• Spring Boot Security使用 JDBC 和 MySQL 进行 RBAC，自定义登录验证，登录界面增加kaptcha验证码

     在本教程中，我将指导您如何编写代码，以使用具有基于表单的身份验证的Spring安全API来保护Spring Boot应用程序中的网页。用户详细信息存储在MySQL数据库中，并使用春季JDBC连接到数据库。我们将从本教程中的 ProductManager 项目开始，向现有的弹簧启动项目添加登录和注销功能。

    1. 创建用户表和虚拟凭据

    凭据应存储在数据库中，因此让我们创建新表，表间关系ER图如下：

    1. -- --------------------------------------------------------
    2. -- 主机:                           127.0.0.1
    3. -- 服务器版本:                        8.0.22 - MySQL Community Server - GPL
    4. -- 服务器操作系统:                      Win64
    5. -- HeidiSQL 版本:                  12.1.0.6537
    6. -- --------------------------------------------------------
    7.  
    8. /*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
    9. /*!40101 SET NAMES utf8 */;
    10. /*!50503 SET NAMES utf8mb4 */;
    11. /*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
    12. /*!40103 SET TIME_ZONE='+00:00' */;
    13. /*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
    14. /*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
    15. /*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;
    16.  
    17.  
    18. -- 导出 product3 的数据库结构
    19. CREATE DATABASE IF NOT EXISTS `product3` /*!40100 DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci */ /*!80016 DEFAULT ENCRYPTION='N' */;
    20. USE `product3`;
    21.  
    22. -- 导出  表 product3.permissions 结构
    23. CREATE TABLE IF NOT EXISTS `permissions` (
    24.   `name` varchar(30) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
    25.   `description` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
    26.   PRIMARY KEY (`name`)
    27. ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
    28.  
    29. -- 正在导出表  product3.permissions 的数据：~3 rows (大约)
    30. INSERT INTO `permissions` (`name`, `description`) VALUES
    31. 	('ADMIN', NULL),
    32. 	('DELETE', 'delete'),
    33. 	('READ', 'read'),
    34. 	('WRITE', 'write');
    35.  
    36. -- 导出  表 product3.product 结构
    37. CREATE TABLE IF NOT EXISTS `product` (
    38.   `id` bigint NOT NULL AUTO_INCREMENT,
    39.   `brand` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
    40.   `madein` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
    41.   `name` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
    42.   `price` float NOT NULL,
    43.   PRIMARY KEY (`id`)
    44. ) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
    45.  
    46. -- 正在导出表  product3.product 的数据：~1 rows (大约)
    47. INSERT INTO `product` (`id`, `brand`, `madein`, `name`, `price`) VALUES
    48. 	(1, '666', '666', '数据库', 222);
    49.  
    50. -- 导出  表 product3.roles 结构
    51. CREATE TABLE IF NOT EXISTS `roles` (
    52.   `name` varchar(20) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
    53.   `description` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
    54.   PRIMARY KEY (`name`)
    55. ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
    56.  
    57. -- 正在导出表  product3.roles 的数据：~3 rows (大约)
    58. INSERT INTO `roles` (`name`, `description`) VALUES
    59. 	('ADMIN', 'Administrator role'),
    60. 	('USER_P1', 'Perfil 1'),
    61. 	('USER_P2', 'Perfil 2');
    62.  
    63. -- 导出  表 product3.roles_permissions 结构
