• Spring Security入门教程，springboot整合Spring Security

    Spring Security是Spring官方推荐的认证、授权框架，功能相比Apache Shiro功能更丰富也更强大，但是使用起来更麻烦。

    如果使用过Apache Shiro，学习Spring Security会比较简单一点，两种框架有很多相似的地方。

    目录

    一、准备工作

    创建springboot项目

    pom.xml

    application.yml

    二、创建相关的类

    UserDetailsService

    SecurityConfig.java

    SystemProperties.java

    MybatisPlusConfig.java

    三、完成登录接口

    创建数据库实体类

    创建持久层接口

    创建登录DTO对象

    创建控制器类

    创建业务层类

    自定义登录成功处理器

    一、准备工作

    创建springboot项目

    首先，通过IntelliJ IDEA创建一个springboot项目，项目名为springboot-springsecurity，在pom.xml中添加相关依赖。

    pom.xml

    1. "1.0" encoding="UTF-8"?>
    2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    3.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    4.     <modelVersion>4.0.0modelVersion>
    5.  
    6.     <parent>
    7.         <groupId>org.springframework.bootgroupId>
    8.         <artifactId>spring-boot-starter-parentartifactId>
    9.         <version>2.3.4.RELEASEversion>
    10.         <relativePath />
    11.     parent>
    12.  
    13.     <groupId>com.examplegroupId>
    14.     <artifactId>springboot-springsecurityartifactId>
    15.     <version>0.0.1-SNAPSHOTversion>
    16.  
    17.     <properties>
    18.         <java.version>1.8java.version>
    19.         <jjwt.version>0.9.1jjwt.version>
    20.         <mysql.version>8.0.28mysql.version>
    21.         <druid.version>1.1.21druid.version>
    22.         <lombok.version>1.18.22lombok.version>
    23.         <mybatis.version>2.2.2mybatis.version>
    24.         <mybatis-plus.version>3.5.1mybatis-plus.version>
    25.     properties>
    26.  
    27.     <dependencies>
    28.         <dependency>
    29.             <groupId>org.springframework.bootgroupId>
    30.             <artifactId>spring-boot-starter-webartifactId>
    31.         dependency>
    32.  
    33.         
    34.         <dependency>
    35.             <groupId>org.springframework.bootgroupId>
    36.             <artifactId>spring-boot-starter-validationartifactId>
    37.         dependency>
    38.  
    39.         
    40.         <dependency>
    41.             <groupId>org.springframework.bootgroupId>
    42.             <artifactId>spring-boot-starter-securityartifactId>
    43.         dependency>
    44.  
    45.         
    46.         <dependency>
    47.             <groupId>mysqlgroupId>
    48.             <artifactId>mysql-connector-javaartifactId>
    49.             <version>${mysql.version}version>
    50.         dependency>
    51.  
    52.         
    53.         <dependency>
    54.             <groupId>com.alibabagroupId>
    55.             <artifactId>druidartifactId>
    56.             <version>${druid.version}version>
    57.         dependency>
    58.  
    59.         
    60.         <dependency>
    61.             <groupId>org.projectlombokgroupId>
    62.             <artifactId>lombokartifactId>
    63.             <version>${lombok.version}version>
    64.         dependency>
    65.  
    66.         
    67.         <dependency>
    68.             <groupId>org.mybatis.spring.bootgroupId>
    69.             <artifactId>mybatis-spring-boot-starterartifactId>
    70.             <version>${mybatis.version}version>
    71.         dependency>
    72.  
    73.         
    74.         <dependency>
    75.             <groupId>com.baomidougroupId>
    76.             <artifactId>mybatis-plus-boot-starterartifactId>
    77.             <version>${mybatis-plus.version}version>
    78.         dependency>
    79.  
    80.         
    81.         <dependency>
    82.             <groupId>io.jsonwebtokengroupId>
    83.             <artifactId>jjwtartifactId>
    84.             <version>${jjwt.version}version>
    85.         dependency>
    86.     dependencies>
    87.  
    88.     <build>
    89.         <plugins>
    90.             <plugin>
    91.                 <groupId>org.springframework.bootgroupId>
    92.                 <artifactId>spring-boot-maven-pluginartifactId>
    93.             plugin>
    94.         plugins>
    95.     build>
    96. project>

