• spring security 身份认证的实现

    目录

    一、引入依赖，开箱即用

    二、自定义用户名和密码

    三、自定义登陆页面

    一、引入依赖，开箱即用

    1、基于Spring Boot实现，首先引入依赖，版本跟随spring boot

    1. <!-- 实现对 Spring MVC 的自动化配置 --> 
    2. <dependency> 
    3.     <groupId>org.springframework.boot</groupId> 
    4.     <artifactId>spring-boot-starter-web</artifactId> 
    5. </dependency> 
    6.  
    7. <!-- 实现对 Spring Security 的自动化配置 --> 
    8. <dependency>
    9.     <groupId>org.springframework.boot</groupId> 
    10.     <artifactId>spring-boot-starter-security</artifactId>
    11. </dependency>

    2、编写 controller 

    1. import org.springframework.web.bind.annotation.GetMapping;
    2. import org.springframework.web.bind.annotation.RequestMapping;
    3. import org.springframework.web.bind.annotation.RestController;
    4.  
    5. /**
    6.  * @author Administrator
    7.  * @date 2019/7/6/006 20:25
    8.  * @Version 1.0
    9.  */
    10. @RestController
    11. @RequestMapping("/admin")
    12. public class AdminController {
    13.  
    14.     @GetMapping("/test")
    15.     public String test(){
    16.         return "Spring Security Test";
    17.     }
    18. }

    引入Spring Security之后 ，访问 API 接口时，需要首先进行登录，才能进行访问。

    测试 http://localhost:8080/admin/test，会跳转到

    该登陆页面通过以下接口生成：DefaultLoginPageGeneratingFilter#generateLoginPageHtml

    默认用户名：user，密码可以查看控制台日志获取，这个默认用户生成的逻辑在SecurityProperties.class 中，用户名和密码也可以通过属性配置进行覆盖。

    默认用户原理：

    默认情况下，UserDetailsServiceAutoConfiguration.class 自动化配置类会创建一个内存级别的

    InMemoryUserDetailsManager对象，提供认证的用户信息。

    • 添加 spring.security.user 配置项，UserDetailsServiceAutoConfiguration 会基于配置的信息在内存中创建一个用户User。
    • 未添加 spring.security.user 配置项，UserDetailsServiceAutoConfiguration 会自动在内存中创建一个用户名为 user，密码为 UUID 随机的用户 User。

    UserDetailsServiceAutoConfiguration#inMemoryUserDetailsManager

    1.     @Lazy
    2. 	public InMemoryUserDetailsManager inMemoryUserDetailsManager(
    3. 			SecurityProperties properties,
    4. 			ObjectProvider<PasswordEncoder> passwordEncoder) {
    5. 		SecurityProperties.User user = properties.getUser();
    6. 		List<String> roles = user.getRoles();
    7. 		return new InMemoryUserDetailsManager(User.withUsername(user.getName())
    8. 				.password(getOrDeducePassword(user, passwordEncoder.getIfAvailable()))
    9. 				.roles(StringUtils.toStringArray(roles)).build());
    10. 	}

    二、自定义用户名和密码

    1、方式一：基于UserDetailsService接口

    1. import org.springframework.security.core.authority.AuthorityUtils;
    2. import org.springframework.security.core.userdetails.User;
    3. import org.springframework.security.core.userdetails.UserDetails;
    4. import org.springframework.security.core.userdetails.UserDetailsService;
    5. import org.springframework.security.core.userdetails.UsernameNotFoundException;
    6. import org.springframework.stereotype.Service;
    7.  
    8. @Service
    9. public class MyUserDetailsService implements UserDetailsService {
    10.     // 用户信息
    11.     @Override
    12.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    13.         // 方式：1-内存、2-DB
    14.         // 需要处理密码编码，无编码{noop} 、 User(用户名，密码，权限)
    15.         UserDetails userDetails = new User("admin","{noop}123456",
    16.                 AuthorityUtils.commaSeparatedStringToAuthorityList("ADMIN"));
    17.         return userDetails;
    18.     }
    19. }

    注意

    1. UserDetails userDetails = new User("admin","{noop}123456",
    2.                 AuthorityUtils.commaSeparatedStringToAuthorityList("ADMIN"));

    Spring security5 中新增加了加密方式，并把原有的spring security的密码存储格式改了，修改后的密码存储格式为：{id}encodedPassword

