1 Star 0 Fork 5.4K

yixiu / renren-security

forked from 人人开源 / renren-security 
加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
克隆/下载
贡献代码
同步代码
取消
提示: 由于 Git 不支持空文件夾,创建文件夹后会生成空的 .keep 文件
Loading...
README
Apache-2.0

项目说明

  1. 采用SpringBoot、MyBatis、Shiro框架,开发的一套权限系统,极低门槛,拿来即用。设计之初,就非常注重安全性,为企业系统保驾护航,让一切都变得如此简单。
  2. renren-admin是后台管理系统的核心项目,从该项目学习即可。
  3. renren-learnling是模仿renren-admin核心功能的学习代码,里面有详细的注释,每一个模块下面还有专门的md文件,想学习的同学可以对照这个项目学习。
  4. 该项目有比较详细的开发文档,建议联系作者购买,并按照模块学习,不要找我要,给钱也不能卖,我们要支持作者开源更多优秀的代码,您说对吧?
    文档地址:https://www.renren.io/guide/security

Fork renren-security,创建你自己的Learning模块,马上开始学习开源项目吧!!!

学习建议

  1. 在学习开源项目时,切记眼高手低,一定要动手实践,有时候你会发现,即使你直接复制别人的代码,也会有意想不到的报错,解决这些错误是进步最快的方法。
  2. 不要贪多,每天要专注解决一个问题。
  3. 学会搜索答案。多尝试不同的关键词搜索,打开几篇文档快速浏览,选择1篇仔细看,没必要看完,找打答案即可。
  4. 每日总结,我个人用的最简单的总结方式如下:
昨天:解决了什么问题,遗留什么问题。
今天:解决了什么问题,最大的收获是什么
明天:遗留问题,明天打算解决什么问题

动态多数据源

  • 需要连接多个数据库情况会用到多数据源,比如分库场景。

1.理解“spring注解”

  • spring注解功能相当强大,要先了解注解的概念和用法。
  • 可以看【spring注解总结.md】中提到的几篇参考文档,讲解的非常好。

2. 数据库连接池 druid

  • Druid是Java语言中最好的数据库连接池。Druid能够提供强大的监控和扩展功能。是阿里巴巴开源的。
  • 官方文档: https://github.com/alibaba/druid/tree/master/druid-spring-boot-starter
  • 将druid-spring-boot-starter项目源码下载下来,运行一下demo
  • 尝试配置druid,可以参考我写的例子
  • 尝试配置多数据源druid

3. MyBatis-Plus

  • MyBatis-Plus(简称 MP)是一个 MyBatis 的增强工具,在 MyBatis 的基础上只做增强不做改变,为简化开发、提高效率而生。
  • 官方文档:http://mp.baomidou.com/guide/quick-start.html#%E5%88%9D%E5%A7%8B%E5%8C%96%E5%B7%A5%E7%A8%8B
  • 可以尝试一下【快速开始】中的demo,确实非常方便。
  • 个人感觉,可以使用MyBatis-Plus的基本函数,至于那些类sql的语法在工程中少用好一些,
    mybatis之所以火的最大的原因是sql写在xml中,可维护性高,code review方便。

4. 面向切面编程Spring AOP

5.动态多数据源

  • 模仿着包io.renren.datasources下的类,自己敲一下。
  • 测试时,可以直接使用JdbcTemplate,非常简单,参考我的测试用例。

功能权限设计

1. 先熟悉RBAC的概念。

功能权限,业内一般选择:基于角色访问控制技术RBAC(Role Based Access Control)。

2. 熟悉Shiro的基本概念。

  • Apache Shiro是一个强大且易用的Java安全框架,执行身份验证、授权、密码和会话管理。
    使用Shiro的易于理解的API,您可以快速、轻松地获得任何应用程序,从最小的移动应用程序到最大的网络和企业应用程序。
  • 可以参考【权限框架Shiro说明.md】中提到的参考文章。

3. 实现security_admin中有关功能权限的部分

  • 有关Shiro功能权限的代码都在包com.yixiu.modules.shiro中。
  • SysLoginController是用来测试登录和权限的。
  • 实现过程中会出现很多错误,逐个解决即可。

数据权限设计

1. 核心思想

  • 通过sql层面的过滤条件实现数据权限的控制。
  • 比如有一个销售报表,表中应该添加两个字段dept_id(部门Id)和user_id(用户id)
  • 销售经理可以查看销售1组和销售2组的数据,实现的逻辑是:
    通过user_id查询所有角色roleIdList,
    通过roleIdList查询所有部门userDeptIdList;
    再通过用户所在部门查询所有的子部门subDeptIdList;
    将上面两个合并,组成t1.detp_id in(1,2)的形式。
  • 普通员工只有查看个人数据的权限,实现逻辑是:
    通过指定 t1.user_id=1的形式,查询该用户的数据。

2. 代码实现

  • 项目中使用了AOP的方式实现了数据权限的控制,对业务侵入小。
  • 通过@DataFilter自定义注解的方式,在需要数据权限控制的地方,添加该注解。
  • 切面类DataFilterAspect实现了控制逻辑。

XSS跨站脚本攻击

  • what: 指利用别人的网站漏洞,执行脚本,盗取用户信息,或做一些其它的恶意事情。
  • why: 如果你的网站上的用户信息被别人盗走了,或者别人打开你的网站就会弹出来一些色情广告,弹出来危害国家安全的言论,网站还能活吗?
  • how: 实现接口Filter的doFilter方法,重写XssHttpServletRequestWrapper的处理stream/header/param的方法,调用开源的HTMLFilter处理。

