Angular前端与Spring后端之间的安全通信可以使用以下解决方案:
在Angular前端中,可以使用Angular的HttpClient模块来发送请求。以下是一个示例代码:
import { HttpClient, HttpHeaders } from '@angular/common/http';
@Injectable()
export class ApiService {
private apiUrl = 'http://localhost:8080/api';
private headers = new HttpHeaders({ 'Content-Type': 'application/json' });
constructor(private http: HttpClient) {}
login(username: string, password: string): Observable {
const body = { username: username, password: password };
return this.http.post(`${this.apiUrl}/login`, body, { headers: this.headers });
}
getData(): Observable {
const token = localStorage.getItem('token'); // 从localStorage中获取保存的令牌
const headers = this.headers.append('Authorization', `Bearer ${token}`);
return this.http.get(`${this.apiUrl}/data`, { headers: headers });
}
}
在Spring后端中,可以使用Spring Security来处理身份验证和授权。以下是一个示例代码:
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private UserDetailsService userDetailsService;
@Autowired
private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
@Bean
public JwtAuthenticationFilter jwtAuthenticationFilter() {
return new JwtAuthenticationFilter();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.cors().and().csrf().disable()
.authorizeRequests()
.antMatchers("/api/login").permitAll()
.anyRequest().authenticated()
.and()
.exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint)
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}
@Service
public class UserDetailsServiceImpl implements UserDetailsService {
@Autowired
private UserRepository userRepository;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = userRepository.findByUsername(username);
if (user == null) {
throw new UsernameNotFoundException("User not found with username: " + username);
}
return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(),
new ArrayList<>());
}
}
@RestController
@RequestMapping("/api")
public class ApiController {
@Autowired
private AuthenticationManager authenticationManager;
@Autowired
private JwtTokenProvider jwtTokenProvider;
@PostMapping("/login")
public ResponseEntity authenticateUser(@RequestBody LoginRequest loginRequest) {
Authentication authentication = authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(loginRequest.getUsername(), loginRequest.getPassword()));
SecurityContextHolder.getContext().setAuthentication(authentication);
String jwt = jwtTokenProvider.generateToken(authentication);
return ResponseEntity.ok(new JwtAuthenticationResponse(jwt));
}
@GetMapping("/data")
public ResponseEntity getData() {
// 处理请求,返回数据
return ResponseEntity.ok("Some data");
}
}
以上是一个简单的示例代码,实现了基于Token的身份验证和安全通信。在实际应用中,可能还需要添加更多的安全措施,例如对角色和权限的控制,以及HTTPS的使用来保护通信。