    如果密码不指定加密方式{id}会抛异常：

    支持的加密方式可以通过 PasswordEncoderFactories.class 查看

    也可以通过增加PasswordEncoder配置指定加密方式，spring security官方推荐的加密方式 BCrypt

    1. import org.springframework.context.annotation.Bean;
    2. import org.springframework.context.annotation.Configuration;
    3. org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    4. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    5. import org.springframework.security.crypto.password.PasswordEncoder;
    6.  
    7. @Configuration // 标记为注解类
    8. public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
    9.     @Bean
    10.     public PasswordEncoder passwordEncoder() {
    11.         return new BCryptPasswordEncoder();
    12.     }
    13. }
    1. @Service
    2. public class MyUserDetailsService implements UserDetailsService {
    3.  
    4.     @Autowired
    5.     PasswordEncoder passwordEncoder;
    6.  
    7.     // 用户信息
    8.     @Override
    9.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    10.         // 方式：1-内存、2-DB
    11.         // 需要处理密码编码，无编码{noop} 、 User(用户名，密码，权限)
    12. //        UserDetails userDetails = new User("admin","{noop}123456",
    13. //                AuthorityUtils.commaSeparatedStringToAuthorityList("ADMIN"));
    14.  
    15.         UserDetails userDetails = new User("admin",passwordEncoder.encode("123456"),
    16.                 AuthorityUtils.commaSeparatedStringToAuthorityList("ADMIN"));
    17.         return userDetails;
    18.     }
    19. }

    2、方式二：基于配置类 WebSecurityConfigurerAdapter

    创建 WebSecurityConfig配置类，继承 WebSecurityConfigurerAdapter抽象类，实现 Spring Security 在 Web 场景下的自定义配置。

    注：springboot 项目中如果引入的是 spring-boot-starter-security 依赖可以不需要添加
    @EnableWebSecurity

    因为在 spring-boot-autoconfigure-2.3.5.RELEASE.jar!/META-INF/spring.factories 下SecurityAutoConfiguration.class 中已经有引入

    但如果引入的是 spring-security-config 和 spring-security-web 依赖，则需要添加@EnableWebSecurity注解。 // 非springboot项目

    （1）重写 #configure(AuthenticationManagerBuilder auth) 方法，实现 AuthenticationManager认证管理器。

    1. import org.springframework.context.annotation.Bean;
    2. import org.springframework.context.annotation.Configuration;
    3. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    4. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    5. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    6. import org.springframework.security.crypto.password.PasswordEncoder;
    7.  
    8. @Configuration // 标记为注解类
    9. public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
    10.     @Bean
    11.     public PasswordEncoder passwordEncoder() {
    12.         return new BCryptPasswordEncoder(); // 加密方式
    13.     }
    14.  
    15.     @Override
    16.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    17.         String password = passwordEncoder().encode("123456");
    18.         auth.inMemoryAuthentication() // 使用基于内存的InMemoryUserDetailsManager
    19.                 .passwordEncoder(passwordEncoder())  //使用 PasswordEncoder 密码编码器
    20.                 .withUser("admin").password(password).roles("admin") // 配置用户
    21.                 .and().withUser("admin2").password(password).roles("user");// 配置其他用户
    22.     }
    23. }

    （2）也可以重写WebSecurityConfigurerAdapter#userDetailsService()方法或者
    WebSecurityConfigurerAdapter#userDetailsServiceBean()，并通过@Bean交给spring管理

    1. @Configuration // 标记为注解类
    2. public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
    3.  
    4.     @Bean
    5.     public PasswordEncoder passwordEncoder() {
    6.         return new BCryptPasswordEncoder();
    7.     }
    8.  
    9. //    @Override
    10. //    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    11. //        String password = passwordEncoder().encode("123456");
    12. //        auth.inMemoryAuthentication() // 使用基于内存的InMemoryUserDetailsManager
    13. //                .passwordEncoder(passwordEncoder())  //使用 PasswordEncoder 密码编码器
    14. //                .withUser("admin").password(password).roles("admin") // 配置用户
    15. //                .and().withUser("admin2").password(password).roles("user");// 配置其他用户
    16. //    }
    17.  
    18.     @Bean
    19.     @Override
    20.     protected UserDetailsService userDetailsService() {
    21.         return username -> {
    22.             String pw = passwordEncoder().encode("123456");
    23.             return new User("admin", pw,
    24.                     AuthorityUtils.commaSeparatedStringToAuthorityList("admin,user"));
    25.         };
    26.     }
    27. }