    64. CREATE TABLE IF NOT EXISTS `roles_permissions` (
    65.   `role_name` varchar(20) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
    66.   `permission` varchar(30) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
    67.   PRIMARY KEY (`role_name`,`permission`),
    68.   KEY `RP_1` (`role_name`),
    69.   KEY `RP_2` (`permission`),
    70.   CONSTRAINT `RP_1` FOREIGN KEY (`role_name`) REFERENCES `roles` (`name`),
    71.   CONSTRAINT `RP_2` FOREIGN KEY (`permission`) REFERENCES `permissions` (`name`)
    72. ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
    73.  
    74. -- 正在导出表  product3.roles_permissions 的数据：~4 rows (大约)
    75. INSERT INTO `roles_permissions` (`role_name`, `permission`) VALUES
    76. 	('ADMIN', 'ADMIN'),
    77. 	('ADMIN', 'DELETE'),
    78. 	('ADMIN', 'READ'),
    79. 	('ADMIN', 'WRITE'),
    80. 	('USER_P1', 'READ'),
    81. 	('USER_P2', 'DELETE'),
    82. 	('USER_P2', 'WRITE');
    83.  
    84. -- 导出  表 product3.users 结构
    85. CREATE TABLE IF NOT EXISTS `users` (
    86.   `username` varchar(15) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
    87.   `email` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
    88.   `name` varchar(65) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
    89.   `password` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
    90.   `enabled` int DEFAULT NULL,
    91.   PRIMARY KEY (`username`)
    92. ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
    93.  
    94. -- 正在导出表  product3.users 的数据：~3 rows (大约)
    95. INSERT INTO `users` (`username`, `email`, `name`, `password`, `enabled`) VALUES
    96. 	('admin', 'admin@example.com', 'Administrator', '$2a$10$2/LSmp3YoEOT97KzgrYODen7I88ErBovM2Qehw9DL1dW9DZ7DZSAm', 1),
    97. 	('u1', 'u1@example.com', 'User P1', '$2a$10$2/LSmp3YoEOT97KzgrYODen7I88ErBovM2Qehw9DL1dW9DZ7DZSAm', 1),
    98. 	('u2', 'u2@example.com', 'User P2', '$2a$10$2/LSmp3YoEOT97KzgrYODen7I88ErBovM2Qehw9DL1dW9DZ7DZSAm', 1);
    99.  
    100. -- 导出  表 product3.users_roles 结构
    101. CREATE TABLE IF NOT EXISTS `users_roles` (
    102.   `username` varchar(15) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
    103.   `role_name` varchar(20) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
    104.   PRIMARY KEY (`username`,`role_name`),
    105.   KEY `UR_1` (`username`),
    106.   KEY `UR_2` (`role_name`),
    107.   CONSTRAINT `UR_1` FOREIGN KEY (`username`) REFERENCES `users` (`username`),
    108.   CONSTRAINT `UR_2` FOREIGN KEY (`role_name`) REFERENCES `roles` (`name`)
    109. ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
    110.  
    111. -- 正在导出表  product3.users_roles 的数据：~0 rows (大约)
    112. INSERT INTO `users_roles` (`username`, `role_name`) VALUES
    113. 	('admin', 'ADMIN'),
    114. 	('u1', 'USER_P1'),
    115. 	('u2', 'USER_P2');
    116.  
    117. /*!40103 SET TIME_ZONE=IFNULL(@OLD_TIME_ZONE, 'system') */;
    118. /*!40101 SET SQL_MODE=IFNULL(@OLD_SQL_MODE, '') */;
    119. /*!40014 SET FOREIGN_KEY_CHECKS=IFNULL(@OLD_FOREIGN_KEY_CHECKS, 1) */;
    120. /*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
    121. /*!40111 SET SQL_NOTES=IFNULL(@OLD_SQL_NOTES, 1) */;

