在Spring Boot应用中集成Spring Security实现用户注册和登录

àì夳堔傛蜴生んèń 2023-01-23 11:55 192阅读 0赞

### 文章目录 ###

*  在Spring Boot应用中集成Spring Security实现用户注册和登录
 *   *  前言
     *  引入依赖
     *   *  引入Spring Security依赖
         *  引入Spring Data JPA和MySQL依赖
         *  引入Thymeleaf依赖
         *  引入前端依赖
         *  引入其他依赖
     *  表设计
     *  API设计
     *  应用配置
     *  配置Spring Security
     *  Web层
     *   *  HomeController类
         *  RegistrationController类
         *  RegistrationDto类
         *  字段校验
     *  Service层
     *  数据层
     *   *  JPA Entities
         *   *  User Entity类
             *  Role Entity类
         *  JPA Repository
         *   *  UserRepository类
             *  RoleRepository类
     *  前端页面
     *   *  index.html
         *  login.html
         *  registration.html
     *  参考文档

# 在Spring Boot应用中集成Spring Security实现用户注册和登录 #

## 前言 ##

本文描述了在Spring Boot应用中如何集成Spring Security实现用户注册和登录。

环境和工具：

*  Spring Boot 2.4 （对应Spring为Spring 5）
 *  Thymeleaf
 *  Spring Security
 *  Spring Data JPA
 *  MySQL 8.0

## 引入依赖 ##

### 引入Spring Security依赖 ###

<dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-test</artifactId>
      <scope>test</scope>
    </dependency>

### 引入Spring Data JPA和MySQL依赖 ###

<dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
    <dependency>
      <groupId>mysql</groupId>
      <artifactId>mysql-connector-java</artifactId>
      <scope>runtime</scope>
    </dependency>

### 引入Thymeleaf依赖 ###

<dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>
    <dependency>
      <groupId>org.thymeleaf.extras</groupId>
      <artifactId>thymeleaf-extras-springsecurity5</artifactId>
    </dependency>

说明：

*  `thymeleaf-extras-springsecurity5` 为Thymeleaf对应Spring 5的security的依赖。

### 引入前端依赖 ###

因为采用的时Thymeleaf，不是前后端分离架构，因此需要额外引入前端依赖，或者需要将前端所需要的静态文件放到相应目录或从CDN获取。

<dependency>
      <groupId>org.webjars</groupId>
      <artifactId>bootstrap</artifactId>
      <version>3.3.7</version>
    </dependency>
    <dependency>
      <groupId>org.webjars</groupId>
      <artifactId>jquery</artifactId>
      <version>3.2.1</version>
    </dependency>

### 引入其他依赖 ###

<dependency>
      <groupId>org.projectlombok</groupId>
      <artifactId>lombok</artifactId>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>commons-beanutils</groupId>
      <artifactId>commons-beanutils</artifactId>
      <version>1.9.3</version>
    </dependency>

## 表设计 ##

创建以下表：

*  `t_sys_user` \- 用户信息表
 *  `t_sys_role` \- 角色信息表
 *  `t_sys_user_role` \- 用户和角色关联表 （用户和角色是多对多的关系）

-- 用户信息表
    DROP TABLE IF EXISTS `t_sys_user`;
    CREATE TABLE `t_sys_user` (
      `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT COMMENT '用户ID',
      `login_name` varchar(32) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '登录账号',
      `user_name` varchar(32) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '用户名称',
      `email` varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '' COMMENT '用户邮箱',
      `phone` varchar(32) COLLATE utf8mb4_unicode_ci DEFAULT '' COMMENT '手机号码',
      `password` varchar(64) COLLATE utf8mb4_unicode_ci DEFAULT '' COMMENT '密码',
      PRIMARY KEY (`id`),
      UNIQUE KEY `UK_LOGIN_NAME` (`login_name`) USING BTREE
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='用户信息表';
    
    
    -- 角色信息表
    DROP TABLE IF EXISTS `t_sys_role`;
    CREATE TABLE `t_sys_role` (
      `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT COMMENT '角色ID',
      `role_name` varchar(32) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '角色名称',
      `role_key` varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '角色权限字符串',
      PRIMARY KEY (`id`)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='角色信息表';
    
    
    -- 用户和角色关联表
    DROP TABLE IF EXISTS `t_sys_user_role`;
    CREATE TABLE `t_sys_user_role`
    (
        `user_id` bigint(20) unsigned NOT NULL COMMENT '用户ID',
        `role_id` bigint(20) unsigned NOT NULL COMMENT '角色ID',
        PRIMARY KEY (`user_id`, `role_id`)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='用户和角色关联表';