    application.yml

    1. server:
    2.   port: 8080
    3.   servlet:
    4.     context-path: /
    5.  
    6. spring:
    7.   datasource:
    8.     username: root
    9.     password: root
    10.     url: jdbc:mysql://localhost:3306/spring_security
    11.     driver-class-name: com.mysql.cj.jdbc.Driver
    12.     type: com.alibaba.druid.pool.DruidDataSource
    13.  
    14. mybatis-plus:
    15.   mapper-locations: classpath:mapper/*Mapper.xml
    16.  
    17. logging:
    18.   level:
    19.     springfox: error
    20.     com.example.security: debug
    21.  
    22.  
    23. system:
    24.   login-page: /login.html
    25.   login-url: /user/login
    26.   index-page: /index.html
    27.   logout-url: /user/logout
    28.   parameter:
    29.     username: username
    30.     password: password
    31.   white-url:
    32.     - /js/**
    33.     - /css/**
    34.     - /images/**
    35.     - /user/login
    36.     - /login.html

    二、创建相关的类

    UserDetailsService

    UserDetailsService接口是Spring Security中非常重要的接口，在登录认证的时候会通过这个接口的loadUserByUsername()方法获取用户的信息，来完成登录的用户名、密码校验，完成登录流程。

    我们需要创建一个UserDetailsService的实现类，并声明为Spring组件。

    1. package com.example.security.security;
    2.  
    3. import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
    4. import com.example.security.entity.User;
    5. import com.example.security.exception.GlobalException;
    6. import com.example.security.mapper.UserMapper;
    7. import com.example.security.restful.ResponseCode;
    8. import org.springframework.beans.factory.annotation.Autowired;
    9. import org.springframework.security.authentication.BadCredentialsException;
    10. import org.springframework.security.core.userdetails.UserDetails;
    11. import org.springframework.security.core.userdetails.UserDetailsService;
    12. import org.springframework.security.core.userdetails.UsernameNotFoundException;
    13. import org.springframework.stereotype.Component;
    14.  
    15. import java.util.ArrayList;
    16. import java.util.List;
    17.  
    18. /**
    19.  * @author heyunlin
    20.  * @version 1.0
    21.  */
    22. @Component
    23. public class UserDetailsServiceImpl implements UserDetailsService {
    24.  
    25.     private final UserMapper userMapper;
    26.  
    27.     @Autowired
    28.     public UserDetailsServiceImpl(UserMapper userMapper) {
    29.         this.userMapper = userMapper;
    30.     }
    31.  
    32.     @Override
    33.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    34.         // 查询用户信息
    35.         User user = selectByUsername(username);
    36.  
    37.         if (user == null) {
    38.             throw new BadCredentialsException("登录失败，用户名不存在！");
    39.         } else {
    40.             List permissions = selectPermissions(username);
    41.  
    42.             return org.springframework.security.core.userdetails.User.builder()
    43.                     .username(user.getUsername())
    44.                     .password(user.getPassword())
    45.                     .accountExpired(false)
    46.                     .accountLocked(false)
    47.                     .disabled(!user.getEnable())
    48.                     .credentialsExpired(false)
    49.                     .authorities(permissions.toArray(new String[] {}))
    50.                     .build();
    51.         }
    52.     }
    53.  
    54.     /**
    55.      * 通过用户名查询用户信息
    56.      * @param username 用户名
    57.      * @return User
    58.      */
    59.     private User selectByUsername(String username) {
    60.         QueryWrapper wrapper = new QueryWrapper<>();
    61.  
    62.         wrapper.eq("username", username);
    63.  
    64.         List list = userMapper.selectList(wrapper);
    65.  
    66.         if (list.size() == 1) {
    67.             return list.get(0);
    68.         }
    69.  
    70.         return null;
    71.     }
    72.  
    73.     /**
    74.      * 通过用户名查询用户权限
    75.      * @param username 用户名
    76.      * @return List
    77.      */
    78.     private List selectPermissions(String username) {
    79.         if (username == null) {
    80.             throw new GlobalException(ResponseCode.BAD_REQUEST, "用户名不能为空");
    81.         }
    82.  
    83.         List permissions = new ArrayList<>();
    84.  
    85.         permissions.add("/user/login");
    86.         permissions.add("/user/logout");
    87.         permissions.add("/user/selectById");
    88.  
    89.         return permissions;
    90.     }
    91.  
    92. }