    2. 配置数据源属性

    接下来，在应用程序属性文件中指定数据库连接信息，如下所示：根据您的MySQL数据库更新URL，用户名和密码。

    1. spring.jpa.hibernate.ddl-auto=update
    2. spring.datasource.url=jdbc:mysql://localhost:3306/product3?autoReconnect=true&useSSL=false&useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai
    3. spring.datasource.username=root
    4. spring.datasource.password=root
    5. #logging.level.root=WARN

    3. 声明弹簧安全性和 MySQL JDBC 驱动程序的依赖关系

    要将Spring安全API用于项目，请在pom.xml文件中声明以下依赖项：并且要将JDBC与弹簧启动和MySQL一起使用：请注意，依赖项版本已由弹簧启动初学者父项目定义。

    1. "1.0" encoding="UTF-8"?>
    2. <project xmlns="http://maven.apache.org/POM/4.0.0"
    3.          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    4.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    5.     <modelVersion>4.0.0modelVersion>
    6.     <parent>
    7.         <groupId>org.springframework.bootgroupId>
    8.         <artifactId>spring-boot-starter-parentartifactId>
    9.         <version>2.7.4version>
    10.         <relativePath /> 
    11.     parent>
    12.     <groupId>net.codejavagroupId>
    13.     <artifactId>ProductManagerJDBCAuthenticationManuallyAuthenticateCaptchaartifactId>
    14.     <version>2.0version>
    15.     <name>ProductManagerJDBCAuthenticationManuallyAuthenticateCaptchaname>
    16.     <description>ProductManagerJDBCAuthenticationdescription>
    17.     <packaging>jarpackaging>
    18.  
    19.     <properties>
    20.         <java.version>1.8java.version>
    21.     properties>
    22.  
    23.     <dependencies>
    24.         <dependency>
    25.             <groupId>org.springframework.bootgroupId>
    26.             <artifactId>spring-boot-starter-data-jpaartifactId>
    27.         dependency>
    28.         <dependency>
    29.             <groupId>org.springframework.bootgroupId>
    30.             <artifactId>spring-boot-starter-thymeleafartifactId>
    31.         dependency>
    32.         <dependency>
    33.             <groupId>org.springframework.bootgroupId>
    34.             <artifactId>spring-boot-starter-webartifactId>
    35.         dependency>
    36.         <dependency>
    37.             <groupId>org.springframework.bootgroupId>
    38.             <artifactId>spring-boot-devtoolsartifactId>
    39.         dependency>
    40.         <dependency>
    41.             <groupId>mysqlgroupId>
    42.             <artifactId>mysql-connector-javaartifactId>
    43.             <scope>runtimescope>
    44.         dependency>
    45.         <dependency>
    46.             <groupId>org.springframework.bootgroupId>
    47.             <artifactId>spring-boot-starter-securityartifactId>
    48.         dependency>
    49.         <dependency>
    50.             <groupId>org.thymeleaf.extrasgroupId>
    51.             <artifactId>thymeleaf-extras-springsecurity5artifactId>
    52.         dependency>
    53.         <dependency>
    54.             <groupId>com.github.pengglegroupId>
    55.             <artifactId>kaptchaartifactId>
    56.             <version>2.3.2version>
    57.         dependency>
    58.     dependencies>
    59.  
    60.     <build>
    61.         <plugins>
    62.             <plugin>
    63.                 <groupId>org.springframework.bootgroupId>
    64.                 <artifactId>spring-boot-maven-pluginartifactId>
    65.             plugin>
    66.         plugins>
    67.     build>
    68.  
    69. project>

    4. 配置 JDBC 身份验证详细信息

    要将 Spring 安全性与基于表单的身份验证和 JDBC 结合使用，请按如下方式创建 WebSecurityConfig 类：

    1. package net.codejava;
    2.  
    3. import javax.sql.DataSource;
    4.  
    5. import org.springframework.beans.factory.annotation.Autowired;
    6. import org.springframework.context.annotation.Bean;
    7. import org.springframework.context.annotation.Configuration;
    8. import org.springframework.http.HttpMethod;
    9. import org.springframework.security.authentication.AuthenticationManager;
    10. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    11. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    12. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    13. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    14. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    15.  
    16. @Configuration
    17. @EnableWebSecurity
    18. public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    19.  
    20.     @Autowired
    21.     private DataSource dataSource;
    22.  
    23.     @Bean
    24.     @Override
    25.     public AuthenticationManager authenticationManagerBean() throws Exception {
    26.         return super.authenticationManagerBean();
    27.     }
    28.  
    29.     @Autowired
    30.     public void configAuthentication(AuthenticationManagerBuilder authBuilder) throws Exception {
    31.         authBuilder.jdbcAuthentication()
    32.                 .dataSource(dataSource)
    33.                 .passwordEncoder(new BCryptPasswordEncoder())
    34.                 .usersByUsernameQuery("select username, password, enabled from users where username=?")
    35.                 .authoritiesByUsernameQuery("SELECT users.username,permissions.name FROM users,roles,users_roles,permissions,roles_permissions WHERE users.username=users_roles.username AND roles.name=users_roles.role_name AND roles.name=roles_permissions.role_name AND permissions.name=roles_permissions.permission AND users.username=?");
    36.     }
    37.  
    38.     @Override
    39.     protected void configure(HttpSecurity http) throws Exception {
    40.         http.authorizeRequests()
    41.                 .antMatchers("/edit/*", "/delete/*").hasAnyAuthority("ADMIN")
    42.                 .antMatchers("/common/**").permitAll()
    43.                 .antMatchers("/login").permitAll()
    44.                 .antMatchers("/verify").permitAll()
    45.                 .anyRequest().authenticated()
    46.                 .and()
    47.                 .formLogin().loginPage("/login")
    48.                 .permitAll()
    49.                 .and()
    50.                 .logout().permitAll()
    51.                 .and()
    52.                 .exceptionHandling().accessDeniedPage("/403");
    53.     }
    54.  
    55. }

    此安全配置类必须使用@EnableWebSecurity注释进行批注，并且是 Web 安全配置器适配器的子类。数据源对象的实例将由Spring框架创建并注入：

    1.     @Autowired
    2.     private DataSource dataSource;

