🚀 Gettler 的个人博客

Appearance

Spring Security 学习笔记 ​

简单Demo ​

导入Maven依赖

xml

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>

编写配置文件

java
   // 链式编程
@Override protected void configure(HttpSecurity http)throws Exception{
  // 首页所有人可以访问，功能页只有对应有权限的人才能访问
  http.authorizeRequests().antMatchers("/").permitAll()
  .antMatchers("/level1/**").hasRole("vip1")
  .antMatchers("/level2/**").hasRole("vip2")
  .antMatchers("/level3/**").hasRole("vip3");
  // 没权限自动跳转登录页面
  http.formLogin().loginPage("/login");
  }

配置用户名密码

java
    @Override protected void configure(AuthenticationManagerBuilder auth)throws Exception{
  auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
  .withUser("123").password(new BCryptPasswordEncoder().encode("123")).roles("vip1").and()
  .withUser("root").password(new BCryptPasswordEncoder().encode("123")).roles("vip1","vip2","vip3").and()
  .withUser("1123").password(new BCryptPasswordEncoder().encode("123")).roles("vip2");
  }

最终配置文件

java
package com.plushuang.config;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("123")
        .password(new BCryptPasswordEncoder().encode("123")).roles("vip1").and().withUser("root")
        .password(new BCryptPasswordEncoder().encode("123")).roles("vip1", "vip2", "vip3").and().withUser("1123")
        .password(new BCryptPasswordEncoder().encode("123")).roles("vip2");
  }

  // 链式编程
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    // 首页所有人可以访问，功能页只有对应有权限的人才能访问
    http.authorizeRequests().antMatchers("/").permitAll().antMatchers("/level1/**").hasRole("vip1")
        .antMatchers("/level2/**").hasRole("vip2").antMatchers("/level3/**").hasRole("vip3");
    // 没权限自动跳转登录页面
    http.formLogin().loginPage("/login").usernameParameter("username").passwordParameter("password");
    // 注销成功后跳转路径
    http.logout().logoutSuccessUrl("/");
    // “记住我”及其对应参数名
    http.rememberMe().rememberMeParameter("remember");
    // RESTFul开发时禁用跨域
    http.csrf().disable();
  }
}

结合 Thymeleaf 模板引擎 ​

引入依赖

xml

<dependency>
  <groupId>org.thymeleaf.extras</groupId>
  <artifactId>thymeleaf-extras-springsecurity5</artifactId>
  <version>3.0.4.RELEASE</version>
</dependency>

添加声明

html

<html lang="en" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity5">

示例

html
<!--如果未登录-->
<div sec:authorize="!isAuthenticated()">
  <a class="item" th:href="@{/toLoginForm}">
    <i class="address card icon"></i> 登录
  </a>
</div>
<!--如果已登录-->
<div sec:authorize="isAuthenticated()">
  <a class="item">
    <i class="address card icon"></i>
    用户名：<span sec:authentication="principal.username"></span>&nbsp;&nbsp;
    角色：<span sec:authentication="principal.authorities"></span>
  </a>
</div>
<div sec:authorize="isAuthenticated()">
  <a class="item" th:href="@{/logout}">
    <i class="address card icon"></i> 注销
  </a>
</div>