    SecurityConfig.java

    创建security的配置类

    1. package com.example.security.config;
    2.  
    3. import com.example.security.security.LoginFailHandler;
    4. import com.example.security.security.LoginSuccessHandler;
    5. import org.springframework.beans.factory.annotation.Autowired;
    6. import org.springframework.context.annotation.Bean;
    7. import org.springframework.context.annotation.Configuration;
    8. import org.springframework.security.authentication.AuthenticationManager;
    9. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    10. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    11. import org.springframework.security.crypto.password.PasswordEncoder;
    12.  
    13. /**
    14.  * @author heyunlin
    15.  * @version 1.0
    16.  */
    17. @Configuration
    18. public class SecurityConfig extends WebSecurityConfigurerAdapter {
    19.  
    20.     private final SystemProperties systemProperties;
    21.  
    22.     @Autowired
    23.     public SecurityConfig(SystemProperties systemProperties) {
    24.         this.systemProperties = systemProperties;
    25.     }
    26.  
    27.     @Bean
    28.     public PasswordEncoder passwordEncoder() {
    29.         return new PasswordEncoder() {
    30.  
    31.             @Override
    32.             public String encode(CharSequence charSequence) {
    33.                 return (String) charSequence;
    34.             }
    35.  
    36.             @Override
    37.             public boolean matches(CharSequence charSequence, String s) {
    38.                 return charSequence.equals(s);
    39.             }
    40.         };
    41.     }
    42.  
    43.     @Bean
    44.     @Override
    45.     public AuthenticationManager authenticationManagerBean() throws Exception {
    46.         return super.authenticationManagerBean();
    47.     }
    48.  
    49.     @Override
    50.     protected void configure(HttpSecurity http) throws Exception {
    51.         // 禁用防跨域攻击
    52.         http.csrf().disable();
    53.  
    54.         // 配置各请求路径的认证与授权
    55.         http.formLogin()
    56.                 .loginPage(systemProperties.getLoginPage()) // 自定义登录页面的地址
    57.                 .loginProcessingUrl(systemProperties.getLoginUrl()) // 处理登录的接口地址
    58.                 .usernameParameter(systemProperties.getParameter().get("username")) // 用户名的参数名
    59.                 .passwordParameter(systemProperties.getParameter().get("password")) // 密码的参数名
    60.                 .successHandler(new LoginSuccessHandler(systemProperties))
    61.                 //.successForwardUrl("/index.html") // 登录成功跳转的地址
    62.                 .failureHandler(new LoginFailHandler()); // 登录失败的处理器
    63.  
    64.         // 退出登录相关配置
    65.         http.logout()
    66.                 .logoutUrl(systemProperties.getLogoutUrl()) // 退出登录的接口地址
    67.                 .logoutSuccessUrl(systemProperties.getLoginUrl()); // 退出登录成功跳转的地址
    68.  
    69.         // 配置认证规则
    70.         String[] toArray = systemProperties.getWhiteUrl().toArray(new String[]{});
    71.         http.authorizeRequests()
    72.                 .antMatchers(toArray).permitAll() // 白名单，也就是不需要登录也能访问的资源
    73.                 .anyRequest().authenticated();
    74.     }
    75.  
    76. }

