Kisso = cookie SSO is a cookie-based SSO middleware, which is a Swiss Army knife for rapid development of java web login systems (SSO).
SpringMvc is a demo of kisso-based sso
Log in and out
1. Start and enter the http://localhost:8080/login user kisso password 123
2. Log in successfully, check the browser and find the kisso cookie, you have successfully integrated kisso!!
3. Log out of the http://localhost:8080/logout to see the kisso cookie disappears
Permissions
1. Login Access http://localhost:8080/test/permission/index.html has the permission to display the logged-in user
2. Test without permission to access http://localhost:8080/test/permission/userinfo.html Enter the no permission interface
Kisso Spring Boot demo
1. Start the execution of Application
2. Access
http://localhost:8080/token prompted to log in
3. Log in to access
http://localhost:8080/login Successfully go to the 2 steps to view
warehouse
https://search.maven.org/search?q=g:com.baomidou
<dependency>
<groupId>com.baomidou</groupId>
<artifactId>kisso</artifactId>
<version>3.8.1</version>
</dependency>
Use documentation
To generate a jwt ticket, the access request header is set to ‘accessToken=ticket content’, which is suitable for single sign-on in the front and back separation mode
String jwtToken = SSOToken.create().setId(1).setIssuer(“admin”).setOrigin(TokenOrigin.HTML5).getToken();
Parse the ticket
SSOToken ssoToken = SSOToken.parser(jwtToken);
Cookie Pattern Settings
SSOHelper.setCookie(request, response, new SSOToken().setId(String.valueOf(1)).setIssuer(“admin”));
Login Privilege Interceptor class SSOSpringInterceptor
Annotations do not intercept @LoginIgnore
yml config kisso.config….
Spring Boot
@ControllerAdvice
@Configuration
public class WebConfig implements WebMvcConfigurer {
@Override
public void addInterceptors(InterceptorRegistry registry) {
SSO Authorized Interceptor
SSOSpringInterceptor ssoInterceptor = new SSOSpringInterceptor();
ssoInterceptor.setHandlerInterceptor(new LoginHandlerInterceptor());
registry.addInterceptor(ssoInterceptor).addPathPatterns(“/**”).excludePathPatterns(“/v1/sso/**”);
}
}
Default HS512 algorithm
HS512 key, the configuration parameter kisso.config.sign-key
SSOHelper.getHS512SecretKey()
Toggle the RS512 algorithm
1. Configure the algorithm
kisso.config.sign-algorithm = RS512
2. Configure the private key public key certificate, and place the resources directory by default
RSA key, configuration parameter kisso.config.rsa-jks-store
Other parameters: CN=Server, OU=Unit, O=Organization, L=City, S=State, and C=US
RSA generates a jks key
$ keytool -genkeypair -alias jwtkey -keyalg RSA -dname “CN=llt” -keypass keypassword -keystore key.jks -storepass jkspassword
RSA generates certificates
RSA public key, configuration parameter kisso.config.rsa-cert-store
$ keytool -export -alias jwtkey -file public.cert -keystore key.jks -storepass jkspassword
Common security policies
1. Cookies marked as Secure should only be sent to the server via requests encrypted by the HTTPS protocol. With the HTTPS security protocol, cookies are protected from theft and tampering during transmission between the browser and the web server
2. HTTPOnly Setting the HTTPOnly attribute can prevent client scripts from accessing cookies through documents such as document.cookie, which can help avoid XSS attacks
3. SameSite The SameSite attribute prevents cookies from being sent when requested across sites, thus preventing CSRF attacks
SameSite can have the following three values:
1. Strict only allows one party to request to carry cookies, that is, the browser will only send cookies requested by the same site, that is, the URL of the current web page is exactly the same as the URL of the request.
2. Lax allows some third parties to request the porting of cookies
3. None will send cookies regardless of whether it is cross-site or not
The reason why cookies cannot be obtained now is because it was None by default, and Lax is defaulted to Chrome 80
The security configuration is as follows:
kisso:
config:
# Enabling HTTPS is effective and the transmission is more secure
cookie-secure: true
# Prevent XSS from scripting attacks
cookie-http-only: true
# Prevent CSRF cross-site attacks
cookie-same-site: Lax
# Encryption algorithm RSA
sign-algorithm: RS512