    3、方式三：从数据库获取用户名和授权信息

    首先创建数据库表，用户表、角色表，权限表，用户角色关联表，角色权限关联表

    1. -- ----------------------------
    2. -- Table structure for tb_user 用户表
    3. -- ----------------------------
    4. DROP TABLE IF EXISTS `tb_user`;
    5. CREATE TABLE `tb_user`  (
    6.   `id` bigint(20) NOT NULL AUTO_INCREMENT,
    7.   `username` varchar(50) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL COMMENT '用户名',
    8.   `password` varchar(64) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL COMMENT '密码，加密存储',
    9.   `phone` varchar(20) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '注册手机号',
    10.   `email` varchar(50) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '注册邮箱',
    11.   `created` datetime NOT NULL,
    12.   `updated` datetime NOT NULL,
    13.   PRIMARY KEY (`id`) USING BTREE,
    14.   UNIQUE INDEX `username`(`username`) USING BTREE,
    15.   UNIQUE INDEX `phone`(`phone`) USING BTREE,
    16.   UNIQUE INDEX `email`(`email`) USING BTREE
    17. ) ENGINE = InnoDB AUTO_INCREMENT = 38 CHARACTER SET = utf8 COLLATE = utf8_general_ci COMMENT = '用户表' ROW_FORMAT = Dynamic;
    18.  
    19. -- ----------------------------
    20. -- Records of tb_user 用户数据
    21. -- ----------------------------
    22. INSERT INTO `tb_user` VALUES (37, 'admin', '$2a$10$9ZhDOBp.sRKat4l14ygu/.LscxrMUcDAfeVOEPiYwbcRkoB09gCmi', '158xxx xxxx', 'xxxxxxx@gmail.com', '2019-04-04 23:21:27', '2019-04-04 23:21:29');
    23.  
    24. -- ----------------------------
    25. -- Table structure for tb_role 角色表
    26. -- ---------------------------- 
    27. DROP TABLE IF EXISTS `tb_role`;
    28. CREATE TABLE `tb_role`  (
    29.   `id` bigint(20) NOT NULL AUTO_INCREMENT,
    30.   `parent_id` bigint(20) NULL DEFAULT NULL COMMENT '父角色',
    31.   `name` varchar(64) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '角色名称',
    32.   `en_name` varchar(64) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL COMMENT '角色英文名称',
    33.   `description` varchar(200) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '备注',
    34.   `created` datetime NOT NULL,
    35.   `updated` datetime NOT NULL,
    36.   PRIMARY KEY (`id`) USING BTREE
    37. ) ENGINE = InnoDB AUTO_INCREMENT = 38 CHARACTER SET = utf8 COLLATE = utf8_general_ci COMMENT = '角色表' ROW_FORMAT = Dynamic;
    38.  
    39. -- ----------------------------
    40. -- Records of tb_role 角色信息
    41. -- ----------------------------
    42. INSERT INTO `tb_role` VALUES (37, 0, '超级管理员', 'swadian', NULL, '2019-04-04 23:22:03', '2019-04-04 23:22:05');
    43.  
    44. -- ----------------------------
    45. -- Table structure for tb_permission  权限表
    46. -- ----------------------------
    47. DROP TABLE IF EXISTS `tb_permission`;
    48. CREATE TABLE `tb_permission`  (
    49.   `id` bigint(20) NOT NULL AUTO_INCREMENT,
    50.   `parent_id` bigint(20) NULL DEFAULT NULL COMMENT '父权限',
    51.   `name` varchar(64) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL COMMENT '权限名称',
    52.   `en_name` varchar(64) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL COMMENT '权限英文名称',
    53.   `url` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL COMMENT '授权路径',
    54.   `description` varchar(200) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '备注',
    55.   `created` datetime NOT NULL,
    56.   `updated` datetime NOT NULL,
    57.   PRIMARY KEY (`id`) USING BTREE
    58. ) ENGINE = InnoDB AUTO_INCREMENT = 49 CHARACTER SET = utf8 COLLATE = utf8_general_ci COMMENT = '权限表' ROW_FORMAT = Dynamic;
    59.  
    60. -- ----------------------------
    61. -- Records of tb_permission  权限信息
    62. -- ----------------------------