    SystemProperties.java

    1. package com.example.security.config;
    2.  
    3. import lombok.Data;
    4. import org.springframework.boot.context.properties.ConfigurationProperties;
    5. import org.springframework.stereotype.Component;
    6.  
    7. import java.util.List;
    8. import java.util.Map;
    9.  
    10. /**
    11.  * @author heyunlin
    12.  * @version 1.0
    13.  */
    14. @Data
    15. @Component
    16. @ConfigurationProperties(prefix = "system")
    17. public class SystemProperties {
    18.  
    19.     /**
    20.      * 登录页面
    21.      */
    22.     private String loginPage;
    23.  
    24.     /**
    25.      * 登录的请求地址
    26.      */
    27.     private String loginUrl;
    28.  
    29.     /**
    30.      * 登录成功后跳转的页面
    31.      */
    32.     private String indexPage;
    33.  
    34.     /**
    35.      * 退出登录的请求地址
    36.      */
    37.     private String logoutUrl;
    38.  
    39.     /**
    40.      * 白名单
    41.      */
    42.     private List whiteUrl;
    43.  
    44.     /**
    45.      * 登录的参数
    46.      */
    47.     private Map parameter;
    48. }

    MybatisPlusConfig.java

    1. package com.example.security.config;
    2.  
    3. import com.baomidou.mybatisplus.annotation.DbType;
    4. import com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor;
    5. import com.baomidou.mybatisplus.extension.plugins.inner.BlockAttackInnerInterceptor;
    6. import com.baomidou.mybatisplus.extension.plugins.inner.PaginationInnerInterceptor;
    7. import org.mybatis.spring.annotation.MapperScan;
    8. import org.springframework.context.annotation.Bean;
    9. import org.springframework.context.annotation.Configuration;
    10.  
    11. /**
    12.  * @author heyunlin
    13.  * @version 1.0
    14.  */
    15. @Configuration
    16. @MapperScan(basePackages = "com.example.security.mapper")
    17. public class MybatisPlusConfig {
    18.  
    19.     @Bean
    20.     public MybatisPlusInterceptor mybatisPlusInterceptor() {
    21.         MybatisPlusInterceptor interceptor = new MybatisPlusInterceptor();
    22.  
    23.         // 防全表更新与删除插件
    24.         interceptor.addInnerInterceptor(new BlockAttackInnerInterceptor());
    25.         // 分页插件
    26.         interceptor.addInnerInterceptor(new PaginationInnerInterceptor(DbType.MYSQL));
    27.  
    28.         return interceptor;
    29.     }
    30.  
    31. }

    三、完成登录接口

    创建数据库实体类

    User.java

    1. package com.example.security.entity;
    2.  
    3. import com.baomidou.mybatisplus.annotation.IdType;
    4. import com.baomidou.mybatisplus.annotation.TableId;
    5. import com.baomidou.mybatisplus.annotation.TableName;
    6. import com.fasterxml.jackson.annotation.JsonFormat;
    7. import lombok.Data;
    8.  
    9. import java.io.Serializable;
    10. import java.time.LocalDateTime;
    11.  
    12. /**
    13.  * 用户
    14.  * @author heyunlin
    15.  * @version 1.0
    16.  */
    17. @Data
    18. @TableName("user")
    19. public class User implements Serializable {
    20. 	private static final long serialVersionUID = 18L;
    21.  
    22. 	@TableId(value = "id", type = IdType.INPUT)
    23. 	private String id;
    24.  
    25. 	/**
    26. 	 * 姓名
    27. 	 */
    28. 	private String name;
    29.  
    30. 	/**
    31. 	 * 性别
    32. 	 */
    33. 	private Integer gender;
    34.  
    35. 	/**
    36. 	 * 用户名
    37. 	 */
    38. 	private String username;
    39.  
    40. 	/**
    41. 	 * 密码
    42. 	 */
    43. 	private String password;
    44.  
    45. 	/**
    46. 	 * 手机号
    47. 	 */
    48. 	private String phone;
    49.  
    50. 	/**
    51. 	 * 是否启用
    52. 	 */
    53. 	private Boolean enable;
    54.  
    55. 	/**
    56. 	 * 最后一次登录时间
    57. 	 */
    58. 	@JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
    59. 	private LocalDateTime lastLoginTime;
    60. }

