版权声明：转载请标明出处 https://blog.csdn.net/keyuzhang/article/details/89114947
login.html
<!DOCTYPE html> <html> <head> <title></title> <meta charset="utf-8"> </head> <body> <form action="/login" method="post"> <h1>login page</h1> <input type="text" name="username"> <input type='password' name='password'/> <input name="submit" type="submit" value="登陆"/> </form> </body> </html>index.html
<!DOCTYPE html> <html> <head> <title></title> <meta charset="utf-8"> </head> <body> <h1>index page</h1> </body> </html>
.pom文件依赖
<properties> <spring.version>4.2.4.RELEASE</spring.version> </properties> <dependencies> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-core</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-web</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-webmvc</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-context-support</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-test</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-jdbc</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-web</artifactId> <version>4.1.0.RELEASE</version> </dependency> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-config</artifactId> <version>4.1.0.RELEASE</version> </dependency> <dependency> <groupId>javax.servlet</groupId> <artifactId>servlet-api</artifactId> <version>2.5</version> <scope>provided</scope> </dependency> </dependencies> <build> <plugins> <!-- java编译插件 --> <plugin> <groupId>org.apache.maven.plugins</groupId> <artifactId>maven-compiler-plugin</artifactId> <version>3.2</version> <configuration> <source>1.7</source> <target>1.7</target> <encoding>UTF-8</encoding> </configuration> </plugin> <plugin> <groupId>org.apache.tomcat.maven</groupId> <artifactId>tomcat7-maven-plugin</artifactId> <configuration> <!-- 指定端口 --> <port>8083</port> <!-- 请求路径 --> <path>/</path> </configuration> </plugin> </plugins> </build>
web.xml配置
<?xml version="1.0" encoding="UTF-8"?> <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5"> <welcome-file-list> <welcome-file>index.html</welcome-file> </welcome-file-list> <context-param> <param-name>contextConfigLocation</param-name> <param-value>classpath:spring-security.xml</param-value> </context-param> <!-- 监听器 加载配置文件(Security安全框架的配置文件) 哪些不想拦截 拦截规则 .... --> <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <!-- 过滤器 /* 拦截所有请求 访问index.html 必须先进login.html --> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> </web-app>
spring-security.xml
<?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"> <!-- 以下页面不被拦截 --> <http pattern="/login.html" security="none"></http> <!-- 页面拦截规则 <http :此标签就是拦截http请求的 use-expressions="false" : 是否使用Spring公司 el表达式 SpEl表达式 false:不使用 access="ROLE_USER,ROLE_ADMIN" true:使用access="hasRole(ROLE_USER,ROLE_ADMIN)" <intercept-url : 拦截 pattern="/**" :拦截规则 拦截所有 /** access="ROLE_USER" : 权限 才可能访问所有资源 ROLE_USER 名称:ROLE_前半部分 是不能改变的 是Security 规定 <form-login/> : 登陆表单 默认情况下:SpringSecurity 自带登陆表单 也可以自定义 登陆表单 --> <http use-expressions="false"> <intercept-url pattern="/**" access="ROLE_USER" /> <form-login login-page="/login.html"/> <!-- 关闭CSRF 不要判断跨站请求伪造（不要使用spring自己的登录页面） 使用单点登陆完成认证,不需要SpringSecurity认证 --> <csrf disabled="true"/> </http> <!-- 认证管理器 校验用户名及密码是否正确 : 简称认证 <user name="admin" password="123456" authorities="ROLE_USER"/> 默认情况下:用户名 密码是固定的 --> <authentication-manager> <authentication-provider> <user-service> <user name="admin" password="123456" authorities="ROLE_USER"/> <user name="ww" password="123456" authorities="ROLE_USER"/> <user name="dasheng" password="sunwukong" authorities="ROLE_USER"/> </user-service> </authentication-provider> </authentication-manager> </beans:beans>