Spring security安全框架的使用

其他 2021-11-24 19:13:58 阅读次数: 0

入门案例

创建一个maven工程

第一步导入pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.offcn</groupId>
    <artifactId>spring_security_demo</artifactId>
    <version>1.0-SNAPSHOT</version>

    <packaging>war</packaging>

    <properties>
        <webVersion>3.0</webVersion>
        <spring.version>4.2.5.RELEASE</spring.version>
    </properties>

    <dependencies>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>${spring.version}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
            <version>${spring.version}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webmvc</artifactId>
            <version>${spring.version}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context-support</artifactId>
            <version>${spring.version}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-test</artifactId>
            <version>${spring.version}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-jdbc</artifactId>
            <version>${spring.version}</version>
        </dependency>
		<!--框架所需要的jar -->
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>4.1.0.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>4.1.0.RELEASE</version>
        </dependency>
        <!----------------------------------->
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>servlet-api</artifactId>
            <version>2.5</version>
            <scope>provided</scope>
        </dependency>
    </dependencies>
    <build>

        <plugins>
            <plugin>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <source>1.8</source>
                    <target>1.8</target>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.tomcat.maven</groupId>
                <artifactId>tomcat7-maven-plugin</artifactId>
                <configuration>
                    <!-- 指定端口 -->
                    <port>9090</port>
                    <!-- 请求路径 -->
                    <path>/</path>
                </configuration>
            </plugin>
        </plugins>
    </build>
</project>

框架所必须的依赖

       <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>4.1.0.RELEASE</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>4.1.0.RELEASE</version>
        </dependency>

第二步配置web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns="http://java.sun.com/xml/ns/javaee"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
         version="3.0">
<!-- application_security.xml是框架的配置文件 -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring/application_security.xml</param-value>
    </context-param>
    
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    
    <!--配置一个springSecurity拦截器,name必须为下面这个-->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <!-------------------------------------------------->
</web-app>

第三步写application_security.xml配置文件

<?xml version="1.0" encoding="UTF-8"?>
    <beans:beans xmlns="http://www.springframework.org/schema/security"
     xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

    <!--favicon.ico被拦截（页头小图标）-->
    <http pattern="/favicon.ico" security="none"/>
    <http pattern="/login.html" security="none"></http>
    <http pattern="/error.html" security="none"></http>
    <!--页面拦截的规则-->
    <!--是否启用springsecutiry的拦截规则 默认是true，设置为false就会按规则拦截-->
    <http use-expressions="false">
        <!--当上面设置为true时，写法是下面这种-->
        <!--<intercept-url pattern="/**" access="hasRole('ROLE_TEACHER')"/>-->
        <!--配置拥有访问权限的用户 角色名称：前缀必须是 ROLE_-->
        <intercept-url pattern="/**" access="ROLE_TEACHER"/>
        <!--login-page 验证页面  default-target-ur 成功后跳转页面 always-use-default-target一直使用吗？authentication-failure-url 失败跳转页面-->
        <form-login login-page="/login.html" default-target-url="/index.html" always-use-default-target="true"
                authentication-failure-url="/error.html"></form-login> <!-- 自定义登陆页面 -->
        <!--配置的登陆页面-->
        <form-login/>
        <!-- 防止攻击 -->
        <csrf disabled="true"/>
        <!-- 注销所需要的 -->
        <logout/>
    </http>
    <!--认证管理器  authentication身份验证 provider提供者 authorities身份确定-->
    <authentication-manager>
        <authentication-provider>
            <user-service>
            <!-- 设置登录用户 -->
                <user name="guodaxia" authorities="ROLE_TEACHER" password="123456"></user>
            </user-service>
        </authentication-provider>
    </authentication-manager>
</beans:beans>

第四步写页面

login.html
注意：1.用户名name必须是username 2.密码name必须是possword 3.提交地址必须是/login 4.提交方式必须是post

<form action="/login" method="post" >
        <table>
            <tr>
                <td>用户名：</td>
                <td>
                    <input type="text" name="username">
                </td>
            </tr>
            <tr>
                <td>密码</td>
                <td>
                    <input type="password" name="password">
                </td>
            </tr>
            <tr>
                <td colspan="2"></td>
                <td>
                    <input name="submit" type="submit" value="登陆">
                </td>
            </tr>
        </table>
    </form>