    创建持久层接口

    1. package com.example.security.mapper;
    2.  
    3. import com.baomidou.mybatisplus.core.mapper.BaseMapper;
    4. import com.example.security.entity.User;
    5. import org.springframework.stereotype.Repository;
    6.  
    7. /**
    8.  * @author heyunlin
    9.  * @version 1.0
    10.  */
    11. @Repository
    12. public interface UserMapper extends BaseMapper {
    13.  
    14. }

    创建登录DTO对象

    1. package com.example.security.dto;
    2.  
    3. import lombok.Data;
    4.  
    5. import javax.validation.constraints.NotEmpty;
    6. import javax.validation.constraints.NotNull;
    7. import java.io.Serializable;
    8.  
    9. /**
    10.  * @author heyunlin
    11.  * @version 1.0
    12.  */
    13. @Data
    14. public class UserLoginDTO implements Serializable {
    15.     private static final long serialVersionUID = 18L;
    16.  
    17.     /**
    18.      * 用户名
    19.      */
    20.     @NotNull(message = "用户名不允许为空")
    21.     @NotEmpty(message = "用户名不允许为空")
    22.     private String username;
    23.  
    24.     /**
    25.      * 密码
    26.      */
    27.     @NotNull(message = "密码不允许为空")
    28.     @NotEmpty(message = "密码不允许为空")
    29.     private String password;
    30. }

    创建控制器类

    1. package com.example.security.controller;
    2.  
    3. import com.example.security.dto.UserLoginDTO;
    4. import com.example.security.entity.User;
    5. import com.example.security.restful.JsonResult;
    6. import com.example.security.service.UserService;
    7. import org.springframework.beans.factory.annotation.Autowired;
    8. import org.springframework.validation.annotation.Validated;
    9. import org.springframework.web.bind.annotation.RequestMapping;
    10. import org.springframework.web.bind.annotation.RequestMethod;
    11. import org.springframework.web.bind.annotation.RequestParam;
    12. import org.springframework.web.bind.annotation.RestController;
    13.  
    14. /**
    15.  * @author heyunlin
    16.  * @version 1.0
    17.  */
    18. @RestController
    19. @RequestMapping(path = "/user", produces = "application/json;charset=utf-8")
    20. public class UserController {
    21.  
    22.     private final UserService userService;
    23.  
    24.     @Autowired
    25.     public UserController(UserService userService) {
    26.         this.userService = userService;
    27.     }
    28.  
    29.     @RequestMapping(value = "/login", method = RequestMethod.POST)
    30.     public JsonResult login(@Validated UserLoginDTO userLoginDTO) {
    31.         userService.login(userLoginDTO);
    32.  
    33.         return JsonResult.success("登录成功");
    34.     }
    35.  
    36.     @RequestMapping(value = "/logout", method = RequestMethod.POST)
    37.     public JsonResult logout() {
    38.         userService.logout();
    39.  
    40.         return JsonResult.success("登出成功");
    41.     }
    42.  
    43.     @RequestMapping(value = "/selectById", method = RequestMethod.GET)
    44.     public JsonResult selectById(@RequestParam(value = "id", required = true) String userId) {
    45.         User user = userService.selectById(userId);
    46.  
    47.         return JsonResult.success(null, user);
    48.     }
    49.  
    50. }

    创建业务层类

    UserService接口

    1. package com.example.security.service;
    2.  
    3. import com.example.security.dto.UserLoginDTO;
    4. import com.example.security.entity.User;
    5.  
    6. /**
    7.  * @author heyunlin
    8.  * @version 1.0
    9.  */
    10. public interface UserService {
    11.  
    12.     /**
    13.      * 登录认证
    14.      * @param userLoginDTO 用户登录信息
    15.      */
    16.     void login(UserLoginDTO userLoginDTO);
    17.  
    18.     /**
    19.      * 退出登录
    20.      */
    21.     void logout();
    22.  
    23.     /**
    24.      * 通过ID查询用户信息
    25.      * @param userId 用户ID
    26.      * @return User 通过ID查询到的用户信息
    27.      */
    28.     User selectById(String userId);
    29. }

