• spring-boot-starter-parent
  是一个特殊的starter，它用来提供相关的Maven默认依赖。使用它之后，常用的包依赖可以省去version标签。

package com.programb.example;import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.ConfigurableApplicationContext;
import org.springframework.context.annotation.ComponentScan;import static org.springframework.boot.SpringApplication.run;@ComponentScan(basePackages ="com.programb.example")
@SpringBootApplication
public class Application {public static void main(String[] args) {ConfigurableApplicationContext run = run(Application.class, args);}}

package com.programb.example.config;import java.beans.PropertyVetoException;import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;
import com.mchange.v2.c3p0.ComboPooledDataSource;@Configuration
public class DBconfig {@Autowiredprivate Environment env;@Bean(name="dataSource")public ComboPooledDataSource dataSource() throws PropertyVetoException {ComboPooledDataSource dataSource = new ComboPooledDataSource();dataSource.setDriverClass(env.getProperty("ms.db.driverClassName"));dataSource.setJdbcUrl(env.getProperty("ms.db.url"));dataSource.setUser(env.getProperty("ms.db.username"));dataSource.setPassword(env.getProperty("ms.db.password"));dataSource.setMaxPoolSize(20);dataSource.setMinPoolSize(5);dataSource.setInitialPoolSize(10);dataSource.setMaxIdleTime(300);dataSource.setAcquireIncrement(5);dataSource.setIdleConnectionTestPeriod(60);return dataSource;}
}

package com.programb.example.config;import org.mybatis.spring.SqlSessionFactoryBean;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.ApplicationContext;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;import javax.sql.DataSource;@Configuration
@ComponentScan
public class MyBatisConfig {@Autowiredprivate DataSource dataSource;@Bean(name = "sqlSessionFactory")public SqlSessionFactoryBean sqlSessionFactory(ApplicationContext applicationContext) throws Exception {SqlSessionFactoryBean sessionFactory = new SqlSessionFactoryBean();sessionFactory.setDataSource(dataSource);// sessionFactory.setPlugins(new Interceptor[]{new PageInterceptor()});sessionFactory.setMapperLocations(applicationContext.getResources("classpath*:mapper/*.xml"));return sessionFactory;}}

package com.programb.example.config;import org.mybatis.spring.mapper.MapperScannerConfigurer;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;@Configuration
public class MyBatisScannerConfig {@Beanpublic MapperScannerConfigurer MapperScannerConfigurer() {MapperScannerConfigurer mapperScannerConfigurer = new MapperScannerConfigurer();mapperScannerConfigurer.setBasePackage("com.programb.example.dao");mapperScannerConfigurer.setSqlSessionFactoryBeanName("sqlSessionFactory");return mapperScannerConfigurer;}
}

package com.programb.example.config;import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.jdbc.datasource.DataSourceTransactionManager;
import org.springframework.transaction.PlatformTransactionManager;
import org.springframework.transaction.annotation.TransactionManagementConfigurer;import javax.sql.DataSource;@Configuration
@ComponentScan
public class TransactionConfig implements TransactionManagementConfigurer{@Autowiredprivate DataSource dataSource;@Bean(name = "transactionManager")@Overridepublic PlatformTransactionManager annotationDrivenTransactionManager() {return new DataSourceTransactionManager(dataSource);}}

package com.programb.example.config;import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;import com.programb.example.security.CustomUserService;@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {@Autowiredprivate  CustomUserService customUserService;@Autowiredprotected void configure(AuthenticationManagerBuilder auth) throws Exception {auth.userDetailsService(customUserService).passwordEncoder(new BCryptPasswordEncoder());}@Overrideprotected void configure(HttpSecurity http) throws Exception {http.csrf().disable().authorizeRequests().antMatchers("/users/**").authenticated().antMatchers(HttpMethod.POST).authenticated().antMatchers(HttpMethod.PUT).authenticated().antMatchers(HttpMethod.DELETE).authenticated().antMatchers("/**").permitAll().and().sessionManagement().and().httpBasic();}}

