SpringSecurity

1、简介

Spring Security 是针对 Spring 项目的安全框架，也是 Spring Boot 底层安全模块默认的技术选型，他可以实现强大的 Web 安全控制，对于安全控制，我们仅需要引入 spring-boot-starter-security 模块，进行少量的配置，即可实现强大的安全管理

记住这几个类：

• WebSecurityConfigurerAdapter：自定义 Security 策略
• AuthenticationMannagerBuilder：自定义认证策略
• EnableWebSecurity：开启 WebSecurity 模式

Spring Security 的两个主要目标是“认证”和“授权”（访问控制）

• “认证”：Authentication
• “授权”：Authorization

这个概念是通用的，而不是只在 Spring Security 中存在

官网：https://spring.io/projects/spring-security/

2、SpringSecurity 环境搭建

步骤：

1. 新建一个项目

2. 添加 web 依赖

   

3. 添加 thymeleaf 依赖

   <!--thymeleaf-->
   <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-thymeleaf</artifactId>
   </dependency>
   

4. 导入静态资源

   

5. 关闭 thymeleaf 模板引擎缓存

   spring:thymeleaf:cache: false
   

6. 编写 RouterController

   package com.aze.controller;import org.springframework.stereotype.Controller;
   import org.springframework.web.bind.annotation.PathVariable;
   import org.springframework.web.bind.annotation.RequestMapping;@Controller
   public class RouterController {@RequestMapping({"/","/index","/index.html"})public String index(){return "index";}@RequestMapping("/toLogin")public String toLogin(){return "views/login";}@RequestMapping("/level1/{id}")public String level1(@PathVariable("id") Integer id){return "views/level1/" + id;}@RequestMapping("/level2/{id}")public String level2(@PathVariable("id") Integer id){return "views/level2/" + id;}@RequestMapping("/level3/{id}")public String level3(@PathVariable("id") Integer id){return "views/level3/" + id;}}
   

7. 测试

3、用户认证和授权

“认证”：Authentication

“授权”：Authorization

步骤：

1. 新增 spring-boot-starter-security 依赖

   <!--security-->
   <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId>
   </dependency>
   

2. 创建 config 目录，并编写 SecurityConfig

   • 骨架

     @EnableWebSecurity
     public class SecurityConfig extends WebSecurityConfigurerAdapter {// 授权@Overrideprotected void configure(HttpSecurity http) throws Exception {}// 认证@Overrideprotected void configure(AuthenticationManagerBuilder auth) throws Exception {}
     

   • 授权

     // 链式编程
     // 授权
     @Override
     protected void configure(HttpSecurity http) throws Exception {// 首页所有人都可以访问，功能页只有对应有权限的人才能访问// 请求授权的规则http.authorizeRequests().antMatchers("/").permitAll().antMatchers("/level1/**").hasRole("vip1").antMatchers("/level2/**").hasRole("vip2").antMatchers("/level3/**").hasRole("vip3");// 没有权限会默认到登录页面，需要开启登录的页面// Loginhttp.formLogin().successForwardUrl("/");
     }
     

   • 认证

     

     // 认证
     // 密码编码：PasswordEncoder
     // 在 Spring Security 5.0+ 新增了很多的加密方法
     @Override
     protected void configure(AuthenticationManagerBuilder auth) throws Exception {// 这些数据正常都在数据库中读取   auth.jdbcAuthentication()// 这里是在内存中读取auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("aze").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2").and().withUser("admin").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2","vip3").and().withUser("user1").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1").and().withUser("user2").password(new BCryptPasswordEncoder().encode("123456")).roles();
     }
     

3. 测试

4、注销以及权限控制

4.1 注销

步骤：

1. 在 SecurityConfig 的授权处开启注销功能

   // 链式编程
   // 授权
   @Override
   protected void configure(HttpSecurity http) throws Exception {// 首页所有人都可以访问，功能页只有对应有权限的人才能访问// 请求授权的规则http.authorizeRequests().antMatchers("/").permitAll().antMatchers("/level1/**").hasRole("vip1").antMatchers("/level2/**").hasRole("vip2").antMatchers("/level3/**").hasRole("vip3");// 没有权限会默认到登录页面，需要开启登录的页面// Loginhttp.formLogin().successForwardUrl("/");// 注销// 开启注销功能，成功则跳转至首页http.logout().logoutSuccessUrl("/");
   }
   

2. 测试

4.2 权限控制

步骤：

1. 导入 thymeleaf-extras-springsecurity5 依赖

   <!-- thymeleaf-security 整合 -->
   <!-- https://mvnrepository.com/artifact/org.thymeleaf.extras/thymeleaf-extras-springsecurity5 -->
   <dependency><groupId>org.thymeleaf.extras</groupId><artifactId>thymeleaf-extras-springsecurity5</artifactId><version>3.0.4.RELEASE</version>
   </dependency>
   

