• SpringSecurity框架学习

    1 认识SpringSecurity

    1.1 认证

    设置配置文件

    1. @Configuration
    2. public class SecurityConfig extends WebSecurityConfigurerAdapter {
    3.  
    4.  	 @Bean
    5.     PasswordEncoder passwordEncoder() {
    6.     	return NoOpPasswordEncoder.getInstance();}
    7.     
    8.     //认证用户账号和密码
    9.     @Override
    10.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    11.         auth.inMemoryAuthentication()
    12.                 .withUser("admin")
    13.                 .password("123456").roles("admin");
    14.     }
    15.  
    16.     //静态资源不拦截
    17.     @Override
    18.     public void configure(WebSecurity web) throws Exception {
    19.         web.ignoring().antMatchers("/js/**", "/css/**","/images/**");
    20. }
    21.  
    22.     //表单登录设置
    23.     @Override
    24.     protected void configure(HttpSecurity http) throws Exception {
    25.         http
    26.             .authorizeRequests()
    27.                 .anyRequest().authenticated()
    28.                 .and()
    29.             .formLogin()
    30.                 .loginPage("/login.html")
    31.                 .permitAll()
    32.                 .and()
    33.             .csrf()
    34.                 .disable();
    35.     }
    36. }

    在 Spring Security 中，如果我们不做任何配置，默认的登录页面和登录接口的地址都是 /login，也就是说，默认会存在如下两个请求：

    GET http://localhost:8080/login

    POST http://localhost:8080/login

    可以通过 loginProcessingUrl 方法来指定登录接口地址 

     此时我们还需要修改登录页面里边的 action 属性，改为 /doLogin

     设置登录成功重定向：

    • defaultSuccessUrl：只设定一个参数时，指定登录成功的跳转页面为 /index，此时分两种情况：如果你是直接在浏览器中输入的登录地址，登录成功后，就直接跳转到 /index；如果你是在浏览器中输入了其他地址，例如 http://localhost:8080/hello，结果因为没有登录，又重定向到登录页面，此时登录成功后，是来到 /hello 页面。第二个参数如果不设置默认为 false，也就是我们上面的的情况，如果手动设置第二个参数为 true，则 defaultSuccessUrl 的效果和 successForwardUrl 一致。
    • successForwardUrl：不管你是从哪里来的，登录后一律跳转到 successForwardUrl 指定的地址。

    与登录成功相似，登录失败也是有两个方法：

    • failureForwardUrl：是登录失败之后会发生服务端跳转
    • failureUrl：则在登录失败之后，会发生重定向

    1.2 授权

    设置两个账号进行权限实验测试：

    1.  @Override
    2.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    3.         auth.inMemoryAuthentication()
    4.                 .withUser("lm").password("123123").roles("root")
    5.                 .and()
    6.                 .withUser("admin").password("123456").roles("admin")
    7.                 .and()
    8.                 .passwordEncoder(new UserPasswordEncoder());
    9.     }

    加密UserPasswordEncoder

    1. public class UserPasswordEncoder implements PasswordEncoder {
    2.  
    3.     @Override
    4.     public String encode(CharSequence charSequence) {
    5.         return charSequence.toString();
    6.     }
    7.  
    8.     @Override
    9.     public boolean matches(CharSequence charSequence, String s) {
    10.         return s.equals(charSequence.toString());
    11.     }
    12. }

    路径权配置

    1. http
    2.     .authorizeRequests()
    3.         .antMatchers("/lg/admin/**").hasRole("admin")
    4.         .antMatchers("/lg/root/**").hasRole("root")
    5.         .anyRequest().authenticated()
    6.         .and()
    7.         ...

    1）「hasAuthority(String)」 判断角色是否具有特定权限

    http.authorizeRequests().antMatchers("/main1.html").hasAuthority("admin")

    2）「hasAnyAuthority(String ...)」 如果用户具备给定权限中某一个，就允许访问

    http.authorizeRequests().antMatchers("/admin/read").hasAnyAuthority("xxx","xxx")

    3）「hasRole(String)」 如果用户具备给定角色就允许访问。否则出现403

    http.authorizeRequests().antMatchers("/admin/read").hasRole("管理员")

    4） 「hasAnyRole(String ...)」 如果用户具备给定角色的任意一个，就允许被访问

    http.authorizeRequests().antMatchers("/guest/read").hasAnyRole("管理员", "访客")

    5） 「hasIpAddress(String)」 请求是指定的IP就运行访问

    http.authorizeRequests().antMatchers("/ip").hasIpAddress("127.0.0.1")