    它将从应用程序属性文件中读取数据库连接信息。要使用JDBC配置身份验证，请编写以下方法：

    1.     @Autowired
    2.     public void configAuthentication(AuthenticationManagerBuilder authBuilder) throws Exception {
    3.         authBuilder.jdbcAuthentication()
    4.                 .dataSource(dataSource)
    5.                 .passwordEncoder(new BCryptPasswordEncoder())
    6.                 .usersByUsernameQuery("select username, password, enabled from users where username=?")
    7.                 .authoritiesByUsernameQuery("SELECT users.username,permissions.name FROM users,roles,users_roles,permissions,roles_permissions WHERE users.username=users_roles.username AND roles.name=users_roles.role_name AND roles.name=roles_permissions.role_name AND permissions.name=roles_permissions.permission AND users.username=?");
    8.     }

    如您所见，我们需要指定密码编码器（建议使用BCrypt），数据源和两个SQL语句：第一个根据用户名选择用户，第二个选择用户的角色。请注意，Spring安全性要求列名必须是用户名，密码，启用和角色。为了配置基于表单的身份验证，我们重写了 configure（HttpSecurity） 方法，如下所示：

    1.     @Override
    2.     protected void configure(HttpSecurity http) throws Exception {
    3.         http.authorizeRequests()
    4.                 .antMatchers("/edit/*", "/delete/*").hasAnyAuthority("ADMIN")
    5.                 .anyRequest().authenticated()
    6.                 .and()
    7.                 .formLogin().permitAll()
    8.                 .and()
    9.                 .logout().permitAll()
    10.                 .and()
    11.                 .exceptionHandling().accessDeniedPage("/403");
    12.     }

    在这里，我们指定所有请求都必须进行身份验证，这意味着用户必须登录才能使用该应用程序。使用Spring安全性提供的默认登录表单。要显示已登录用户的用户名，请在Thymeleaf模板文件中编写以下代码：

    1. <div sec:authorize="isAuthenticated()">
    2.                 Welcome <b><span sec:authentication="name">Usernamespan>b>
    3.                  
    4.                 <i><span sec:authentication="principal.authorities">Rolesspan>i>
    5.             div>

    并添加注销按钮：

    1.             <form th:action="@{/logout}" method="post">
    2.                 <input type="submit" value="Logout" />
    3.             form>

    如您所见，Spring Security将处理应用程序的登录和注销。我们不必编写重复的代码，只需指定一些配置即可。

    5.自定义登录验证过程

    1. package net.codejava;
    2.  
    3. import org.springframework.beans.factory.annotation.Autowired;
    4. import org.springframework.stereotype.Controller;
    5. import org.springframework.util.StringUtils;
    6. import org.springframework.web.bind.annotation.*;
    7.  
    8. import javax.servlet.http.HttpSession;
    9. import org.springframework.security.authentication.AuthenticationManager;
    10. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    11. import org.springframework.security.core.Authentication;
    12. import org.springframework.security.core.context.SecurityContext;
    13. import org.springframework.security.core.context.SecurityContextHolder;
    14. import static org.springframework.security.web.context.HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY;
    15.  
    16. @Controller
    17.  
    18. public class LoginController {
    19.  
    20.     /**
    21.      * 注入身份认证管理器
    22.      */
    23.     @Autowired
    24.     private AuthenticationManager authenticationManager;
    25.  
    26.     @GetMapping("/login")
    27.     public String login() {
    28.         return "login";
    29.     }
    30.  
    31.     @PostMapping(value = "/verify")
    32.     public String login(@RequestParam("username") String username,
    33.             @RequestParam("password") String password,
    34.             @RequestParam("verifyCode") String verifyCode,
    35.             HttpSession session) {
    36.         System.out.println("username is:" + username);
    37.         System.out.println("password is:" + password);
    38.         System.out.println("verifyCode is:" + verifyCode);
    39.         if (StringUtils.isEmpty(verifyCode)) {
    40.             session.setAttribute("errorMsg", "The verification code cannot be empty");
    41.             return "login";
    42.         }
    43.         if (StringUtils.isEmpty(username) || StringUtils.isEmpty(password)) {
    44.             session.setAttribute("errorMsg", "User name or password cannot be empty");
    45.             return "login";
    46.         }
    47.         String kaptchaCode = session.getAttribute("verifyCode") + "";
    48.         System.out.println("kaptchaCode is:" + kaptchaCode);
    49.         if (StringUtils.isEmpty(kaptchaCode) || !verifyCode.equals(kaptchaCode)) {
    50.             session.setAttribute("errorMsg", "Verification code error");
    51.             return "login";
    52.         }
    53. //        User user = userService.login(userName, password);
    54.  
    55.         System.out.println(username + "==" + password + "==" + verifyCode);
    56.         // 创建用户名与密码认证对象
    57.         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password);
    58.         try {
    59.             // 调用认证方法，返回认证对象
    60.             Authentication authenticate = authenticationManager.authenticate(token);
    61.             // 判断是否认证成功
    62.             if (authenticate.isAuthenticated()) {
    63.                 // 设置用户认证成功，往Session中添加认证通过信息
    64.                 SecurityContextHolder.getContext().setAuthentication(authenticate);
    65.                 SecurityContext sc = SecurityContextHolder.getContext();
    66.                 sc.setAuthentication(authenticate);
    67.                 session.setAttribute(SPRING_SECURITY_CONTEXT_KEY, sc);
    68.                 // 重定向到登录成功页面
    69.                 return "redirect:/";
    70.  
    71.             } else {
    72.                 session.setAttribute("errorMsg", "Login failed");
    73.                 return "login";
    74.             }
    75.         } catch (Exception ex) {
    76.             ex.printStackTrace();
    77.         }
    78.         return "login";
    79.     }
    80. }