## API设计 ##

创建以下API：

<table> 
 <thead> 
  <tr> 
   <th>URI</th> 
   <th>HTTP Method</th> 
   <th>说明</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td><code>/</code></td> 
   <td>GET</td> 
   <td>跳转到首页index.html</td> 
  </tr> 
  <tr> 
   <td><code>/login</code></td> 
   <td>GET</td> 
   <td>跳转到登录页login.html</td> 
  </tr> 
  <tr> 
   <td><code>/registration</code></td> 
   <td>GET</td> 
   <td>跳转到用户注册页registration.html</td> 
  </tr> 
  <tr> 
   <td><code>/registration</code></td> 
   <td>POST</td> 
   <td>用户注册</td> 
  </tr> 
 </tbody> 
</table>

## 应用配置 ##

`application.yaml` 配置如下：

spring:
      datasource:
        url: jdbc:mysql://${ database-service:localhost}:3306/${ database-name:foxdb}?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8
        username: ${ database-user:foxuser}
        password: ${ database-password:foxpassword}
        driver-class-name: com.mysql.cj.jdbc.Driver
      jpa:
        show-sql: true

## 配置Spring Security ##

创建一个Spring Security配置类：

@Configuration
    @EnableWebSecurity
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 
    
        @Autowired
        private UserService userService;
    
        /** * Auth whitelist: * - Static files * - SwaggerUI for both Swagger2 and Swagger3 * https://stackoverflow.com/questions/37671125/how-to-configure-spring-security-to-allow-swagger-url-to-be-accessed-without-aut * - registration * */
        private static final String [] AUTH_WHITELIST = { 
            "/js/**",
            "/css/**",
            "/img/**",
            "/webjars/**",
            "/registration**"
        };
    
        @Override
        protected void configure(HttpSecurity http) throws Exception { 
            http
                    .authorizeRequests()
                        .antMatchers(AUTH_WHITELIST).permitAll()
                        .anyRequest().authenticated()
                        .and()
                    .formLogin()
                        .loginPage("/login")
                        .permitAll()
                        .and()
                    .logout()
                        .invalidateHttpSession(true)
                        .clearAuthentication(true)
                        .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                        .logoutSuccessUrl("/login?logout")
                        .permitAll();
        }
    
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
            auth.authenticationProvider(authenticationProvider());
        }
    
        @Bean
        public DaoAuthenticationProvider authenticationProvider() { 
            DaoAuthenticationProvider auth = new DaoAuthenticationProvider();
            auth.setUserDetailsService(userService);
            auth.setPasswordEncoder(passwordEncoder());
            return auth;
        }
    
        @Bean
        public BCryptPasswordEncoder passwordEncoder() { 
            return new BCryptPasswordEncoder();
        }
        
    }

说明：

*  配置URI白名单，对白名单内的URI不需要登录，其它URI都需要登录。
 *  配置了认证provider的UserDetailsService为`UserService` 类，PasswordEncoder为`BCryptPasswordEncoder`。

## Web层 ##

### HomeController类 ###

创建`HomeController` 类用来跳转到首页和登录页：

@Controller
    public class HomeController { 
    
        @GetMapping("/")
        public String home() { 
            return "index";
        }
    
        @GetMapping("/login")
        public String login(Model model) { 
            return "login";
        }
    }

说明：

*  定义了两个URI，分别跳转到首页和登录页。

### RegistrationController类 ###

创建`RegistrationController` 类用来跳转到用户注册页和作用户注册：

@Controller
    @RequestMapping("/registration")
    @Slf4j
    public class RegistrationController { 
    
        private final UserService userService;
    
        public RegistrationController(UserService userService) { 
            this.userService = userService;
        }
    
        @ModelAttribute("user")
        public RegistrationDto registrationDto(){ 
            return new RegistrationDto();
        }
    
        @GetMapping
        public String showRegistrationForm(Model model) { 
            return "registration";
        }
    
        @PostMapping
        public String registerUserAccount(@ModelAttribute("user") @Valid RegistrationDto registrationDto,
                                        BindingResult bindingResult) { 
            if (userService.findUserByLoginName(registrationDto.getLoginName()).isPresent()) { 
                bindingResult.reject("email", null, "Login name already exist.");
            }
            if (bindingResult.hasErrors()) { 
                log.error("Regisration error: ", bindingResult.getAllErrors());
                return "registration";
            }
            userService.save(registrationDto);
            return "redirect:/registration?success";
        }
    }