    测试demo

    1. @Controller
    2. @RequestMapping("/lg")
    3. public class HelloControl {
    4.  
    5.     @RequestMapping(value = "/index",method = RequestMethod.GET)
    6.     public String userLogin(){
    7.         return "index";
    8.     }
    9.  
    10.     @RequestMapping(value = "/hello",method = RequestMethod.GET)
    11.     @ResponseBody
    12.     public String hello(){
    13.         return "this is hello";
    14.     }
    15.  
    16.     @RequestMapping(value = "/root",method = RequestMethod.GET)
    17.     @ResponseBody
    18.     public String root(){
    19.         return "this is root";
    20.     }
    21.  
    22.     @RequestMapping(value = "/admin",method = RequestMethod.GET)
    23.     @ResponseBody
    24.     public String admin(){
    25.         return "this is admin";
    26.     }
    27. }

    使用lm账号登录测试一下： 

     ​​​​​1.3 日志

    Spring Boot默认使用LogBack日志系统，如果不需要更改为其他日志系统如Log4j2等，则无需多余的配置，LogBack默认将日志打印到控制台上。

    使用日志功能，只需要在相应类上加上@Slf4j(lambok组件)注解，在对应方法中log.info(),log.error()等就可以输出日志。

     同时可以在application.properties里进行配置，将日志写入本地

    2 SpringSecurity 权限管理设计

    2.1 用户角色权限设计

    1）pom.xml配置

    1.         <dependency>
    2.             <groupId>org.mybatis.spring.bootgroupId>
    3.             <artifactId>mybatis-spring-boot-starterartifactId>
    4.             <version>2.1.2version>
    5.         dependency>
    6.         <dependency>
    7.             <groupId>org.projectlombokgroupId>
    8.             <artifactId>lombokartifactId>
    9.             <optional>trueoptional>
    10.         dependency>
    11.         
    12.         <dependency>
    13.             <groupId>com.alibabagroupId>
    14.             <artifactId>druid-spring-boot-starterartifactId>
    15.             <version>1.1.21version>
    16.         dependency>
    17.         <dependency>
    18.             <groupId>mysqlgroupId>
    19.             <artifactId>mysql-connector-javaartifactId>
    20.             <scope>runtimescope>
    21.         dependency>

    2）application.properties配置

    1. spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
    2. spring.datasource.url=jdbc:mysql://localhost:3306/springsecurity
    3. spring.datasource.username=root
    4. spring.datasource.password=rootlhc
    5. # 初始化配置
    6. spring.datasource.druid.initial-size=3
    7. # 最小连接数
    8. spring.datasource.druid.min-idle=3
    9. # 最大连接数
    10. spring.datasource.druid.max-active=15
    11. # 获取连接超时时间
    12. spring.datasource.druid.max-wait=5000
    13. # 连接有效性检测时间
    14. spring.datasource.druid.time-between-eviction-runs-millis=90000
    15. # 最大空闲时间
    16. spring.datasource.druid.min-evictable-idle-time-millis=1800000
    17. spring.datasource.druid.test-while-idle=true
    18. spring.datasource.druid.test-on-borrow=false
    19. spring.datasource.druid.test-on-return=false
    20. spring.datasource.druid.validation-query=select 1
    21. # 配置监控统计拦截的filters
    22. spring.datasource.druid.filters=stat
    23. spring.datasource.druid.web-stat-filter.url-pattern=/*
    24. spring.datasource.druid.web-stat-filter.exclusions="*.js,*.gif,*.jpg,*.bmp,*.png,*.css,*.ico,/druid/*"
    25. spring.datasource.druid.stat-view-servlet.enabled=true
    26. spring.datasource.druid.stat-view-servlet.url-pattern=/druid/*
    27. spring.datasource.druid.stat-view-servlet.reset-enable=true
    28. spring.datasource.druid.stat-view-servlet.login-username=admin
    29. spring.datasource.druid.stat-view-servlet.login-password=admin
    30. spring.jackson.date-format=yyyy-MM-dd HH:mm:ss
    31. spring.jackson.time-zone=GMT+8
    33. mybatis.type-aliases-package=com.lhc.lhcprojectdemo.util.entity
    34. mybatis.mapper-locations=classpath:/mappers/*
    35. mybatis.configuration.map-underscore-to-camel-case=true

    3）SysUser设置

    SysUser.java

    1. @Data
    2. @EqualsAndHashCode(callSuper = true)
    3. @NoArgsConstructor
    4. public class SysUser extends BaseEntity{
    5.     private static final long serialVersionUID = -6525908145032868837L;
    6.  
    7.     private Integer userId;
    8.  
    9.     private Integer deptId;
    10.  
    11.     private String userName;
    12.  
    13.     private String password;
    14.  
    15.     private String nickName;
    16.  
    17.     private String phone;
    18.  
    19.     private String email;
    20.  
    21.     private Integer status;
    22.  
    23.     public interface Status {
    24.         int LOCKED = 0;
    25.         int VALID = 1;
    26.     }
    27. }