    63. INSERT INTO `tb_permission` VALUES (37, 0, '系统管理', 'System', '/', NULL, '2019-04-04 23:22:54', '2019-04-04 23:22:56');
    64. INSERT INTO `tb_permission` VALUES (38, 37, '用户管理', 'SystemUser', '/users/', NULL, '2019-04-04 23:25:31', '2019-04-04 23:25:33');
    65. INSERT INTO `tb_permission` VALUES (39, 38, '查看用户', 'SystemUserView', '', NULL, '2019-04-04 15:30:30', '2019-04-04 15:30:43');
    66. INSERT INTO `tb_permission` VALUES (40, 38, '新增用户', 'SystemUserInsert', '', NULL, '2019-04-04 15:30:31', '2019-04-04 15:30:44');
    67. INSERT INTO `tb_permission` VALUES (41, 38, '编辑用户', 'SystemUserUpdate', '', NULL, '2019-04-04 15:30:32', '2019-04-04 15:30:45');
    68. INSERT INTO `tb_permission` VALUES (42, 38, '删除用户', 'SystemUserDelete', '', NULL, '2019-04-04 15:30:48', '2019-04-04 15:30:45');
    69. INSERT INTO `tb_permission` VALUES (44, 37, '内容管理', 'SystemContent', '/contents/', NULL, '2019-04-06 18:23:58', '2019-04-06 18:24:00');
    70. INSERT INTO `tb_permission` VALUES (45, 44, '查看内容', 'SystemContentView', '/contents/view/**', NULL, '2019-04-06 23:49:39', '2019-04-06 23:49:41');
    71. INSERT INTO `tb_permission` VALUES (46, 44, '新增内容', 'SystemContentInsert', '/contents/insert/**', NULL, '2019-04-06 23:51:00', '2019-04-06 23:51:02');
    72. INSERT INTO `tb_permission` VALUES (47, 44, '编辑内容', 'SystemContentUpdate', '/contents/update/**', NULL, '2019-04-06 23:51:04', '2019-04-06 23:51:06');
    73. INSERT INTO `tb_permission` VALUES (48, 44, '删除内容', 'SystemContentDelete', '/contents/delete/**', NULL, '2019-04-06 23:51:08', '2019-04-06 23:51:10');
    74.  
    75. -- ----------------------------
    76. -- Table structure for tb_user_role 用户角色关联表
    77. -- ----------------------------
    78. DROP TABLE IF EXISTS `tb_user_role`;
    79. CREATE TABLE `tb_user_role`  (
    80.   `id` bigint(20) NOT NULL AUTO_INCREMENT,
    81.   `user_id` bigint(20) NOT NULL COMMENT '用户 ID',
    82.   `role_id` bigint(20) NOT NULL COMMENT '角色 ID',
    83.   PRIMARY KEY (`id`) USING BTREE
    84. ) ENGINE = InnoDB AUTO_INCREMENT = 38 CHARACTER SET = utf8 COLLATE = utf8_general_ci COMMENT = '用户角色表' ROW_FORMAT = Dynamic;
    85.  
    86. -- ----------------------------
    87. -- Records of tb_user_role 用户角色关联信息
    88. -- ----------------------------
    89. INSERT INTO `tb_user_role` VALUES (37, 37, 37);
    90.  
    91. -- ----------------------------
    92. -- Table structure for tb_role_permission 角色权限关联表
    93. -- ----------------------------
    94. DROP TABLE IF EXISTS `tb_role_permission`;
    95. CREATE TABLE `tb_role_permission`  (
    96.   `id` bigint(20) NOT NULL AUTO_INCREMENT,
    97.   `role_id` bigint(20) NOT NULL COMMENT '角色 ID',
    98.   `permission_id` bigint(20) NOT NULL COMMENT '权限 ID',
    99.   PRIMARY KEY (`id`) USING BTREE
    100. ) ENGINE = InnoDB AUTO_INCREMENT = 48 CHARACTER SET = utf8 COLLATE = utf8_general_ci COMMENT = '角色权限表' ROW_FORMAT = Dynamic;
    101.  
    102. -- ----------------------------
    103. -- Records of tb_role_permission 角色权限关信息
    104. -- ----------------------------
    105. INSERT INTO `tb_role_permission` VALUES (37, 37, 37);
    106. INSERT INTO `tb_role_permission` VALUES (38, 37, 38);
    107. INSERT INTO `tb_role_permission` VALUES (39, 37, 39);
    108. INSERT INTO `tb_role_permission` VALUES (40, 37, 40);
    109. INSERT INTO `tb_role_permission` VALUES (41, 37, 41);
    110. INSERT INTO `tb_role_permission` VALUES (42, 37, 42);
    111. INSERT INTO `tb_role_permission` VALUES (43, 37, 44);
    112. INSERT INTO `tb_role_permission` VALUES (44, 37, 45);
    113. INSERT INTO `tb_role_permission` VALUES (45, 37, 46);
    114. INSERT INTO `tb_role_permission` VALUES (46, 37, 47);
    115. INSERT INTO `tb_role_permission` VALUES (47, 37, 48);