说明：

*  GET方法 - 跳转到用户注册页。
 *  POST方法 - 作用户注册。

### RegistrationDto类 ###

创建`RegistrationDto`类来传输用户注册时填写的信息：

@Data
    @FieldMatch.List({ 
            @FieldMatch(
                    first = "password",
                    second = "confirmPassword",
                    message = "The password and confirm password should be same")
    })
    public class RegistrationDto { 
        @NotBlank(message = "Login name is mandatory")
        private String loginName;
        @NotBlank(message = "User name is mandatory")
        private String userName;
        @NotBlank(message = "Email is mandatory")
        @Email
        private String email;
        private String phone;
        @NotBlank(message = "Password is mandatory")
        private String password;
        @NotBlank(message = "Confirm password is mandatory")
        private String confirmPassword;
        @AssertTrue
        private Boolean terms;
    
    }

### 字段校验 ###

自定义`FieldMatch` 注解用于比较两个字段值是否相同。

package cn.xdevops.fox.admin.constraint;
    
    import javax.validation.Constraint;
    import javax.validation.Payload;
    import java.lang.annotation.Documented;
    import java.lang.annotation.Retention;
    import java.lang.annotation.Target;
    
    import static java.lang.annotation.ElementType.ANNOTATION_TYPE;
    import static java.lang.annotation.ElementType.TYPE;
    import static java.lang.annotation.RetentionPolicy.RUNTIME;
    
    @Target({ 
            TYPE,
            ANNOTATION_TYPE
    })
    @Retention(RUNTIME)
    @Constraint(validatedBy = FieldMatchValidator.class)
    @Documented
    public @interface FieldMatch { 
        String message() default "{constraints.field-match}";
        Class < ? > [] groups() default { };
        Class < ? extends Payload> [] payload() default { };
        String first();
        String second();
    
        @Target({ 
                TYPE,
                ANNOTATION_TYPE
        })
        @Retention(RUNTIME)
        @Documented
        @interface List { 
            FieldMatch[] value();
        }
    }

对应的Validator类：

public class FieldMatchValidator implements ConstraintValidator<FieldMatch, Object> { 
    
        private String firstFieldName;
        private String secondFieldName;
    
        @Override
        public void initialize(final FieldMatch constraintAnnotation) { 
            firstFieldName = constraintAnnotation.first();
            secondFieldName = constraintAnnotation.second();
        }
    
        @Override
        public boolean isValid(final Object value, final ConstraintValidatorContext context) { 
            try { 
                final Object firstObj = BeanUtils.getProperty(value, firstFieldName);
                final Object secondObj = BeanUtils.getProperty(value, secondFieldName);
                return Objects.equals(firstObj, secondObj);
            } catch (Exception e) { 
    
            }
            return true;
        }
    }

## Service层 ##

创建`UserService`类：

@Service
    public class UserService implements UserDetailsService { 
    
        private final UserRepository userRepository;
    
        @Autowired
        private BCryptPasswordEncoder passwordEncoder;
    
        public UserService(UserRepository userRepository) { 
            this.userRepository = userRepository;
        }
    
        @Override
        public UserDetails loadUserByUsername(String loginName) throws UsernameNotFoundException { 
            User user = userRepository.findUserByLoginName(loginName);
            if (user == null) { 
                throw new UsernameNotFoundException("Invalid username or password.");
            }
    
            return new org.springframework.security.core.userdetails.User(user.getLoginName(),
                    user.getPassword(),
                    mapRoleToAuthorities(user.getRoles()));
        }
    
        private List<? extends GrantedAuthority> mapRoleToAuthorities(List<Role> roles) { 
            return roles.stream()
                    .map(role -> new SimpleGrantedAuthority(role.getRoleName()))
                    .collect(Collectors.toList());
        }
    
        public Optional<User> findUserByLoginName(String loginName) { 
            return Optional.ofNullable(userRepository.findUserByLoginName(loginName));
        }
    
        public Optional<User> save(RegistrationDto registrationDto) { 
            User user = new User();
            user.setLoginName(registrationDto.getLoginName());
            user.setUserName(registrationDto.getUserName());
            user.setEmail(registrationDto.getEmail());
            user.setPassword(passwordEncoder.encode(registrationDto.getPassword()));
            user.setRoles(Arrays.asList(new Role("User", "ROLE_USER")));
            return Optional.of(userRepository.save(user));
        }
    }

说明：

*  实现Spring Security的`UserDetailsService`接口。
    
     *  Override `loadUserByUsername` 方法，根据loginName查找用户，并将该用户的(loginName, password)传给Spring Security与登录时提交的（loginName, password) 作比较。
 *  定义用户注册时保存用户和角色信息的`save()` 方法。

