Thymeleaf-extras-Spring Security 权限控制

我不是女神ヾ 2022-02-25 08:20 171阅读 0赞

**目录**

Thymeleaf-extras-Spring Security 概述

--------------------

# Thymeleaf-extras-Spring Security 概述 #

1、[spring-security][] 是 spring 提供身份验证和授权的安全框架，用于后台编码，对于前端页面，Thymeleaf 模板引擎对它提供了良好的支持。

2、Spring boot 内置 [thymeleaf ][thymeleaf]作为模板引擎，启动器为 spring-boot-starter-thymeleaf，但这个组件只是提供了 Thymeleaf 的核心功能，并没有 spring-security 安全组件的标签。

3、[thymeleaf 官网][thymeleaf 1] 根据功能不同，提供了不同的组件支持，其中支持 spring-security 的是 **[thymeleaf-extras-springsecurity][] **

<table> 
 <thead> 
  <tr> 
   <th>Module</th> 
   <th>Repository</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>Core library</td> 
   <td><a href="https://github.com/thymeleaf/thymeleaf" rel="nofollow">https://github.com/thymeleaf/thymeleaf</a></td> 
  </tr> 
  <tr> 
   <td>Spring integration</td> 
   <td><a href="https://github.com/thymeleaf/thymeleaf-spring" rel="nofollow">https://github.com/thymeleaf/thymeleaf-spring</a></td> 
  </tr> 
  <tr> 
   <td>Documentation</td> 
   <td><a href="https://github.com/thymeleaf/thymeleaf-docs" rel="nofollow">https://github.com/thymeleaf/thymeleaf-docs</a></td> 
  </tr> 
  <tr> 
   <td>Testing library</td> 
   <td><a href="https://github.com/thymeleaf/thymeleaf-testing" rel="nofollow">https://github.com/thymeleaf/thymeleaf-testing</a></td> 
  </tr> 
  <tr> 
   <td>Test suites</td> 
   <td><a href="https://github.com/thymeleaf/thymeleaf-tests" rel="nofollow">https://github.com/thymeleaf/thymeleaf-tests</a></td> 
  </tr> 
  <tr> 
   <td>Benchmarks</td> 
   <td><a href="https://github.com/thymeleaf/thymeleaf-benchmarks" rel="nofollow">https://github.com/thymeleaf/thymeleaf-benchmarks</a></td> 
  </tr> 
  <tr> 
   <td><span style="color:#f33b45;">Spring Security integration</span></td> 
   <td><a href="https://github.com/thymeleaf/thymeleaf-extras-springsecurity" rel="nofollow">https://github.com/thymeleaf/thymeleaf-extras-springsecurity</a></td> 
  </tr> 
  <tr> 
   <td>Java 8 Time API compatibility</td> 
   <td><a href="https://github.com/thymeleaf/thymeleaf-extras-java8time" rel="nofollow">https://github.com/thymeleaf/thymeleaf-extras-java8time</a></td> 
  </tr> 
  <tr> 
   <td>Tiles 2 integration</td> 
   <td><a href="https://github.com/thymeleaf/thymeleaf-extras-tiles2" rel="nofollow">https://github.com/thymeleaf/thymeleaf-extras-tiles2</a></td> 
  </tr> 
  <tr> 
   <td>IE Conditional Comments support</td> 
   <td><a href="https://github.com/thymeleaf/thymeleaf-extras-conditionalcomments" rel="nofollow">https://github.com/thymeleaf/thymeleaf-extras-conditionalcomments</a></td> 
  </tr> 
 </tbody> 
</table>

4、[thymeleaf-extras-springsecurity][] 是 Thymeleaf 的附加模块，不属于 Thymeleaf  核心的一部分，同样遵循它自己的版本化模式），但得到了 Thymeleaf  团队的完全支持。Thymeleaf 根据 Spring Security 的不同版本提供了自己对应的版本：

> thymeleaf-extras-springsecurity3 for integration with Spring Security 3.x  
> thymeleaf-extras-springsecurity4 for integration with Spring Security 4.x  
> thymeleaf-extras-springsecurity5 for integration with Spring Security 5.x

5、[thymeleaf-extras-springsecurity][] 的 Maven 依赖 groupId 与 artifactId 写法如下：

<table> 
 <tbody> 
  <tr> 
   <td>groupId</td> 
   <td>org.thymeleaf.extras</td> 
  </tr> 
  <tr> 
   <td>artifactId</td> 
   <td>Spring Security 3 integration package: thymeleaf-extras-springsecurity3<br> Spring Security 4 integration package: thymeleaf-extras-springsecurity4<br> Spring Security 5 integration package: thymeleaf-extras-springsecurity5</td> 
  </tr> 
 </tbody> 
</table>

6、[thymeleaf-extras-springsecurity][] 方言所有版本的名称空间是 http://www.thymeleaf.org/extras/spring-security)，使用不正确的命名空间虽然不会影响模板的处理，但是，当涉及到模板中的建议/自动补全等问题时，它可能会影响您的 IDE：

>   <html xmlns:sec="http://www.thymeleaf.org/extras/spring-security">

# Thymeleaf-extras-Spring Security 权限控制 #

1、本文环境：Spring boot 2.1.3 + Spring Security5.1.4 + Thymeleaf-extras-springsecurity5 ：

> 关于 Spring Security 的内容，可以参考《[Spring Security 安全框架概述 与 快速入门][Spring Security _ _]》
> 
> 关于 Thymeleaf 的内容，可以参考《[Thymeleaf 模板引擎简介 与 Spring Boot 整合入门][Thymeleaf _ _ Spring Boot]》