package com.programb.example.controller;import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.annotation.Secured;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.ResponseBody;import com.programb.example.dao.UserDao;
import com.programb.example.domain.SysUser;
import com.programb.example.service.UserService;@Controller
@RequestMapping("/users")
public class HomeController {@AutowiredUserService userService;@RequestMapping(method = RequestMethod.GET)@ResponseBodypublic String getUsers() {return "getUsers";}@Secured({"ROLE_ADMIN","ROLE_USER"})@RequestMapping(method = RequestMethod.POST)@ResponseBodypublic Object save(@RequestBody SysUser user) {return  userService.create(user);}@Secured("ROLE_ADMIN")@RequestMapping(method = RequestMethod.PUT)@ResponseBodypublic String update() {return "updateUser";}@Secured("ROLE_ADMIN")@RequestMapping(method = RequestMethod.DELETE)@ResponseBodypublic String delete() {return "deleteUser";}}

package com.programb.example.controller;import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;import com.programb.example.domain.SysUser;@RestController
public class LoginController {@RequestMapping(value = "/login")@ResponseBody//用户名密码是用base64 加密 原文为 admin:admin 即 用户名:密码  内容是放在request.getHeader 的 "authorization" 中public Object login(@AuthenticationPrincipal SysUser loginedUser, @RequestParam(name = "logout", required = false) String logout) {if (logout != null) {return null;}if (loginedUser != null) {return loginedUser;}return null;}
}

package com.programb.example.dao;import com.programb.example.domain.SysUser;public interface UserDao {SysUser findByUserName(String username);int create (SysUser sysUser);
}

package com.programb.example.domain;public class SysRole {private Integer id;private String name;public Integer getId() {return id;}public void setId(Integer id) {this.id = id;}public String getName() {return name;}public void setName(String name) {this.name = name;}}

package com.programb.example.domain;import com.fasterxml.jackson.annotation.JsonIgnore;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;import java.util.Collection;
import java.util.List;public class SysUser implements UserDetails {  // implements UserDetails 用于登录时 @AuthenticationPrincipal 标签取值private Integer id;private String username;@JsonIgnoreprivate String password;private String rawPassword;@JsonIgnoreprivate List<SysRole> roles;private List<? extends GrantedAuthority> authorities;public Integer getId() {return id;}public void setId(Integer id) {this.id = id;}public String getUsername() {return username;}public void setUsername(String username) {this.username = username;}public String getPassword() {return password;}public void setPassword(String password) {this.password = password;}public List<SysRole> getRoles() {return roles;}public void setRoles(List<SysRole> roles) {this.roles = roles;}public String getRawPassword() {return rawPassword;}public void setRawPassword(String rawPassword) {this.rawPassword = rawPassword;}@JsonIgnore@Overridepublic boolean isAccountNonExpired() {return true;}@JsonIgnore@Overridepublic boolean isAccountNonLocked() {return true;}@JsonIgnore@Overridepublic boolean isCredentialsNonExpired() {return true;}@JsonIgnore@Overridepublic boolean isEnabled() {return true;}@JsonIgnore@Overridepublic Collection<? extends GrantedAuthority> getAuthorities() {return authorities;}public void setGrantedAuthorities(List<? extends GrantedAuthority> authorities) {this.authorities = authorities;}}

package com.programb.example.security;import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;import com.programb.example.dao.UserDao;
import com.programb.example.domain.SysRole;
import com.programb.example.domain.SysUser;import java.util.ArrayList;
import java.util.List;@Service
public class CustomUserService implements UserDetailsService { //自定义UserDetailsService 接口@AutowiredUserDao userDao;private static final org.slf4j.Logger logger = LoggerFactory.getLogger(CustomUserService.class);@Overridepublic UserDetails loadUserByUsername(String username) { //重写loadUserByUsername 方法获得 userdetails 类型用户SysUser user = userDao.findByUserName(username);if(user == null){throw new UsernameNotFoundException("用户名不存在");}List<SimpleGrantedAuthority> authorities = new ArrayList<>();//用于添加用户的权限。只要把用户权限添加到authorities 就万事大吉。for(SysRole role:user.getRoles()){authorities.add(new SimpleGrantedAuthority(role.getName()));logger.info("loadUserByUsername: " + user);}user.setGrantedAuthorities(authorities); //用于登录时 @AuthenticationPrincipal 标签取值return user;}}

package com.programb.example.service;import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;import com.programb.example.dao.UserDao;
import com.programb.example.domain.SysUser;
import com.programb.example.util.MD5Util;@Service
public class UserService {@AutowiredUserDao userDao;public SysUser create(SysUser sysUser){//进行加密BCryptPasswordEncoder encoder =new BCryptPasswordEncoder();sysUser.setPassword(encoder.encode(MD5Util.encode(sysUser.getRawPassword().trim())));userDao.create(sysUser);return sysUser;}}