## 数据层 ##

### JPA Entities ###

#### User Entity类 ####

@Data
    @NoArgsConstructor
    @AllArgsConstructor
    @Entity
    @Table(name = "t_sys_user")
    public class User implements Serializable { 
    
        private static final long serialVersionUID = 1L;
    
        @Id
        @Column(name = "id")
        @GeneratedValue(strategy = GenerationType.IDENTITY)
        private Long id;
    
        @Column(name = "login_name")
        private String loginName;
    
        @Column(name = "user_name")
        private String userName;
    
        @Column(name = "email")
        private String email;
    
        @Column(name = "phone")
        private String phone;
    
        @Column(name = "password")
        private String password;
    
        @ManyToMany(fetch = FetchType.EAGER, cascade = CascadeType.ALL)
        @JoinTable(
                name = "t_sys_user_role",
                joinColumns = @JoinColumn(
                        name = "user_id", referencedColumnName = "id"
                ),
                inverseJoinColumns = @JoinColumn(
                        name = "role_id", referencedColumnName = "id"
                )
        )
        private List<Role> roles;
    
    
    }

说明：

*  定义了User Entity，并定义了User和Role的多对多关系。
 *  定义了一个User可以有多个Role。

#### Role Entity类 ####

@Data
    @NoArgsConstructor
    @AllArgsConstructor
    @Entity
    @Table(name = "t_sys_role")
    public class Role implements Serializable { 
    
        private static final long serialVersionUID = 1L;
    
        @Id
        @Column(name = "id")
        @GeneratedValue(strategy = GenerationType.IDENTITY)
        private Long id;
    
        @Column(name = "role_name")
        private String roleName;
    
        @Column(name = "role_key")
        private String roleKey;
    
        public Role(String roleName, String roleKey) { 
            this.roleName = roleName;
            this.roleKey = roleKey;
        }
    }

说明：

*  定义了Role Entity类。
 *  定义了`Role(roleName, roleKey)` 构造方法。

### JPA Repository ###

#### UserRepository类 ####

public interface UserRepository extends JpaRepository<User, Long> { 
    
        User findUserByLoginName(String loginName);
    }

说明：

*  定义了根据loginName查找用户的方法，其它默认继承JpaRepository。

#### RoleRepository类 ####

public interface RoleRepository extends JpaRepository<Role, Long> { 
    
    }

## 前端页面 ##

### index.html ###

<!DOCTYPE html>
    <html xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
    
    <head>
        <meta charset="utf-8" />
        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
        <meta name="viewport" content="width=device-width, initial-scale=1" />
    
        <link rel="stylesheet" type="text/css" th:href="@{/webjars/bootstrap/3.3.7/css/bootstrap.min.css}" />
    
        <title>Registration</title>
    </head>
    
    <body>
    <nav class="navbar navbar-inverse navbar-fixed-top">
        <div class="container">
            <div class="navbar-header">
                <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar" aria-expanded="false" aria-controls="navbar">
                    <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span>
                </button>
                <a class="navbar-brand" href="#" th:href="@{/}">Registration and
                    Login Module</a>
            </div>
            <div id="navbar" class="collapse navbar-collapse">
                <ul class="nav navbar-nav">
                    <li sec:authorize="isAuthenticated()"><a th:href="@{/logout}">Logout</a></li>
                </ul>
            </div>
        </div>
    </nav>
    
    <br>
    <br>
    <div class="container">
        <h2>User Registration and Login Module using Spring Boot, Spring MVC, Spring Security, JPA/Hibernate and Thymeleaf</h2>
    
        <p>
            Welcome <span sec:authentication="principal.username">User</span>
        </p>
    </div>
    
    <script type="text/javascript" th:src="@{/webjars/jquery/3.2.1/jquery.min.js/}"></script>
    <script type="text/javascript" th:src="@{/webjars/bootstrap/3.3.7/js/bootstrap.min.js}"></script>
    
    </body>
    
    </html>

### login.html ###

### registration.html ###

<!DOCTYPE html>
    <html xmlns:th="http://www.thymeleaf.org">
    
    <head>
        <meta charset="utf-8" />
        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
        <meta name="viewport" content="width=device-width, initial-scale=1" />
    
        <link rel="stylesheet" type="text/css" th:href="@{/webjars/bootstrap/3.3.7/css/bootstrap.min.css}" />
    
        <title>Registration</title>
    </head>
    
    <body>
    <nav class="navbar navbar-inverse navbar-fixed-top">
        <div class="container">
            <div class="navbar-header">
                <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar" aria-expanded="false" aria-controls="navbar">
                    <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span>
                </button>
                <a class="navbar-brand" href="#" th:href="@{/}">Registration and
                    Login Module</a>
            </div>
        </div>
    </nav>
    
