springsecurity接入微信扫码登录

要在Spring Security中使用微信扫码登录，您需要完成以下步骤：

1. 在微信开放平台上创建应用程序并配置授权域名。

2. 在应用程序中创建一个扫码登录的方式，获取重定向URL和state参数。

3. 在Spring Security配置中添加一个OAuth2客户端，包括客户端ID、客户端密钥、授权域和重定向URL。

4. 创建一个自定义的OAuth2认证过滤器，用于处理微信回调请求。

以下是一个简单的示例，演示如何在Spring Security中使用微信扫码登录：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private OAuth2AuthorizedClientService authorizedClientService;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/login/**").permitAll()
                .anyRequest().authenticated()
                .and()
            .oauth2Login()
                .redirectionEndpoint()
                    .baseUri("/login/oauth2/code/wechat")
                    .and()
                .userInfoEndpoint()
                    .userService(wechatOAuth2UserService())
                    .and()
                .authorizedClientService(authorizedClientService)
                .and()
            .logout()
                .logoutUrl("/logout")
                .logoutSuccessUrl("/")
                .permitAll();
    }

    @Bean
    public OAuth2UserService<OAuth2UserRequest, OAuth2User> wechatOAuth2UserService() {
        return new WechatOAuth2UserService();
    }

    private static class WechatOAuth2UserService implements OAuth2UserService<OAuth2UserRequest, OAuth2User> {

        @Override
        public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
            // 获取微信用户信息
            Map<String, Object> userInfo = userRequest.getAdditionalParameters();
            String openid = (String) userInfo.get("openid");
            String nickname = (String) userInfo.get("nickname");
            String avatarUrl = (String) userInfo.get("headimgurl");
            // 构造OAuth2User对象
            return new DefaultOAuth2User(Collections.singleton(new SimpleGrantedAuthority("ROLE_USER")),
                    userInfo, "openid");
        }
    }

    @Bean
    public OAuth2AuthorizedClientRepository authorizedClientRepository() {
        return new HttpSessionOAuth2AuthorizedClientRepository();
    }

    @Bean
    public OAuth2AuthorizedClientService authorizedClientService(
            OAuth2ClientRegistrationRepository clientRegistrationRepository,
            OAuth2AuthorizedClientRepository authorizedClientRepository) {
        return new DefaultOAuth2AuthorizedClientService(clientRegistrationRepository, authorizedClientRepository);
    }

    @Bean
    public ClientRegistrationRepository clientRegistrationRepository() {
        // 配置微信OAuth2客户端
        ClientRegistration wechat = ClientRegistration.withRegistrationId("wechat")
                .clientId("your-client-id")
                .clientSecret("your-client-secret")
                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                .redirectUriTemplate("{baseUrl}/login/oauth2/code/{registrationId}")
                .scope("snsapi_login")
                .authorizationUri("https://open.weixin.qq.com/connect/qrconnect")
                .tokenUri("https://api.weixin.qq.com/sns/oauth2/access_token")
                .userInfoUri("https://api.weixin.qq.com/sns/userinfo")
                .userNameAttributeName("openid")
                .clientName("Wechat")
                .build();
        return new InMemoryClientRegistrationRepository(wechat);
    }

    @Bean
    public OAuth2AuthorizationRequestRedirectFilter oauth2AuthorizationRequestRedirectFilter(
            OAuth2AuthorizedClientService authorizedClientService) {
        // 自定义OAuth2认证过滤器，用于处理微信回调请求
        OAuth2AuthorizationRequestRedirectFilter filter = new OAuth2AuthorizationRequestRedirectFilter(
                clientRegistrationRepository(), authorizedClientRepository());
        filter.setAuthorizationRequestRepository(
                new HttpSessionOAuth2AuthorizationRequestRepository());
        filter.setAuthorizationUri("https://open.weixin.qq.com/connect/qrconnect");
        filter.setPrincipalExtractor(new OAuth2AccessTokenResponseClientAdapter(
                new DefaultOAuth2AccessTokenResponseClient()).getPrincipalExtractor());
        filter.setAuthorizationClientService(authorizedClientService);
        return filter;
    }

}

您需要替换上述代码中的`your-client-id`和`your-client-secret`为您的微信应用程序的客户端ID和客户端密钥。

此外，您还需要编写一个控制器来处理登录页面和回调URL：

@Controller
public class LoginController {

    @Autowired
    private OAuth2AuthorizedClientService authorizedClientService;

    @GetMapping("/login")
    public String login(HttpServletRequest request, Model model) {
        // 创建扫码登录URL和state参数
        String redirectUrl = "http://" + request.getServerName() + ":" + request.getServerPort() + "/login/oauth2/code/wechat";
        String state = UUID.randomUUID().toString().replaceAll("-", "");
        // 将state参数存储在会话中
        request.getSession().setAttribute("state", state);
        // 构造微信扫码登录URL
        String qrCodeUrl = "https://open.weixin.qq.com/connect/qrconnect?appid=your-app-id&redirect_uri=" + URLEncoder.encode(redirectUrl, "UTF-8") + "&response_type=code&scope=snsapi_login&state=" + state + "#wechat_redirect";
        model.addAttribute("qrCodeUrl", qrCodeUrl);
        return "login";
    }

    @GetMapping("/login/oauth2/code/wechat")
    public String loginCallback(HttpServletRequest request, HttpServletResponse response,
            @RequestParam("code") String code, @RequestParam("state") String state, Authentication authentication)
            throws IOException {
        // 验证state参数是否匹配
        String sessionState = (String) request.getSession().getAttribute("state");
        if (!state.equals(sessionState)) {
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid state parameter");
            return null;
        }
        // 使用OAuth2AuthorizedClientService获取访问令牌
        OAuth2AuthorizedClient authorizedClient = authorizedClientService.loadAuthorizedClient("wechat",
                authentication.getName());
        String accessToken = authorizedClient.getAccessToken().getTokenValue();
        // 处理用户登录逻辑
        // ...
        return "redirect:/";
    }

}

在`/login`请求中，我们构造了一个微信扫码登录的URL，并将其添加到模型中返回给用户。在`/login/oauth2/code/wechat`请求中，我们验证了回调请求中的state参数，并使用`OAuth2AuthorizedClientService`获取访问令牌，然后处理用户登录逻辑。