spring boot security学习

た入场券 2023-01-08 05:25 106阅读 0赞

### spring boot security学习 ###

1.  自定以securityconfig
    
        package com.cai.config;
        
        import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
        import org.springframework.security.config.annotation.web.builders.HttpSecurity;
        import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
        import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
        import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
        
        import java.beans.Encoder;
        
        /** * @BelongsProject:IntelliJ IDEA * @Package:com.cai.config * @Author:superman * @CreateTime:2021--01--17 11:04 * @Description: */
        //AOP横切
        @EnableWebSecurity
        public class SecurityConfig extends WebSecurityConfigurerAdapter { 
        
            //授权
            @Override
            protected void configure(HttpSecurity http) throws Exception { 
                //首页所有人可以访问,但是里面的功能页只有对应有权限的人才可以访问
                //请求授权的规则
                http.authorizeRequests()
                        .antMatchers("/").permitAll()
                        .antMatchers("/level1/**").hasRole("vip1")
                        .antMatchers("/level2/**").hasRole("vip2")
                        .antMatchers("/level3/**").hasRole("vip3");
        
                //没有权限默认回到登录页面,需要开启登录的页面
                http.formLogin().loginPage("/toLogin");
        
                //防止网站攻击：get不安全，post
                //关闭csrf攻击功能
                http.csrf().disable();
        
                //注销,开启了注销功能,跳到首页
                http.logout().logoutSuccessUrl("/");
        
                //开启记住我功能 cookie,默认保存两周，自定义接受前端的参数
                http.rememberMe().rememberMeParameter("remember");
            }
        
            //认证，springboot2.1.x 可以直接使用
            //如果出现500说明版本过高，需要密码加密：PasswordEncoder
            //在spring security5.0+ 新增了很多的加密方式
            @Override
            protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
                //这些数据正常应该从数据库里面拿
                auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                        .withUser("admin").password(new BCryptPasswordEncoder().encode("123456")).roles("vip2","vip3")
                        .and()
                        .withUser("caiji").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2","vip3")
                        .and()
                        .withUser("guest").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1");
            }
        }
2.  创建routercontroller
    
        package com.cai.controller;
        
        import org.springframework.stereotype.Controller;
        import org.springframework.web.bind.annotation.PathVariable;
        import org.springframework.web.bind.annotation.RequestMapping;
        
        /** * @BelongsProject:IntelliJ IDEA * @Package:com.cai.controller * @Author:superman * @CreateTime:2021--01--17 10:48 * @Description: */
        @Controller
        public class RouterController { 
        
            @RequestMapping({ "/","/index"})
            public String index(){ 
                return "index";
            }
        
            @RequestMapping("/toLogin")
            public String toLogin(){ 
                return "views/login";
            }
        
            @RequestMapping("/level1/{id}")
            public String level1(@PathVariable("id") int id){ 
                return "views/level1/"+id;
            }
        
            @RequestMapping("/level2/{id}")
            public String level2(@PathVariable("id") int id){ 
                return "views/level2/"+id;
            }
        
            @RequestMapping("/level3/{id}")
            public String level3(@PathVariable("id") int id){ 
                return "views/level3/"+id;
            }
        
        }
3.  权限控制页面
    
        <!DOCTYPE html>
        <html lang="en" xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
        <head>
            <meta charset="UTF-8">
            <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
            <title>首页</title>
            
            <link href="https://cdn.bootcss.com/semantic-ui/2.4.1/semantic.min.css" rel="stylesheet">
            <link th:href="@{/qinjiang/css/qinstyle.css}" rel="stylesheet">
        </head>
        <body>
        
        
        <div class="ui container">
        
            <div class="ui segment" id="index-header-nav" th:fragment="nav-menu">
                <div class="ui secondary menu">
                    <a class="item" th:href="@{/index}">首页</a>
        
                    
                    <div class="right menu">
        
        
                        
                        <div sec:authorize="!isAuthenticated()">
                            
                            <a class="item" th:href="@{/toLogin}">
                                <i class="address card icon"></i> 登录
                            </a>
                        </div>
        
        
                        <div sec:authorize="isAuthenticated()">
                            
                            <a class="item" th:href="@{/logout}">
                                <i class="sign-out icon"></i> 注销
                            </a>
                        </div>
        
                        <div sec:authorize="isAuthenticated()">
                            
                            <a class="item">
                                用户名：<span sec:authentication="name"></span>
                                角色：<span sec:authentication="principal.authorities"></span>
                            </a>
                        </div>
        
        
                    </div>
                </div>
            </div>
        
            <div class="ui segment" style="text-align: center">
                <h3>Spring Security Study by 秦疆</h3>
            </div>
        
            <div>
                <br>
                <div class="ui three column stackable grid">
        
        
                    
                    <div class="column" sec:authorize="hasRole('vip1')">
                        <div class="ui raised segment">
                            <div class="ui">
                                <div class="content">
                                    <h5 class="content">Level 1</h5>
                                    <hr>
                                    <div><a th:href="@{/level1/1}"><i class="bullhorn icon"></i> Level-1-1</a></div>
                                    <div><a th:href="@{/level1/2}"><i class="bullhorn icon"></i> Level-1-2</a></div>
                                    <div><a th:href="@{/level1/3}"><i class="bullhorn icon"></i> Level-1-3</a></div>
                                </div>
                            </div>
                        </div>
                    </div>
        
                    <div class="column" sec:authorize="hasRole('vip2')">
                        <div class="ui raised segment">
                            <div class="ui">
                                <div class="content">
                                    <h5 class="content">Level 2</h5>
                                    <hr>
                                    <div><a th:href="@{/level2/1}"><i class="bullhorn icon"></i> Level-2-1</a></div>
                                    <div><a th:href="@{/level2/2}"><i class="bullhorn icon"></i> Level-2-2</a></div>
                                    <div><a th:href="@{/level2/3}"><i class="bullhorn icon"></i> Level-2-3</a></div>
                                </div>
                            </div>
                        </div>
                    </div>
        
                    <div class="column" sec:authorize="hasRole('vip3')">
                        <div class="ui raised segment">
                            <div class="ui">
                                <div class="content">
                                    <h5 class="content">Level 3</h5>
                                    <hr>
                                    <div><a th:href="@{/level3/1}"><i class="bullhorn icon"></i> Level-3-1</a></div>
                                    <div><a th:href="@{/level3/2}"><i class="bullhorn icon"></i> Level-3-2</a></div>
                                    <div><a th:href="@{/level3/3}"><i class="bullhorn icon"></i> Level-3-3</a></div>
                                </div>
                            </div>
                        </div>
                    </div>
        
                </div>
            </div>
        
        </div>
        
        
        <script th:src="@{/qinjiang/js/jquery-3.1.1.min.js}"></script>
        <script th:src="@{/qinjiang/js/semantic.min.js}"></script>
        
        </body>
        </html>