Sql注入

  • what: 通过web表单/url/请求参数,注入恶意SQL,从而获取数据或搞恶意破坏,比如删库。主要手段就是拼接sql。
  • why: sql注入的风险非常大,利用sql注入可以删掉你的数据库,或者把你数据库的数据搞走。
  • how: 执行sql之前,检查参数中的特殊字符和关键词,比如单引号,delete,drop等等。
    mybatis 通过parameterType限制参数类型,通过#{}对sql预编译,可以限制一部分sql注入。

Redis缓存

  • what: Redis是一个基于内存的key-value数据存储系统。
  • why: 速度快,支持类型多,最重要的用途是缓存。
  • how: 通过spring提供的redisTemplate来操作redis,通过AOP来控制是否执行redis代码。

分布式部署

  • what: 将系统分散的部署到多台机器上。
  • why: 一台机器处理能力有限,分散到多台机器上,可以提高系统的性能。
  • how: 分布式部署,无非就是解决session共享的问题,将Shiro中的session存储在redis中,从而解决分布式session共享问题。
    继承 EnterpriseCacheSessionDAO 类,定义我们的sessionManager即可。

异常处理

  • what: 用于处理系统中出现的异常状况的一种机制。
  • why: 系统异常不处理会导致系统崩溃,用户体检极差。
  • how: 自定义异常类,使用@ControllerAdvice拦截所有异常,统一处理后返回到前台。

后端校验

  • what: 验证数据是否合法。比如字段是否为空,数值是否在合法范围内等等。
  • why: 拦截非法数据,减少数据库操作。
  • how: 使用Hibernate Validator校验框架,封装一个静态方法供调用。

系统日志

  • what: 记录什么人,在什么时间,做了什么事情。比如:用户名,用户IP,执行方法,参数,执行时间,耗时等等。
  • why: 监控系统发生的事件。
  • how: 通过自定义注解和AOP的方式实现。

定时任务框架Quartz

  • what: Quartz是Job scheduling领域一个开源项目,主要用来执行定时任务。
  • why: 针对定时执行的任务,使用Quartz,扩展性好,功能强大。应用场景有:定时更新静态数据,自动结账,自动核算评价分数。
  • how: 最主要的是创建Job和Trigger,使用方法参考官方教程。

对象存储服务oss

  • what: 对象存储服务(Object Storage Service,简称 OSS),是云平台(如阿里云)提供的云存储服务。
    应用场景有:海量存储图片和音视频,动态资源(存在云服务器)和静态资源(存在oss)分离,云端处理(图片和视频)
  • why: 使用oss的好处有:海量、安全、低成本、高可靠,使用RESTful API 可以在互联网任何位置存储和访问,容量和处理能力弹性扩展,多种存储类型供选择全面优化存储成本。
  • how: 在云平台上购买服务,使用它们提供的api调用即可。
  • oss优点:海量的图片存储到hdfs中,会造成namenode节点中记录的元数据(记录文件名称/位置/时间等等)非常庞大;
    而将图片以key-value的形式直接存储到hbase中,key相当于访问路径,value就是实际的图片,存取方便,性能高,节省空间。

## Swagger生成接口文档

  • what: Swagger是接口管理系统,用来管理后台接口,方便前台和后台对接。
  • why: 前台和后台对接不规范,时间成本过高,文档管理混乱,前台过度依赖后台。
  • how: 添加swagger依赖,增加swagger配置类,在控制器方法上增加注解,访问swagger-ui.html即可。



前台

两套主题

  • index.html为adminlte主题,登录后默认为该主题;个人觉得该主题好看些。
  • index1.html为layui主题,登录后,将url中修改为index1.html,即可查看效果。

表格插件jqGrid

  • jqGrid是jquery插件,专门用来生成表格,最常用的就是用在列表页展示数据。通过ajax和后台交互。
  • 官方文档http://blog.mn886.net/jqGrid/
  • 前台传递参数:Map<String, Object>
reload: function (event) {
    vm.showList = true;   // 显示列表
    // 获取jqGrid参数page,是一个json对象,对应PageUtils的对象,这个也是后台返回到前台的数据格式
    var page = $("#jqGrid").jqGrid('getGridParam','page');
     // 设置jqGrid参数(键值对形式)
    $("#jqGrid").jqGrid('setGridParam',{ 
        postData:{'paramKey': vm.q.paramKey},  // 发送到后台的参数
        page:page								// 后台返回的参数
    }).trigger("reloadGrid");				// 触发器
}
  • 后台通过PageUtils序列化的json对象返回到前台,展示数据。

Vue框架

一个完整的页面例子 系统配置页面

  • 直接查看renren-admin下对应的页面,已经添加了详细的注释。
  • html代码: modules/sys/config.html
  • js代码: modules/sys/config.js
  • 后台控制器:SysConfigController
Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: You must give any other recipients of the Work or Derivative Works a copy of this License; and You must cause any modified files to carry prominent notices stating that You changed the files; and You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "{}" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2018 人人开源 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

简介

采用SpringBoot2.0、MyBatis、Shiro框架,开发的一套权限系统,极低门槛,拿来即用。 展开 收起
Java
Apache-2.0
取消

发行版

暂无发行版

贡献者

全部

近期动态

加载更多
不能加载更多了
Java
1
https://gitee.com/yixiu7/renren-security.git
git@gitee.com:yixiu7/renren-security.git
yixiu7
renren-security
renren-security
master

搜索帮助