    <br>
    <br>
    
    <div class="container">
        <div class="row">
            <div class="col-md-6 col-md-offset-3">
    
                <div th:if="${param.success}">
                    <div class="alert alert-info">You've successfully registered to our awesome app!</div>
                </div>
    
                <h1>Registration</h1>
                <form th:action="@{/registration}" th:object="${user}" method="post">
    
                    <p class="error-message" th:if="${#fields.hasGlobalErrors()}" th:each="error : ${#fields.errors('global')}" th:text="${error}">Validation error
                    </p>
    
                    <div class="form-group" th:classappend="${#fields.hasErrors('loginName')}? 'has-error':''">
                        <label for="loginName" class="control-label">Login name</label> <input id="loginName" class="form-control" th:field="*{loginName}" />
                        <p class="error-message" th:each="error: ${#fields.errors('loginName')}" th:text="${error}">Validation error</p>
                    </div>
                    <div class="form-group" th:classappend="${#fields.hasErrors('userName')}? 'has-error':''">
                        <label for="userName" class="control-label">User name</label> <input id="userName" class="form-control" th:field="*{userName}" />
                        <p class="error-message" th:each="error : ${#fields.errors('userName')}" th:text="${error}">Validation error</p>
                    </div>
                    <div class="form-group" th:classappend="${#fields.hasErrors('email')}? 'has-error':''">
                        <label for="email" class="control-label">Email</label> <input id="email" class="form-control" th:field="*{email}" />
                        <p class="error-message" th:each="error : ${#fields.errors('email')}" th:text="${error}">Validation error
                        </p>
                    </div>
                    <div class="form-group" th:classappend="${#fields.hasErrors('phone')}? 'has-error':''">
                        <label for="email" class="control-label">Phone</label> <input id="phone" class="form-control" th:field="*{phone}" />
                        <p class="error-message" th:each="error : ${#fields.errors('phone')}" th:text="${error}">Validation error
                        </p>
                    </div>
                    <div class="form-group" th:classappend="${#fields.hasErrors('password')}? 'has-error':''">
                        <label for="password" class="control-label">Password</label> <input id="password" class="form-control" type="password" th:field="*{password}" />
                        <p class="error-message" th:each="error : ${#fields.errors('password')}" th:text="${error}">Validation error</p>
                    </div>
                    <div class="form-group" th:classappend="${#fields.hasErrors('confirmPassword')}? 'has-error':''">
                        <label for="confirmPassword" class="control-label">Confirm
                            password</label> <input id="confirmPassword" class="form-control" type="password" th:field="*{confirmPassword}" />
                        <p class="error-message" th:each="error : ${#fields.errors('confirmPassword')}" th:text="${error}">Validation error</p>
                    </div>
                    <div class="form-group" th:classappend="${#fields.hasErrors('terms')}? 'has-error':''">
                        <input id="terms" type="checkbox" th:field="*{terms}" /> <label class="control-label" for="terms"> I agree with the <a href="#">terms and conditions</a> for Registration.
                    </label>
                        <p class="error-message" th:each="error : ${#fields.errors('terms')}" th:text="${error}">Validation error
                        </p>
                    </div>
                    <div class="form-group">
                        <button type="submit" class="btn btn-success">Register</button>
                        <span>Already registered? <a href="/" th:href="@{/login}">Login
            here</a></span>
                    </div>
    
                </form>
            </div>
        </div>
    </div>
    
    <script type="text/javascript" th:src="@{/webjars/jquery/3.2.1/jquery.min.js/}"></script>
    <script type="text/javascript" th:src="@{/webjars/bootstrap/3.3.7/js/bootstrap.min.js}"></script>
    </body>
    </html>

## 参考文档 ##

*  [Registration + Login Example using Spring Boot, Spring Security, Spring Data JPA, Hibernate, MySQL, Thymeleaf][Registration _ Login Example using Spring Boot_ Spring Security_ Spring Data JPA_ Hibernate_ MySQL_ Thymeleaf]
 *  [Securing a Web Application][]
 *  [Spring Security Architecture][]
 *  [Spring Security Reference][]

[Registration _ Login Example using Spring Boot_ Spring Security_ Spring Data JPA_ Hibernate_ MySQL_ Thymeleaf]: https://www.javaguides.net/2019/08/registration-login-example-using-springboot-spring-data-jpa-hibernate-mysql-thymeleaf.html
[Securing a Web Application]: https://spring.io/guides/gs/securing-web/
[Spring Security Architecture]: https://spring.io/guides/topicals/spring-security-architecture
[Spring Security Reference]: https://docs.spring.io/spring-security/site/docs/current/reference/html5/