    然后引入数据库相关依赖

    1.         <--mybaits plus 框架-->
    2.         <dependency>
    3.             <groupId>com.baomidou</groupId>
    4.             <artifactId>mybatis-plus-boot-starter</artifactId>
    5.             <version>3.3.2</version>
    6.         </dependency>
    7.         <--mysql-->
    8.         <dependency>
    9.             <groupId>mysql</groupId>
    10.             <artifactId>mysql-connector-java</artifactId>
    11.             <version>5.1.39</version>
    12.         </dependency>
    13.         <dependency>
    14.             <groupId>org.projectlombok</groupId>
    15.             <artifactId>lombok</artifactId>
    16.         </dependency>

    在配置文件 application.yml 中，配置数据源

    1. spring:
    2.   datasource:
    3.     driver-class-name: com.mysql.jdbc.Driver
    4.     url: jdbc:mysql://localhost:3306/security?useSSL=false
    5.     password: root
    6.     username: root

    关键步骤：修改获取用户信息的 MyUserDetailsService 逻辑，改为从数据库获取

    1. import com.baomidou.mybatisplus.core.toolkit.Wrappers;
    2. import com.swadian.security.entity.TbPermission;
    3. import com.swadian.security.entity.TbUser;
    4. import com.swadian.security.mapper.TbPermissionMapper;
    5. import com.swadian.security.mapper.TbUserMapper;
    6. import org.springframework.security.core.GrantedAuthority;
    7. import org.springframework.security.core.authority.SimpleGrantedAuthority;
    8. import org.springframework.security.core.userdetails.User;
    9. import org.springframework.security.core.userdetails.UserDetails;
    10. import org.springframework.security.core.userdetails.UserDetailsService;
    11. import org.springframework.security.core.userdetails.UsernameNotFoundException;
    12. import org.springframework.stereotype.Service;
    13. import org.springframework.util.StringUtils;
    14.  
    15. import javax.annotation.Resource;
    16. import java.util.ArrayList;
    17. import java.util.List;
    18.  
    19. @Service
    20. public class MyUserDetailsService implements UserDetailsService {
    21.  
    22.     @Resource // 用户表
    23.     private TbUserMapper userMapper;
    24.  
    25.     @Resource // 权限表
    26.     private TbPermissionMapper permissionMapper;
    27.  
    28.     public TbUser getByUsername(String username) {
    29.         return userMapper.selectList(Wrappers.lambdaQuery(TbUser.class).eq(TbUser::getUsername, username)
    30.         ).stream().findFirst().orElse(null);
    31.     }
    32.  
    33.     @Override
    34.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    35.         // 从mysql查询用户
    36.         TbUser user = getByUsername(username);
    37.         // 封装权限的集合
    38.         List authorities = new ArrayList<>();
    39.         if (user != null) {
    40.             // 获取用户的权限  用户->角色->权限：注,这个三个表的id被设置为一样，所以可以直接用 userId 获取权限
    41.             List permissions = permissionMapper.selectList(Wrappers.lambdaQuery(TbPermission.class)
    42.                     .eq(TbPermission::getId, user.getId()));
    43.             permissions.forEach(permission -> {
    44.                 if (permission != null && !StringUtils.isEmpty(permission.getEnName())) {
    45.                     GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(permission.getEnName());
    46.                     authorities.add(grantedAuthority);
    47.                 }
    48.             });
    49.             // 封装成UserDetails的实现类
    50.             return new User(user.getUsername(), user.getPassword(), authorities);
    51.         } else {
    52.             throw new UsernameNotFoundException("用户名不存在");
    53.         }
    54.     }
    55. }