<?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
        <parent>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-parent</artifactId>
            <version>2.1.3.RELEASE</version>
            <relativePath/>
            
        </parent>
        <groupId>www.wmx.com</groupId>
        <artifactId>spring-security-app</artifactId>
        <version>0.0.1-SNAPSHOT</version>
        <name>spring-security-app</name>
        <description>Demo project for Spring Boot</description>
        <properties>
            <java.version>1.8</java.version>
        </properties>
    
        <dependencies>
            
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>
    
            
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-thymeleaf</artifactId>
            </dependency>
    
            
            <dependency>
                <groupId>org.thymeleaf.extras</groupId>
                <artifactId>thymeleaf-extras-springsecurity5</artifactId>
            </dependency>
    
            
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
    
            
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-test</artifactId>
                <scope>test</scope>
            </dependency>
    
            
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-test</artifactId>
                <scope>test</scope>
            </dependency>
    
            
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-devtools</artifactId>
                <optional>true</optional>
                <scope>true</scope>
            </dependency>
        </dependencies>
    
        <build>
            <plugins>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                    <configuration>
                        
                        <fork>true</fork>
                    </configuration>
                </plugin>
            </plugins>
        </build>
    </project>

2、后台代码和平常没什么区别，不同点是前端 html 页面中使用 thymeleaf 标签即可：

<!DOCTYPE html>
    
    <html xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
    <head lang="en">
        <meta charset="UTF-8">
        <title>蚩尤后裔</title>
    </head>
    <body>
    <h2>欢迎来到大熊山</h2>
    
    <div sec:authorize="!isAuthenticated()">
        <span style="color: red">温馨提示：使用前请先登录<a th:href="@{/login}">登录</a></span>
    </div>
    
    <div sec:authorize="isAuthenticated()">
        当前登录用户：<span sec:authentication="name">zhangWuJi</span>  当前角色：<span
            sec:authentication="principal.authorities"></span><br>
        <a href="#" th:href="@{/logout}">注销</a><br><br>
    </div>
    <fieldset>
        <legend>学生管理</legend>
        <div sec:authorize="hasRole('topLevel')">
            <a th:href="@{/user/addUser}">添加学生</a><br><br>
        </div>
        <div sec:authorize="hasAnyRole('topLevel','senior')">
            <a th:href="@{/user/deleteUser/101}">删除学生</a><br><br>
        </div>
        <div sec:authorize="hasAnyRole('topLevel','senior','middleRank')">
            <a th:href="@{/user/updateUser}">修改学生</a><br><br>
        </div>
        <a th:href="@{/user/findAllUsers}">查询学生</a><br><br>
    </fieldset>
    </body>
    </html>

<table> 
 <tbody> 
  <tr> 
   <td>xmlns:sec="http://www.thymeleaf.org/extras/spring-security"</td> 
   <td>&lt;html&gt; 中加入命名空间&nbsp; xmlns:sec，这样 IDE 在编写标签的时候就会有提示信息。不加也不影响运行。</td> 
  </tr> 
  <tr> 
   <td>sec:authorize="!isAuthenticated()"</td> 
   <td>判断当前用户是否已经进行用户认证，已经认证通过时返回 true，继续执行里面的内容，否则不执行。"！"表示取反。</td> 
  </tr> 
  <tr> 
   <td>&nbsp;sec:authentication="name"</td> 
   <td>获取当前认证用户的用户名，也就是后台 configure(AuthenticationManagerBuilder auth) 方法中&nbsp;withUser("xxx") 设置的用户名称。值会作为标签提的内容。</td> 
  </tr> 
  <tr> 
   <td>sec:authentication="principal.authorities"</td> 
   <td>获取当前认证用户的角色，因为一个用户可以有多个角色，所以值是一个数组。</td> 
  </tr> 
  <tr> 
   <td>sec:authorize="hasRole('topLevel')"</td> 
   <td>判断当前用户如果有&nbsp;topLevel 角色则返回 true，同时指向里面的内容，否则不执行</td> 
  </tr> 
  <tr> 
   <td>sec:authorize="hasAnyRole('topLevel','senior')"</td> 
   <td>判断当前用户是否有&nbsp;'topLevel' 角色，或者 'senior'角色，有则继续指向内部的内容，否则不执行。（<span style="color:#f33b45;">完全对应后台 http.authorizeRequests() 设置的角色</span>）</td> 
  </tr> 
 </tbody> 
</table>

3、下面以用户 yangGuo 可以访问 updateUser、findAllUsers 方法 为例进行演示：

![20190401190840431.gif][]

> 查询学生针对所有用户开放，所以未登录时也可以访问。
> 
> 未登录时无法看到用于权限的内容，登录后也只能看到自己角色权限之内的内容。

> 更多关于 Thymeleaf-Extras-SpringSecurity 插件的内容参考官网：[https://github.com/thymeleaf/thymeleaf-extras-springsecurity][thymeleaf-extras-springsecurity]

[spring-security]: https://spring.io/projects/spring-security
[thymeleaf]: https://www.thymeleaf.org/
[thymeleaf 1]: https://www.thymeleaf.org/download.html
[thymeleaf-extras-springsecurity]: https://github.com/thymeleaf/thymeleaf-extras-springsecurity
[Spring Security _ _]: https://mp.csdn.net/console/editor/html/88867153
[Thymeleaf _ _ Spring Boot]: https://mp.csdn.net/console/editor/html/81054474
[20190401190840431.gif]: /images/20220225/cf72aceb2e664c6fa3cd83847c6e463b.png