package com.programb.example.util;import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;public class BCryptPasswordEncoderTest {public static void main(String[] args) {BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();System.out.println("encoder:  " + encoder.encode("abel"));System.out.println("encoder:  " + encoder.encode("admin"));if (encoder.matches("abel", "0000000000.0000000000.0000000000")) {System.out.println("encoder: true");}System.out.println("programb");String Md5Password = MD5Util.encode("abel");System.out.println("Md5Password:  " + Md5Password);System.out.println("encoder:  " + encoder.encode(Md5Password));if (encoder.matches(Md5Password, "0000000000.0000000000.0000000000")) {System.out.println("Md5Password: true");}}
}

package com.programb.example.util;import java.security.MessageDigest;public class MD5Util {private static final String SALT = "salt";public static String encode(String password) {password = password + SALT;return processEncode(password);}public static String processEncode(String password) {MessageDigest md5 = null;try {md5 = MessageDigest.getInstance("MD5");} catch (Exception e) {throw new RuntimeException(e);}char[] charArray = password.toCharArray();byte[] byteArray = new byte[charArray.length];for (int i = 0; i < charArray.length; i++)byteArray[i] = (byte) charArray[i];byte[] md5Bytes = md5.digest(byteArray);StringBuffer hexValue = new StringBuffer();for (int i = 0; i < md5Bytes.length; i++) {int val = ((int) md5Bytes[i]) & 0xff;if (val < 16) {hexValue.append("0");}hexValue.append(Integer.toHexString(val));}return hexValue.toString();}public static void main(String[] args) {System.out.println(MD5Util.encode("abel"));System.out.println(MD5Util.encode("admin"));}
}

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.programb.example.dao.UserDao"><resultMap id="userMap" type="com.programb.example.domain.SysUser"><id property="id" column="ID"/><result property="username" column="username"/><result property="password" column="PASSWORD"/><collection property="roles" ofType="com.programb.example.domain.SysRole"><result column="name" property="name"/></collection></resultMap><select id="findByUserName" parameterType="String" resultMap="userMap">select u.*,r.namefrom Sys_User uLEFT JOIN sys_role_user sru on u.id= sru.Sys_User_idLEFT JOIN Sys_Role r on sru.Sys_Role_id=r.idwhere username= #{username}</select><insert id="create" parameterType="com.programb.example.domain.SysUser"><selectKey resultType="int"  order="AFTER" keyProperty="id" >SELECT LAST_INSERT_ID()</selectKey>INSERT into Sys_User(username,password)values(#{username},#{password})</insert>
</mapper>

ms.db.driverClassName=com.mysql.jdbc.Driver
ms.db.url=jdbc:mysql://localhost:3306/cache?characterEncoding=utf-8&useSSL=false
ms.db.username=root
ms.db.password=admin
ms.db.maxActive=500
server.port=8099logging.level.org.springframework.security= INFO
spring.thymeleaf.cache=false

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"><modelVersion>4.0.0</modelVersion><groupId>com.programb</groupId><artifactId>springboot-security</artifactId><version>1.0-SNAPSHOT</version><parent><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-parent</artifactId><version>1.3.0.RELEASE</version></parent><properties><start-class>com.us.Application</start-class><maven.compiler.target>1.8</maven.compiler.target><maven.compiler.source>1.8</maven.compiler.source><mybatis.version>3.2.7</mybatis.version><mybatis-spring.version>1.2.2</mybatis-spring.version></properties><dependencies><!--springboot--><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId></dependency><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-thymeleaf</artifactId></dependency><!--db--><dependency><groupId>mysql</groupId><artifactId>mysql-connector-java</artifactId><version>6.0.5</version></dependency><dependency><groupId>com.mchange</groupId><artifactId>c3p0</artifactId><version>0.9.5.2</version><exclusions><exclusion><groupId>commons-logging</groupId><artifactId>commons-logging</artifactId></exclusion></exclusions></dependency><!--mybatis--><dependency><groupId>org.springframework</groupId><artifactId>spring-jdbc</artifactId></dependency><dependency><groupId>org.mybatis</groupId><artifactId>mybatis</artifactId><version>${mybatis.version}</version></dependency><dependency><groupId>org.mybatis</groupId><artifactId>mybatis-spring</artifactId><version>${mybatis-spring.version}</version></dependency></dependencies></project>