Spring Security 实现IP白名单机制

Spring Security提供了IP白名单机制的实现。具体实现步骤如下：

1. 创建IP白名单过滤器

public class IpFilter extends OncePerRequestFilter {
    private final Logger logger = LoggerFactory.getLogger(getClass());

    private List<String> allowList;

    public IpFilter(List<String> allowList) {
        this.allowList = allowList;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String ipAddress = request.getHeader("X-FORWARDED-FOR");
        if (ipAddress == null) {
            ipAddress = request.getRemoteAddr();
        }
        if (!allowList.contains(ipAddress)) {
            logger.warn("IP {} is not allowed.", ipAddress);
            response.setStatus(HttpStatus.FORBIDDEN.value());
            return;
        }
        filterChain.doFilter(request, response);
    }
}

2. 注册IP白名单过滤器

在Spring Security配置类中注册IP白名单过滤器：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    private List<String> allowList = Arrays.asList("127.0.0.1", "192.168.1.1");

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.addFilterBefore(new IpFilter(allowList), BasicAuthenticationFilter.class)
            .authorizeRequests()
            .anyRequest().authenticated()
            .and()
            .httpBasic();
    }
}

3. 测试IP白名单机制

启动应用程序并使用浏览器或其他HTTP客户端进行测试。如果客户端的IP地址在allowList中，则可以成功访问受保护的资源；否则，将返回HTTP状态码403。