SpringSecurity身份验证基础入门

2018-08-21 05:31:23来源：博客园阅读 ()

对于没有访问权限的用户需要转到登录表单页面。要实现访问控制的方法多种多样，可以通过Aop、拦截器实现，也可以通过框架实现（如：Apache Shiro、Spring Security）。

pom.xml添加依赖

 1 <dependency>
 2             <groupId>org.springframework.boot</groupId>
 3             <artifactId>spring-boot-starter-web</artifactId>
 4         </dependency>
 5  
 6         <dependency>
 7             <groupId>org.springframework.boot</groupId>
 8             <artifactId>spring-boot-starter-thymeleaf</artifactId>
 9         </dependency>
10         <dependency>
11             <groupId>org.springframework.boot</groupId>
12             <artifactId>spring-boot-starter-security</artifactId>
13         </dependency>

创建SpringSecurity配置类

 1 import org.springframework.beans.factory.annotation.Autowired;
 2 import org.springframework.context.annotation.Configuration;
 3 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 4 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 5 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 6 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 7  
 8 @Configuration
 9 @EnableWebSecurity
10 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
11  
12     @Override
13     protected void configure(HttpSecurity http) throws Exception {
14         http
15             .authorizeRequests()
16                 .antMatchers("/", "/home").permitAll()
17                 .anyRequest().authenticated()
18                 .and()
19             .formLogin()
20                 .loginPage("/login")
21                 .permitAll()
22                 .and()
23             .logout()
24                 .permitAll();
25     }
26  
27     @Autowired
28     public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
29         //inMemoryAuthentication 从内存中获取
30         auth
31                 .inMemoryAuthentication()
32                 .passwordEncoder(new BCryptPasswordEncoder())
33                 .withUser("admin")
34                 .password(new BCryptPasswordEncoder()
35                         .encode("123456")).roles("USER");
36     }
37 }

通过@EnableWebSecurity注解开启Spring Security的功能
继承WebSecurityConfigurerAdapter，并重写它的方法来设置一些web安全的细节
configure(HttpSecurity http)方法，通过authorizeRequests()定义哪些URL需要被保护、哪些不需要被保护。例如以上代码指定了/和/home不需要任何认证就可以访问，其他的路径都必须通过身份验证。
通过formLogin()定义当需要用户登录时候，转到的登录页面。
configureGlobal(AuthenticationManagerBuilder auth)方法，在内存中创建了一个用户，该用户的名称为admin，密码为123456，用户角色为USER。

控制器：

 1 @Controller
 2 public class HelloController {
 3  
 4     @RequestMapping("/")
 5     public String index() {
 6         return "index";
 7     }
 8  
 9     @RequestMapping("/hello")
10     public String hello() {
11         return "hello";
12     }
13  
14     @RequestMapping(value = "/login", method = RequestMethod.GET)
15     public String login() {
16         return "login";
17     }
18  
19 }

index.html

 1 <!DOCTYPE html>
 2 <html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"
 3       xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
 4 <head>
 5     <title>Spring Security入门</title>
 6 </head>
 7 <body>
 8 <h1>欢迎使用Spring Security!</h1>
 9  
10 <p>点击 <a th:href="@{/hello}">这里</a> 打个招呼吧</p>
11 </body>
12 </html>

hello.html

 1 <!DOCTYPE html>
 2 <html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"
 3       xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
 4 <head>
 5     <title>Hello World!</title>
 6 </head>
 7 <body>
 8 <h1 th:inline="text">Hello [[${#httpServletRequest.remoteUser}]]!</h1>
 9 <form th:action="@{/logout}" method="post">
10     <input type="submit" value="注销"/>
11 </form>
12 </body>
13 </html>

 1 <!DOCTYPE html>
 2 <html xmlns="http://www.w3.org/1999/xhtml"
 3       xmlns:th="http://www.thymeleaf.org"
 4       xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
 5 <head>
 6     <title>Spring Security Example </title>
 7 </head>
 8 <body>
 9 <div th:if="${param.error}">
10     用户名或密码错
11 </div>
12 <div th:if="${param.logout}">
13     您已注销成功
14 </div>
15 <form th:action="@{/login}" method="post">
16     <div><label> 用户名 : <input type="text" name="username"/> </label></div>
17     <div><label> 密 码 : <input type="password" name="password"/> </label></div>
18     <div><input type="submit" value="登录"/></div>
19 </form>
20 </body>
21 </html>