    spring secutiry 的 配置如下：

    1. import com.swadian.security.service.MyUserDetailsService;
    2. import org.springframework.beans.factory.annotation.Autowired;
    3. import org.springframework.context.annotation.Bean;
    4. import org.springframework.context.annotation.Configuration;
    5. import org.springframework.context.annotation.Lazy;
    6. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    7. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    8. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    9. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    10. import org.springframework.security.crypto.password.PasswordEncoder;
    11.  
    12. @Configuration // 标记为注解类
    13. public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
    14.     @Autowired
    15.     @Lazy // 解决循环依赖
    16.     private MyUserDetailsService userService;
    17.  
    18.     @Bean
    19.     public PasswordEncoder passwordEncoder() {
    20.         return new BCryptPasswordEncoder();
    21.     }
    22.  
    23.     @Override
    24.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    25.         //设置UserDetailsService的实现类
    26.         auth.userDetailsService(userService);
    27.     }
    28.  
    29.     @Override
    30.     protected void configure(HttpSecurity http) throws Exception {
    31.         http.formLogin(); //表单提交
    32.         http.logout()
    33.                 .logoutUrl("/logout")
    34.                 .logoutSuccessUrl("/login.html"); // 退出后跳转到登陆页面
    35.         http.authorizeRequests()
    36.                 .antMatchers("/login.html", "/error.html", "/main.html").permitAll() // 不需要认证
    37.                 .anyRequest()
    38.                 .authenticated() // 认证拦截
    39.                 .and().csrf().disable(); //关闭csrf防护
    40.     }
    41. }

    修改下 controller 的内容，修改为返回用户信息

    1. @RestController
    2. @RequestMapping("/admin")
    3. public class AdminController {
    4.     @GetMapping("/test")
    5.     public Object test() {
    6.         // 返回用户信息
    7.         return SecurityContextHolder.getContext().getAuthentication().getPrincipal();
    8.     }
    9. }

    测试结果：

    从数据库获取用户信息成功

    三、自定义登陆页面

    默认登录页面通过DefaultLoginPageGeneratingFilter#generateLoginPageHtml生成，下边替换成自定义登陆页面：login.html

    1. <!DOCTYPE html>
    2. <html lang="en">
    3. <head>
    4.     <meta charset="UTF-8">
    5.     <title>Title</title>
    6. </head>
    7. <body>
    8.     <form action="/user/login" method="post">
    9.         用户名:<input type="text" name="username"/><br/>
    10.         密码： <input type="password"name="password"/><br/>
    11.         <input type="submit" value="提交"/>
    12.     </form>
    13. </body>
    14. </html>

    自定义登陆页面配置

    1. import com.swadian.userdemo.service.MyUserDetailsService;
    2. import org.springframework.beans.factory.annotation.Autowired;
    3. import org.springframework.context.annotation.Bean;
    4. import org.springframework.context.annotation.Configuration;
    5. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    6. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    7. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    8. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    9. import org.springframework.security.crypto.password.PasswordEncoder;
    10.  
    11. @Configuration // 标记为注解类
    12. public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
    13.     @Autowired
    14.     private MyUserDetailsService userService;
    15.  
    16.     @Bean
    17.     public PasswordEncoder passwordEncoder() {
    18.         return new BCryptPasswordEncoder();
    19.     }
    20.  
    21.     @Override
    22.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    23.         //设置UserDetailsService的实现类
    24.         auth.userDetailsService(userService);
    25.     }
    26.  
    27.     // 自定义登陆页面配置
    28.     @Override
    29.     protected void configure(HttpSecurity http) throws Exception {
    30.         http.formLogin() //表单提交
    31.                 .loginPage("/login.html") //自定义登录页面
    32.                 .loginProcessingUrl("/user/login") //登录访问路径，必须和表单提交接口一样
    33.                 //.usernameParameter("my-username") // 自定义参数名
    34.                 //.passwordParameter("my-password")
    35.                 //.defaultSuccessUrl("/main.html") //认证成功之后跳转的路径
    36.                 .successForwardUrl("/login/main")  //认证成功之后转发的路径,必须是Post请求
    37.                 .failureForwardUrl("/login/error") //认证失败之后转发的路径,必须是Post请求
    38.                 .and()
    39.                 // 认证配置
    40.                 .authorizeRequests() //设置哪些路径可以直接访问，不需要认证
    41.                 .antMatchers("/user/login", "/login.html","/error.html","/main.html").permitAll()
    42.                 .anyRequest()
    43.                 .authenticated() //需要认证
    44.                 .and().csrf().disable(); //关闭csrf防护
    45.     }
    46.  
    47.     //    @Bean
    48. //    @Override
    49. //    protected UserDetailsService userDetailsService() {
    50. //        return username -> {
    51. //            String pw = passwordEncoder().encode("123456");
    52. //            return new User("admin", pw,
    53. //                    AuthorityUtils.commaSeparatedStringToAuthorityList("admin,user"));
    54. //        };
    55. //    }
    56. }