成功页面还要失败页面就不写了

将Spring security融入项目中的操作

第一步在web.xml中添加一个过滤器

   <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

第二步写application_security.xml配置文件

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
            xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
   http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
   <!-- 放行静态资源文件，以下是某个项目的例举 -->
   <http pattern="/favion.ico" security="none"/>
   <http pattern="/login.html" security="none"/>
   <http pattern="/css/**" security="none"/>
   <http pattern="/img/**" security="none"/>
   <http pattern="/js/**" security="none"/>
   <http pattern="/plugins/**" security="none"/>


   <http use-expressions="false">
       <intercept-url pattern="/**" access="ROLE_STU"/>
       <!-- login-page指定了登陆页面 -->
       <form-login login-page="/login.html" default-target-url="/admin/index.html" authentication-failure-url="/login.html" always-use-default-target="true"></form-login>
       <csrf disabled="true"/>

       <!--如果使用了frame框架就要设置这个：同源根目录下的放行-->
       <headers>
           <frame-options policy="SAMEORIGIN"/>
       </headers>
   	<!-- 注销操作 -->
       <logout/>
   </http>
       <!--认证管理器-->
   <authentication-manager>
       <authentication-provider>
           <user-service>
               <user name="guodaxia" password="offcn123" authorities="ROLE_STU"/>
               <user name="huangdaxia" password="offcn123" authorities="ROLE_STU"/>
               <user name="feidaxia" password="offcn123" authorities="ROLE_STU"/>
           </user-service>
       </authentication-provider>
   </authentication-manager>
</beans:beans>

第三步 修改登陆表单的action还要属性名等

注意：登陆访问的接口是/login 注销操作访问的接口是/logout
注销举例：

   <a href="../logout" class="btn btn-default btn-flat">注销</a>
内容补充：当你登陆成功后还要获取登陆名信息的话，再写一个接口

@RestController
@RequestMapping("/login")
public class LongController {
    
    
    @RequestMapping("/name")
    public Map name(){
    
    
        //Context上下文
        String name = SecurityContextHolder.getContext().getAuthentication().getName();
        Map map = new HashMap();
        map.put("loginName",name);
        return map;
    }
}

自定义认证类

1.写一个类实现UserDetailsService接口

package com.offcn.service;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import java.util.ArrayList;
import java.util.List;

public class UserDetailsServiceImpl implements UserDetailsService {
    
    
    //UserDetails 认证的一个接口 有一个实现类 User
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    
    
       //自定义一个安全的集合  ROLE_TEACGER 是配置拥有访问权限的用户的角色    GrantedAuthority：权限
        List<GrantedAuthority> Granted = new ArrayList<GrantedAuthority>();
        //角色名必须是配置文件中已经配置的角色
        Granted.add(new SimpleGrantedAuthority("ROLE_SELLER"));
        return new User(username,"123",Granted);
        //这里写username  表示用户名可以任意 密码是123 就可以通过验证
    }
}

2.修改spring-security.xml配置文件

只修改认证管理器

  <!--认证管理器-->
    <authentication-manager>
        <!-- 让它引用认证类 -->
        <authentication-provider user-service-ref="userDetailsService">
        </authentication-provider>
    </authentication-manager>
<!-- 自定义认证类 -->
<beans:bean id="userDetailsService" class="com.offcn.service.UserDetailsServiceImpl"></beans:bean>

猜你喜欢

转载自blog.csdn.net/JavaSupeMan/article/details/104657594
今日推荐
LFOSSA 源来如此公开课 | 掌握云原生未来：CNCF 认证全面攻略与备考秘籍
国产云输入法——仅华为无云端数据上传安全问题
开源日报 | 工业开源项目OGG 1.0；姐姐，你要和我一起配置火狐吗；苹果AI遥遥落后？Fedora 40
开放签电子签章：停止新增，优化体验，前进更进（五一假期前工作）
开源日报 | 中学生开源前端动画引擎；全球首个Llama3 8B中文版开源模型；联想电脑恐出局；Linus讽刺AI炒作
“百模大战”必有一战 | 2024中国“百模大战”竞争格局分析
周排行
Family Tree 题解
BZOJ 1093 最大半连通子图 SCC + DP
幂等处理
Spring----学习（2）----XML 配置Bean 自动装配
SQL Server 远程更新目标表数据
HIbernate3.6 环境搭建
特殊符号正则表达式
【Linux】第一章 进程的理解
843. n-皇后问题（dfs+输出各种情况）
空间数据库2
每日归档
更多
2024-04-26(39)
2024-04-25(22)
2024-04-24(36)
2024-04-23(26)
2024-04-22(39)
2024-04-21(0)
2024-04-20(6)
2024-04-19(5)
2024-04-18(0)
2024-04-17(5)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022