1.pom文件
<dependencies> <!--添加方言--> <dependency> <groupId>org.thymeleaf.extras</groupId> <artifactId>thymeleaf-extras-springsecurity5</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-thymeleaf</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-test</artifactId> <scope>test</scope> <exclusions> <exclusion> <groupId>org.junit.vintage</groupId> <artifactId>junit-vintage-engine</artifactId> </exclusion> </exclusions> </dependency> </dependencies>
2.SpringBoot启动类
/** * 1、引入SpringSecurity; * 2、编写SpringSecurity的配置类; * @EnableWebSecurity extends WebSecurityConfigurerAdapter * 3、控制请求的访问权限: * configure(HttpSecurity http) { * http.authorizeRequests().antMatchers("/").permitAll() * .antMatchers("/level1/**").hasRole("VIP1") * } * 4、定义认证规则: * configure(AuthenticationManagerBuilder auth){ * auth.inMemoryAuthentication() * .withUser("zhangsan").password("123456").roles("VIP1","VIP2") * } * 5、开启自动配置的登陆功能: * configure(HttpSecurity http){ * http.formLogin(); * } * 6、注销:http.logout(); * 7、记住我:Remeberme(); */ @SpringBootApplication public class SpringbootSecurityApplication { public static void main(String[] args) { SpringApplication.run(SpringbootSecurityApplication.class, args); } }
3.Security配置类
@EnableWebSecurity public class MySecurityConfig extends WebSecurityConfigurerAdapter { @Bean public UserDetailsService userDetailsService() { InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager(); manager.createUser(User.withDefaultPasswordEncoder().username("zhangsan").password("password").roles("VIP1").build()); manager.createUser(User.withDefaultPasswordEncoder().username("amao").password("password").roles("VIP2").build()); manager.createUser(User.withDefaultPasswordEncoder().username("lisi").password("password").roles("VIP3").build()); return manager; } @Override protected void configure(HttpSecurity http) throws Exception { //super.configure(http); //定制请求的授权规则 http.authorizeRequests().antMatchers("/").permitAll() .antMatchers("/level1/**").hasRole("VIP1") .antMatchers("/level2/**").hasRole("VIP2") .antMatchers("/level3/**").hasRole("VIP3"); //开启自动配置的登陆功能,效果,如果没有登陆,没有权限就会来到登陆页面 //BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(); http.formLogin().usernameParameter("user").passwordParameter("pwd"); /*.loginPage("/userlogin")*/ //1、/login来到登陆页 //2、重定向到/login?error表示登陆失败 //3、更多详细规定 //4、默认post形式的 /login代表处理登陆 //5、一但定制loginPage;那么 loginPage的post请求就是登陆 //开启自动配置的注销功能。 http.logout().logoutSuccessUrl("/");//注销成功以后来到首页 //1、访问 /logout 表示用户注销,清空session //2、注销成功会返回 /login?logout 页面; //开启记住我功能 http.rememberMe().rememberMeParameter("remeber-me"); //登陆成功以后,将cookie发给浏览器保存,以后访问页面带上这个cookie,只要通过检查就可以免登录 //点击注销会删除cookie } //定义认证规则 // @Override // protected void configure(AuthenticationManagerBuilder auth) throws Exception { // auth.inMemoryAuthentication() // .withUser("zhangsan").password("123456").roles("VIP1","VIP2") // .and() // .withUser("lisi").password("123456").roles("VIP2","VIP3") // .and() // .withUser("wangwu").password("123456").roles("VIP1","VIP3"); // } }
4.控制器
@Controller public class KungfuController { private final String PREFIX = "pages/"; /** * 欢迎页 * @return */ @GetMapping("/") public String index() { return "welcome"; } /** * 登陆页 * @return */ @GetMapping("/userlogin") public String loginPage() { return PREFIX+"login"; } /** * level1页面映射 * @param path * @return */ @GetMapping("/level1/{path}") public String level1(@PathVariable("path")String path) { return PREFIX+"level1/"+path; } /** * level2页面映射 * @param path * @return */ @GetMapping("/level2/{path}") public String level2(@PathVariable("path")String path) { return PREFIX+"level2/"+path; } /** * level3页面映射 * @param path * @return */ @GetMapping("/level3/{path}") public String level3(@PathVariable("path")String path) { return PREFIX+"level3/"+path; } }
5.项目结构图
6.关闭Thymeleaf的缓存
# 使用html模板
spring.thymeleaf.mode=HTML
# 编译缓存,开发环境写false,更新页面可马上看到效果;生产环境用true,速度快一些,但更新页面后需重启应用才能看到效果
spring.thymeleaf.cache=false
7.页面示例
<!DOCTYPE html> <html xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4"> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>Insert title here</title> </head> <body> <h1 align="center">欢迎光临武林秘籍管理系统</h1> <div sec:authorize="!isAuthenticated()"> <h2 align="center">游客您好,如果想查看武林秘籍 <a th:href="@{/userlogin}">请登录</a></h2> </div> <div sec:authorize="isAuthenticated()"> <h2><span sec:authentication="name"></span>,您好,您的角色有: <span sec:authentication="principal.authorities"></span></h2> <form th:action="@{/logout}" method="post"> <input type="submit" value="注销"/> </form> </div> <hr> <div sec:authorize="hasRole('VIP1')"> <h3>普通武功秘籍</h3> <ul> <li><a th:href="@{/level1/1}">罗汉拳</a></li> <li><a th:href="@{/level1/2}">武当长拳</a></li> <li><a th:href="@{/level1/3}">全真剑法</a></li> </ul> </div> <div sec:authorize="hasRole('VIP2')"> <h3>高级武功秘籍</h3> <ul> <li><a th:href="@{/level2/1}">太极拳</a></li> <li><a th:href="@{/level2/2}">七伤拳</a></li> <li><a th:href="@{/level2/3}">梯云纵</a></li> </ul> </div> <div sec:authorize="hasRole('VIP3')"> <h3>绝世武功秘籍</h3> <ul> <li><a th:href="@{/level3/1}">葵花宝典</a></li> <li><a th:href="@{/level3/2}">龟派气功</a></li> <li><a th:href="@{/level3/3}">独孤九剑</a></li> </ul> </div> </body> </html>