    通过successForwardUrl和failureForwardUrl设置登录成功和失败后的跳转页面

    1. import org.springframework.stereotype.Controller;
    2. import org.springframework.web.bind.annotation.RequestMapping;
    3.  
    4. @Controller
    5. @RequestMapping("/login")
    6. public class LoginController {
    7.     @RequestMapping("/main") // 认证成功后执行方法
    8.     public String main() {
    9.         return "redirect:/main.html"; // 跳转页面
    10.     }
    11.  
    12.     @RequestMapping("/error") // 认证失败后执行方法
    13.     public String error() {
    14.         return "redirect:/error.html";
    15.     }
    16. }

    需要注意的点，代码和页面两边的路径需要保持一致

    页面路径，统一放在资源包static下，至于为什么在static，后续可以探讨下

    使用过滤器的页面重定向

    比如想实现登录成功后重定向其他页面，可以利用AuthenticationSuccessHandler接口实现自定义的认证成功控制器。

    1. import org.springframework.security.core.Authentication;
    2. import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
    3.  
    4. import javax.servlet.ServletException;
    5. import javax.servlet.http.HttpServletRequest;
    6. import javax.servlet.http.HttpServletResponse;
    7. import java.io.IOException;
    8.  
    9. public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    10.     // 重定向 url
    11.     private String redirectUrl;
    12.  
    13.     public MyAuthenticationSuccessHandler(String redirectUrl) {
    14.         this.redirectUrl = redirectUrl;
    15.     }
    16.  
    17.     @Override
    18.     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
    19.         response.sendRedirect(redirectUrl);
    20.     }
    21. }

    在代码中使用 successHandler() 进行配置

    1.     // 自定义登陆页面配置
    2.     @Override
    3.     protected void configure(HttpSecurity http) throws Exception {
    4.         http.formLogin() //表单提交
    5.                 .loginPage("/login.html") //自定义登录页面
    6.                 .loginProcessingUrl("/my-user/login") //登录访问路径，必须和表单提交接口一样
    7.                 .successHandler(new MyAuthenticationSuccessHandler("/main.html"))
    8.                 .and()
    9.                 .authorizeRequests() //设置哪些路径可以直接访问，不需要认证
    10.                 .antMatchers("/login.html","/error.html","/main.html").permitAll()
    11.                 .anyRequest()
    12.                 .authenticated() //需要认证
    13.                 .and().csrf().disable(); //关闭csrf防护
    14.     }

    同样的，当登录认证失败后，想做一些事情，可以实现AuthenticationFailureHandler接口。

  • 相关阅读:
    浏览器工作原理与实践学习笔记（一）宏观视角下的浏览器
    一、MongoDB安装（CentOS7）
    JSP 基本介绍及使用。
    shell脚本之文件读写
    IDEA Error: java: -source 1.5中不支持 lambda 表达式和 Error:java: Compilation failed
    是的，决定放弃算法去机器学习了
    游戏设计模式专栏(十三）：在Cocos游戏开发中运用责任链模式
    【云原生之Docker实战】使用docker部署Wiznote私人笔记系统
    新手开抖店之前，这三个核心点，一定要提前了解！
    软件测试高频面试题真实分享/网上银行转账是怎么测的，设计一下测试用例。
  • 原文地址：https://blog.csdn.net/swadian2008/article/details/126191823