    kaptcha验证码

    1. package net.codejava;
    2.  
    3. import com.google.code.kaptcha.impl.DefaultKaptcha;
    4. import org.springframework.beans.factory.annotation.Autowired;
    5. import org.springframework.stereotype.Controller;
    6. import org.springframework.web.bind.annotation.GetMapping;
    7.  
    8. import javax.imageio.ImageIO;
    9. import javax.servlet.ServletOutputStream;
    10. import javax.servlet.http.HttpServletRequest;
    11. import javax.servlet.http.HttpServletResponse;
    12. import java.awt.image.BufferedImage;
    13. import java.io.ByteArrayOutputStream;
    14.  
    15. @Controller
    16. public class KaptchaController {
    17.  
    18.     @Autowired
    19.     private DefaultKaptcha captchaProducer;
    20.  
    21.     @GetMapping("/common/kaptcha")
    22.     public void defaultKaptcha(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws Exception {
    23.         byte[] captchaOutputStream = null;
    24.         ByteArrayOutputStream imgOutputStream = new ByteArrayOutputStream();
    25.         try {
    26.             //Produce the verification code string and save it in the session
    27.             String verifyCode = captchaProducer.createText();
    28.             httpServletRequest.getSession().setAttribute("verifyCode", verifyCode);
    29.             BufferedImage challenge = captchaProducer.createImage(verifyCode);
    30.             ImageIO.write(challenge, "jpg", imgOutputStream);
    31.         } catch (IllegalArgumentException e) {
    32.             httpServletResponse.sendError(HttpServletResponse.SC_NOT_FOUND);
    33.             return;
    34.         }
    35.         captchaOutputStream = imgOutputStream.toByteArray();
    36.         httpServletResponse.setHeader("Cache-Control", "no-store");
    37.         httpServletResponse.setHeader("Pragma", "no-cache");
    38.         httpServletResponse.setDateHeader("Expires", 0);
    39.         httpServletResponse.setContentType("image/jpeg");
    40.         ServletOutputStream responseOutputStream = httpServletResponse.getOutputStream();
    41.         responseOutputStream.write(captchaOutputStream);
    42.         responseOutputStream.flush();
    43.         responseOutputStream.close();
    44.     }
    45.  
    46. }
    1. package net.codejava;
    2.  
    3. import com.google.code.kaptcha.impl.DefaultKaptcha;
    4. import com.google.code.kaptcha.util.Config;
    5. import org.springframework.context.annotation.Bean;
    6. import org.springframework.stereotype.Component;
    7.  
    8. import java.util.Properties;
    9.  
    10. @Component
    11. public class KaptchaConfig {
    12.  
    13.     @Bean
    14.     public DefaultKaptcha getDefaultKaptcha() {
    15.         DefaultKaptcha defaultKaptcha = new DefaultKaptcha();
    16.         Properties properties = new Properties();
    17.         properties.put("kaptcha.border", "no");
    18.         properties.put("kaptcha.textproducer.font.color", "black");
    19.         properties.put("kaptcha.image.width", "150");
    20.         properties.put("kaptcha.image.height", "40");
    21.         properties.put("kaptcha.textproducer.font.size", "30");
    22.         properties.put("kaptcha.session.key", "verifyCode");
    23.         properties.put("kaptcha.textproducer.char.space", "5");
    24.         Config config = new Config(properties);
    25.         defaultKaptcha.setConfig(config);
    26.  
    27.         return defaultKaptcha;
    28.     }
    29.  
    30. }