2. 修改首页代码

   <!DOCTYPE html>
   <html lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
   <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"><title>首页</title><!--semantic-ui--><link href="https://cdn.bootcss.com/semantic-ui/2.4.1/semantic.min.css" rel="stylesheet"><link th:href="@{/aze/css/qinstyle.css}" rel="stylesheet">
   </head>
   <body><!--主容器-->
   <div class="ui container"><div class="ui segment" id="index-header-nav" th:fragment="nav-menu"><div class="ui secondary menu"><a class="item" th:href="@{/index}">首页</a><!--登录注销--><div class="right menu"><!--如果没有登录--><div sec:authorize="!isAuthenticated()"><a class="item" th:href="@{/toLogin}"><i class="address card icon"></i> 登录</a></div><div sec:authorize="isAuthenticated()"><!--如果登录：用户名，注销--><!--注销--><a class="item">用户名：<span sec:authentication="name"></span><!--角色：<span sec:authentication="principal.getAuthorities()"></span>--></a></div><div sec:authorize="isAuthenticated()"><!--如果登录：用户名，注销--><!--注销--><a class="item" th:href="@{/logout}"><i class="sign-out icon"></i> 注销</a></div></div></div></div><div class="ui segment" style="text-align: center"><h3>Spring Security Study by 秦疆</h3></div><div><br><div class="ui three column stackable grid"><!--动态菜单的效果--><div class="column" sec:authorize="hasRole('vip1')"><div class="ui raised segment"><div class="ui"><div class="content"><h5 class="content">Level 1</h5><hr><div><a th:href="@{/level1/1}"><i class="bullhorn icon"></i> Level-1-1</a></div><div><a th:href="@{/level1/2}"><i class="bullhorn icon"></i> Level-1-2</a></div><div><a th:href="@{/level1/3}"><i class="bullhorn icon"></i> Level-1-3</a></div></div></div></div></div><div class="column"><div class="ui raised segment" sec:authorize="hasRole('vip2')"><div class="ui"><div class="content"><h5 class="content">Level 2</h5><hr><div><a th:href="@{/level2/1}"><i class="bullhorn icon"></i> Level-2-1</a></div><div><a th:href="@{/level2/2}"><i class="bullhorn icon"></i> Level-2-2</a></div><div><a th:href="@{/level2/3}"><i class="bullhorn icon"></i> Level-2-3</a></div></div></div></div></div><div class="column"><div class="ui raised segment" sec:authorize="hasRole('vip3')"><div class="ui"><div class="content"><h5 class="content">Level 3</h5><hr><div><a th:href="@{/level3/1}"><i class="bullhorn icon"></i> Level-3-1</a></div><div><a th:href="@{/level3/2}"><i class="bullhorn icon"></i> Level-3-2</a></div><div><a th:href="@{/level3/3}"><i class="bullhorn icon"></i> Level-3-3</a></div></div></div></div></div></div></div></div><script th:src="@{/qinjiang/js/jquery-3.1.1.min.js}"></script>
   <script th:src="@{/qinjiang/js/semantic.min.js}"></script></body>
   </html>
   

   

   

3. 测试

5、记住我功能以及首页定制

修改 Security 中的授权

// 链式编程
// 授权
@Override
protected void configure(HttpSecurity http) throws Exception {// 首页所有人都可以访问，功能页只有对应有权限的人才能访问// 请求授权的规则http.authorizeRequests().antMatchers("/").permitAll().antMatchers("/level1/**").hasRole("vip1").antMatchers("/level2/**").hasRole("vip2").antMatchers("/level3/**").hasRole("vip3");// 没有权限会默认到登录页面，需要开启登录的页面// Loginhttp.formLogin().loginPage("/toLogin").usernameParameter("user").passwordParameter("pwd").loginProcessingUrl("/login").successForwardUrl("/");// 注销// 关闭 csrf 功能   http.csrf().disable();// 开启注销功能，成功则跳转至首页http.logout().logoutSuccessUrl("/");// 开启记住我功能，cookie 默认保存两周，自定义接收前端的参数http.rememberMe().rememberMeParameter("remember");
}

修改 login.html，增添记住我按钮

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"><title>登录</title><!--semantic-ui--><link href="https://cdn.bootcss.com/semantic-ui/2.4.1/semantic.min.css" rel="stylesheet">
</head>
<body><!--主容器-->
<div class="ui container"><div class="ui segment"><div style="text-align: center"><h1 class="header">登录</h1></div><div class="ui placeholder segment"><div class="ui column very relaxed stackable grid"><div class="column"><div class="ui form"><!--如果要使用toLogin，则http.formLogin().loginPage("/toLogin");配置一致。如果非要使用login，则http.formLogin().loginPage("/toLogin").loginProcessingUrl("/login");--><form th:action="@{/login}" method="post"><div class="field"><label>工号</label><div class="ui left icon input"><input type="text" placeholder="请输入工号..." name="user"><i class="user icon"></i></div></div><div class="field"><label>密码</label><div class="ui left icon input"><input type="password" placeholder="请输入密码..." name="pwd"><i class="lock icon"></i></div></div><div class="field"><input type="checkbox" name="remember">记住我</div><input type="submit" class="ui blue submit button"/></form></div></div></div></div><div style="text-align: center"><div class="ui label"></i>注册</div><br><br><small>blog.kuangstudy.com</small></div><div class="ui segment" style="text-align: center"><h3>Spring Security Study by 秦疆</h3></div></div></div><script th:src="@{/qinjiang/js/jquery-3.1.1.min.js}"></script>
<script th:src="@{/qinjiang/js/semantic.min.js}"></script></body>
</html>