    UserServiceImpl.java

    1. package com.example.security.service.impl;
    2.  
    3. import com.example.security.dto.UserLoginDTO;
    4. import com.example.security.entity.User;
    5. import com.example.security.mapper.UserMapper;
    6. import com.example.security.service.UserService;
    7. import org.springframework.beans.factory.annotation.Autowired;
    8. import org.springframework.security.authentication.AuthenticationManager;
    9. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    10. import org.springframework.security.core.Authentication;
    11. import org.springframework.stereotype.Service;
    12.  
    13. /**
    14.  * @author heyunlin
    15.  * @version 1.0
    16.  */
    17. @Service
    18. public class UserServiceImpl implements UserService {
    19.  
    20.     private final UserMapper userMapper;
    21.     private final AuthenticationManager authenticationManager;
    22.  
    23.     @Autowired
    24.     public UserServiceImpl(UserMapper userMapper, AuthenticationManager authenticationManager) {
    25.         this.userMapper = userMapper;
    26.         this.authenticationManager = authenticationManager;
    27.     }
    28.  
    29.     @Override
    30.     public void login(UserLoginDTO userLoginDTO) {
    31.         Authentication authentication = new UsernamePasswordAuthenticationToken(
    32.                 userLoginDTO.getUsername(),
    33.                 userLoginDTO.getPassword()
    34.         );
    35.  
    36.         authenticationManager.authenticate(authentication);
    37.     }
    38.  
    39.     @Override
    40.     public void logout() {
    41.         // todo
    42.     }
    43.  
    44.     @Override
    45.     public User selectById(String userId) {
    46.         return userMapper.selectById(userId);
    47.     }
    48.  
    49. }

    自定义登录成功处理器

    登陆成功直接重定向到/index.html

    1. package com.example.security.security;
    2.  
    3. import com.example.security.config.SystemProperties;
    4. import org.springframework.security.core.Authentication;
    5. import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
    6.  
    7. import javax.servlet.http.HttpServletRequest;
    8. import javax.servlet.http.HttpServletResponse;
    9. import java.io.IOException;
    10.  
    11. /**
    12.  * @author heyunlin
    13.  * @version 1.0
    14.  */
    15. public class LoginSuccessHandler implements AuthenticationSuccessHandler {
    16.  
    17.     private final SystemProperties systemProperties;
    18.  
    19.     public LoginSuccessHandler(SystemProperties systemProperties) {
    20.         this.systemProperties = systemProperties;
    21.     }
    22.  
    23.     @Override
    24.     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {
    25.         response.sendRedirect(systemProperties.getIndexPage());
    26.     }
    27.  
    28. }

    至此，springboot整合Spring Security就完成了，项目结构如下。

    文章就分享到这里了，代码已开源，可按需获取~

    springboot整合spring securityicon-default.png?t=N7T8https://gitee.com/he-yunlin/springboot-springsecurity.git

  • 相关阅读:
    【pip command】之 options 汇总
    【数据结构】树和二叉树的应用（哈夫曼树和哈夫曼编码、堆和优先级队列）
    Nginx+Tomcat 多实例负载均衡，动静分离部署
    为什么工业物联网平台要配备MQTT网关?|
    HIVE如何校验map类型数据 -- 比较json和map的转换前后数据一致性
    学习记录11
    java基础面试题（一）
    谷歌浏览器误代码STATUS_INVALID_IMAGE_HASH如何一行代码解决
    Spring基础（四）：XML方式实现DI
    JSP session对象
  • 原文地址：https://blog.csdn.net/heyl163_/article/details/133956908