    6.登录页面

    1. html>
    2. <html xmlns:th="http://www.thymeleaf.org">
    3.     <head>
    4.         <meta charset="UTF-8">
    5.         <meta http-equiv="X-UA-Compatible" content="IE=edge">
    6.         <meta name="viewport" content="width=device-width, initial-scale=1.0">
    7.         <title>Bootstrap 5 Sign In Form with Image Exampletitle>
    8.         <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet"
    9.               integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous">
    10.         <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js"
    11.                 integrity="sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM"
    12.         crossorigin="anonymous">script>
    13.         <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css">
    14.     head>
    15.  
    16.     <body>
    17.         <form th:action="@{/verify}" method="post">
    18.             <div class="container-fluid vh-100" style="margin-top:50px">
    19.                 <div class="" style="margin-top:50px">
    20.                     <div class="rounded d-flex justify-content-center">
    21.                         <div class=" col-md-4 col-sm-12 shadow-lg p-5 bg-light">
    22.                             <div class="text-center">
    23.                                 <h3 class="text-primary">请登录h3>
    24.                             div>
    25.                             <div class="p-4">
    26.                                 <div class="input-group mb-3">
    27.                                     <span class="input-group-text bg-secondary"><i
    28.                                             class="bi bi-person-fill text-white">i>span>
    29.                                     <input id="username" type="text" name="username" required class="form-control" placeholder="用户名">
    30.                                 div>
    31.                                 <div class="input-group mb-3">
    32.                                     <span class="input-group-text bg-secondary"><i
    33.                                             class="bi bi-key-fill text-white">i>span>
    34.                                     <input  id="password" type="password" name="password" required class="form-control" placeholder="密码">
    35.                                 div>
    36.                                 <div class="input-group mb-3">
    37.                                     <span class="input-group-text bg-secondary"><i
    38.                                             class="bi bi-lock-fill text-white">i>span>
    39.                                     <input type="text" name="verifyCode"  class="form-control" placeholder="输入下图中的校验码">
    40.                                 div>
    41.                                 <div class="input-group mb-3">
    42.                                     <span class="input-group-text bg-secondary"><i
    43.                                             class="bi bi-image-fill text-white">i>span>
    44.                                     <img alt="Click the picture to refresh!" class="pointer" th:src="@{/common/kaptcha}"
    45.                                          onclick="this.src = '/common/kaptcha?d=' + new Date() * 1">
    46.                                 div>
    47.                                 <div class="col-12">
    48.                                     <button type="submit" class="btn btn-primary px-4 float-end mt-4">登录button>
    49.                                 div>
    50.  
    51.                             div>
    52.                         div>
    53.                     div>
    54.                 div>
    55.             div>
    56.     body>
    57.  
    58. html>

    5. 测试登录和注销

    启动Spring Boot应用程序并访问 http://localhost:8080 在Web浏览器中，您将看到自定义的登录页面出现：

     现在输入正确的用户名admin和密码admin，您将看到主页如下：

     

    并注意欢迎消息后跟用户名。用户现在已通过身份验证以使用该应用程序。单击“注销”按钮，您将看到自定义的登录页面出现，这意味着我们已成功实现登录并注销到我们的Spring Boot应用程序。

    结论：

    到目前为止，您已经学会了使用基于表单的身份验证和数据库内凭据来保护Spring Boot应用程序。您会看到 Spring 安全性使实现登录和注销功能变得非常容易，并且非常方便。为方便起见，您可以下载下面的示例项目。

    下载源码：https://github.com/allwaysoft/ProductManagerJDBCAuthenticationManuallyAuthenticateCaptcha/

  • 相关阅读:
    Python魔术方法
    扩展:文件属性chattr,隐藏权限主要用来防止root误删除
    判断input标签的type类型为checkbox是否被选中
    Linux目录操作
    ChatGLM3 本地部署的解决方案
    理“ Druid 元数据”之乱
    springWeb
    String类常用方法
    数据可视化项目（二）
    Cookie 能跨域吗？如何设置？
  • 原文地址：https://blog.csdn.net/allway2/article/details/127696327