    UserDao.java

    1. @Mapper
    2. public interface UserDao {
    3.     /**
    4.      * 分页返回所有用户
    5.      */
    6.     List getAllUserByPage(@Param("startPosition")Integer startPosition, @Param("limit")Integer limit);
    7.     
    8. }

    UserService.java

    1. public interface UserService {
    2.     ResultUtil getAllUsersByPage(Integer startPosition, Integer limit);
    3. }

    UserServiceImpl.java

    1. @Service
    2. public class UserServiceImpl implements UserService {
    3.     @Autowired
    4.     private UserDao userDao;
    5.  
    6.     @Override
    7.     public ResultUtil getAllUsersByPage(Integer startPosition, Integer limit) {
    8.         return ResultUtil.ok().data(userDao.getAllUserByPage(startPosition,limit)).code(ResultCode.TABLE_SUCCESS);
    9.     }
    10. }

    UseControl.java

    1. @Controller
    2. @RequestMapping("/api/user")
    3. public class UserControl {
    4.     @Autowired
    5.     private UserService userService;
    6.  
    7.     @GetMapping("/index")
    8.     @ResponseBody
    9.     public ResultUtil index(PageTableRequest pageTableRequest){
    10.         pageTableRequest.countOffset();
    11.         return userService.getAllUsersByPage(pageTableRequest.getOffset(),pageTableRequest.getLimit());
    12.     }
    13. }

    UserMapper.xml

    1. "1.0" encoding="UTF-8" ?>
    2. mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
    3. <mapper namespace="com.lhc.lhcprojectdemo.dao.UserDao">
    4.  
    5.     <select id="getAllUserByPage" resultType="com.lhc.lhcprojectdemo.util.entity.SysUser">
    6.         SELECT u.user_id,u.dept_id,u.user_name,u.password,u.nick_name,u.phone,u.email,u.status,u.create_time,u.update_time
    7.         FROM sys_user u
    8.         ORDER BY u.user_id
    9.     select>
    10.  
    11. mapper>

    4）测试 

    5）设置角色和权限

    sys_role

    sys_menu（可以简单设置sys_permit）

      然后关联user- role，menu-role（permit-role）

     2.2 security权限控制

    1）给API添加权限

     2）添加security配置注解

    3）认证授权

    1. @Autowired
    2. private UserDetailsService userDetailsService;
    3.  
    4. @Bean
    5. public PasswordEncoder passwordEncoder(){
    6.     return new BCryptPasswordEncoder();
    7. }
    8.  
    9. @Override
    10. protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    11.     auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    12. }

    4）自定义用户信息

    1. @Data
    2. @ToString
    3. public class JwtUserDto implements UserDetails {
    4.     /**
    5.      * 用户数据
    6.      */
    7.     private SysUser myUser;
    8.  
    9.     //private List roleInfo;
    10.     /**
    11.      * 用户权限的集合
    12.      */
    13.     @JsonIgnore
    14.     private List authorities;
    15.  
    16.     public List getRoles() {
    17.         return authorities.stream().map(GrantedAuthority::getAuthority).collect(Collectors.toList());
    18.     }
    19.  
    20.  
    21.     /**
    22.      * 加密后的密码
    23.      * @return
    24.      */
    25.     public String getPassword() {
    26.         return myUser.getPassword();
    27.     }
    28.  
    29.  
    30.     /**
    31.      * 用户名
    32.      * @return
    33.      */
    34.     public String getUsername() {
    35.         return myUser.getUserName();
    36.     }
    37.  
    38.  
    39.     /**
    40.      * 是否过期
    41.      * @return
    42.      */
    43.     public boolean isAccountNonExpired() {
    44.         return true;
    45.     }
    46.  
    47.  
    48.     /**
    49.      * 是否锁定
    50.      * @return
    51.      */
    52.     public boolean isAccountNonLocked() {
    53.         return true;
    54.     }
    55.  
    56.  
    57.     /**
    58.      * 凭证是否过期
    59.      * @return
    60.      */
    61.     public boolean isCredentialsNonExpired() {
    62.         return true;
    63.     }
    64.  
    65.  
    66.     /**
    67.      * 是否可用
    68.      * @return
    69.      */
    70.     public boolean isEnabled() {
    71.         return myUser.getStatus() == 1 ? true : false;
    72.     }
    73.  
    74.  
    75.     public JwtUserDto(SysUser sysUser, List authorities) {
    76.         this.myUser = sysUser;
    77.         this.authorities = authorities;
    78.     }
    79. }

