SpringBoot整合SpringSecurity

后端后端安全授权认证 SpringSecurity

发布时间 : 2020-07-08 00:16

字数:770 阅读 :

SpringSecurity整合到SpringBoot项目中

SpringSecurity整合到SpringBoot项目中

首先创建的项目如图所示

1.在pom.xml中导入SpringSecurity的依赖

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>

2.导入thymeleaf模板引擎和静态文件

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>

静态资源链接在这儿
链接：https://pan.baidu.com/s/1D9N9V-lAmKVR0mwhHuOW2w
提取码：rhl8
将他放到静态文件夹–>static中即可

3.编写后端controller

package com.cxy.controller;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
public class RouterController {

  @RequestMapping(value = {"/index","/"})
  public String index(){
    return "index";
  }
  @RequestMapping(value = {"/toLogin"})
  public String toLogin(){
    return "/views/login";
  }

  // 根据id和level获取不同的控制访问路径 
  @RequestMapping("/level1/{id}")
  public String toLevel1(@PathVariable("id") int id){
    return "/views/level1/"+id;
  }
  @RequestMapping("/level2/{id}")
  public String toLevel2(@PathVariable("id") int id){
    return "/views/level2/"+id;
  }
  @RequestMapping("/level3/{id}")
  public String toLevel3(@PathVariable("id") int id){
    return "/views/level3/"+id;
  }
}

4.编写配置文件用于映射请求以及用户登录状态，查看不同的权限

这个文件夹在config下面

package com.cxy.config;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
//  授权 这里是链式编程，跟前端中的promise函数有点相像
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    //首页所有人可以访问，功能页具有权限的才能进行访问
    http.authorizeRequests().antMatchers("/")
            .permitAll()
            .antMatchers("/level1/**").hasRole("vip1")
            .antMatchers("/level2/**").hasRole("vip2")
            .antMatchers("/level3/**").hasRole("vip3");
    //关闭默认的cfrs防止网站攻击  登出失败的这个
    http.csrf().disable();
    //跳转到内置写好的页面 添加前端表单上的username和password属性的别名
    http.formLogin().loginPage("/toLogin").loginProcessingUrl("/login")
            .usernameParameter("user")
            .passwordParameter("pwd");
    //开启注销功能
    http.logout().logoutSuccessUrl("/");
    //开启记住我功能
    http.rememberMe().rememberMeParameter("remember");
  }

//  认证
//  要进行密码进行加密
//  使用spring security中的password编码格式
  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    //这里应该是从数据库中查找数据
    auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
            .withUser("cxy").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2")
    .and()
    .withUser("root").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2","vip3")
    .and()
    .withUser("chest").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1");
  }
}