterPropertiesSet()

指定者:

afterPropertiesSet 在接口中 org.springframework.beans.factory.InitializingBean