    5）自定义一个UserDetailsServiceImpl实现UserDetailsService

    1. @Service
    2. @Slf4j
    3. public class UserDetailsServiceImpl implements UserDetailsService {
    4.  
    5.     @Autowired
    6.     private UserService userService;
    7.     @Autowired
    8.     private RoleService roleService;
    9.     @Autowired
    10.     private RoleUserService roleUserService;
    11.     @Autowired
    12.     private MenuDao menuDao;
    13.  
    14.     @Override
    15.     public JwtUserDto loadUserByUsername(String userName) throws UsernameNotFoundException {
    16.         SysUser user = userService.getUserByName(userName);//根据用户名获取用户
    17.         if (user == null ){
    18.             throw new UsernameNotFoundException("用户名不存在");//这个异常一定要抛
    19.         }else if (user.getStatus().equals(SysUser.Status.LOCKED)) {
    20.             throw new LockedException("用户被锁定,请联系管理员");
    21.         }
    22.         List grantedAuthorities = new ArrayList<>();
    23.         //菜单表中获取信息
    24.         List list = menuDao.listByUserId(user.getUserId());
    25.         
    26.         List collect = list.stream().map(MenuIndexDto::getPermission).collect(Collectors.toList());
    27.         for (String authority : collect){
    28.             if (!("").equals(authority) & authority !=null){
    29.                 GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(authority);
    30.                 //获取到user:list等具体权限
    31.                 grantedAuthorities.add(grantedAuthority);
    32.             }
    33.         }
    34.         JwtUserDto loginUser =new JwtUserDto(user,grantedAuthorities);
    35.         return loginUser;
    36.     }
    37. }

    2.3 引入验证码

    1）配置pom文件

    1.  
    2. <dependency>
    3.     <groupId>com.github.whvcsegroupId>
    4.     <artifactId>easy-captchaartifactId>
    5.     <version>1.6.2version>
    6. dependency>

     2）准备验证码生成control

    1. @Controller
    2. public class CaptchaController {
    3.  
    4.     @RequestMapping("/captcha")
    5.     public void captcha(HttpServletRequest request, HttpServletResponse response) throws Exception {
    6.         CaptchaUtil.out(120, 45, 4, request, response);
    7.     }
    8. }

    3）login.html登录界面配置验证码

    1. <div>
    2. <input id="captcha" name="captcha"  size="6" style="width:150px;height:40px" placeholder="验 证 码:" type="text">
    3. <img src="/captcha" width="130px" height="40px" onclick="this.src=this.src+'?'+Math.random()" title="点击刷新"/>
    4. div>

    4）验证码校验

    1. @Component
    2. public class VerifyCodeFilter extends OncePerRequestFilter {
    3.     private String defaultFilterProcessUrl = "/dologin";
    4.     private String method = "POST";
    5.  
    6.     @Override
    7.     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
    8.         if (method.equalsIgnoreCase(request.getMethod()) && defaultFilterProcessUrl.equals(request.getServletPath())) {
    9.             // 登录请求校验验证码，非登录请求不用校验
    10.             HttpSession session = request.getSession();
    11.             String requestCaptcha = request.getParameter("captcha");
    12.             //验证码的信息存放在seesion种，具体看EasyCaptcha官方解释
    13.             String genCaptcha = (String) request.getSession().getAttribute("captcha");
    14.             response.setContentType("application/json;charset=UTF-8");
    15.             if (requestCaptcha.isEmpty()){
    16.                 //删除缓存里的验证码信息
    17.                 session.removeAttribute("captcha");
    18.                 response.getWriter().write(JSON.toJSONString(ResultUtil.error().message("验证码不能为空!")));
    19.                 return;
    20.             }
    21.             if (genCaptcha.isEmpty()){
    22.                 response.getWriter().write(JSON.toJSONString(ResultUtil.error().message("验证码已失效!")));
    23.                 return;
    24.             }
    25.             if (!genCaptcha.equalsIgnoreCase(requestCaptcha)){
    26.                 session.removeAttribute("captcha");
    27.                 response.getWriter().write(JSON.toJSONString(ResultUtil.error().message("验证码错误!")));
    28.                 return;
    29.             }
    30.         }
    31.         chain.doFilter(request, response);
    32.     }
    33. }

    5）security配置

  • 相关阅读:
    「五度情报站」网罗全量企业情报，找客户、查竞品、寻商机！
    【数据结构】一种令人愉悦的链表——带头双向循环链表（代码实现）
    CAN - 基础
    “开源 vs. 闭源：大模型的未来发展趋势预测“——探讨大模型未来的发展方向
    mysql 主从复制
    聚精品，通全球 2024中国（杭州）国际电商物流包装产业展览会四月隆重开幕
    HDLBits-Edgedetect
    java毕业设计企业资产管理系统mybatis+源码+调试部署+系统+数据库+lw
    决策中心：构建企业长期战略竞争力
    ASP.NET Core - 依赖注入(一)
  • 原文地址：https://blog.csdn.net/xlsj228/article/details/121124366