springsecurity入门

布满荆棘的人生 2024-02-19 14:11 40阅读 0赞

## springsecurity入门教程 ##

### 1. springsecurity介绍 ###

Spring 是一个非常流行和成功的 Java 应用开发框架。Spring Security 基于 Spring 框架，提供了一套 Web 应用安全性的完整解决方案。Web 应用的安全性包括用户认证（Authentication）和用户授权（Authorization）两个部分。

### 2. springsecurity入门 ###

#### 2.1 创建一个maven工程（war） ####

##### 2.1.1 导入pom依赖 #####

<?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
        <groupId>cn.hqlearn</groupId>
        <artifactId>springsecurity_demo01</artifactId>
        <version>1.0-SNAPSHOT</version>
        <packaging>war</packaging>
        <properties>
            <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
            <maven.compiler.source>1.8</maven.compiler.source>
            <maven.compiler.target>1.8</maven.compiler.target>
        </properties>
    
        <dependencies>
            
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-core</artifactId>
                <version>4.2.3.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-beans</artifactId>
                <version>4.2.3.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-tx</artifactId>
                <version>4.2.3.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-context</artifactId>
                <version>4.2.3.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-context-support</artifactId>
                <version>4.2.3.RELEASE</version>
            </dependency>
    
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-web</artifactId>
                <version>4.2.3.RELEASE</version>
            </dependency>
    
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-webmvc</artifactId>
                <version>4.2.3.RELEASE</version>
            </dependency>
    
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-jms</artifactId>
                <version>4.2.3.RELEASE</version>
            </dependency>
    
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-jdbc</artifactId>
                <version>4.2.3.RELEASE</version>
            </dependency>
            
            <dependency>
                <groupId>org.aspectj</groupId>
                <artifactId>aspectjrt</artifactId>
                <version>1.8.6</version>
            </dependency>
    
            <dependency>
                <groupId>org.aspectj</groupId>
                <artifactId>aspectjweaver</artifactId>
                <version>1.8.6</version>
            </dependency>
    
    
            
            <dependency>
                <groupId>javax.servlet</groupId>
                <artifactId>javax.servlet-api</artifactId>
                <version>3.1.0</version>
            </dependency>
    
            <dependency>
                <groupId>javax.servlet.jsp</groupId>
                <artifactId>javax.servlet.jsp-api</artifactId>
                <version>2.3.1</version>
            </dependency>
    
            
            <dependency>
                <groupId>javax.servlet</groupId>
                <artifactId>jstl</artifactId>
                <version>1.2</version>
            </dependency>
    
    		
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-databind</artifactId>
                <version>2.7.5</version>
            </dependency>
    
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-core</artifactId>
                <version>2.7.5</version>
            </dependency>
    
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-annotations</artifactId>
                <version>2.7.5</version>
            </dependency>
    
            <dependency>
                <groupId>org.codehaus.jackson</groupId>
                <artifactId>jackson-core-asl</artifactId>
                <version>1.9.4</version>
            </dependency>
    
    
    
            
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-web</artifactId>
                <version>4.2.3.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-config</artifactId>
                <version>4.2.3.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-cas</artifactId>
                <version>4.2.3.RELEASE</version>
            </dependency>
    
            
            <dependency>
                <groupId>mysql</groupId>
                <artifactId>mysql-connector-java</artifactId>
                <version>8.0.13</version>
            </dependency>
    
            
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>druid</artifactId>
                <version>1.1.12</version>
            </dependency>
        </dependencies>
    
       
    </project>

##### 2.1.2 web.xml配置 #####

<?xml version="1.0" encoding="UTF-8"?>
    <web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
    
        
        <filter>
            <filter-name>characterEncodingFilter</filter-name>
            <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
            <init-param>
                <param-name>encoding</param-name>
                <param-value>UTF-8</param-value>
            </init-param>
            <init-param>
                <param-name>forceEncoding</param-name>
                <param-value>true</param-value>
            </init-param>
        </filter>
        <filter-mapping>
            <filter-name>characterEncodingFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        
        <filter>
            <filter-name>springSecurityFilterChain</filter-name>
            <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        </filter>
        <filter-mapping>
            <filter-name>springSecurityFilterChain</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
    
        
        
        <servlet>
            <servlet-name>DispatcherServlet
            </servlet-name>
            <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
            
            <init-param>
                <param-name>contextConfigLocation</param-name>
                
                
                
                
                
                <param-value>classpath:spring/springmvc.xml</param-value>
            </init-param>
            <load-on-startup>1</load-on-startup>
        </servlet>
        <servlet-mapping>
            
            
            <servlet-name>DispatcherServlet</servlet-name>
            
            
            
            <url-pattern>*.shtml</url-pattern> 
        </servlet-mapping>
    
    
        <welcome-file-list>
            <welcome-file>index.html</welcome-file>
            <welcome-file>index.jsp</welcome-file>
        </welcome-file-list>
    </web-app>

##### 2.1.3 加入springmvc配置 #####

##### 2.1.4 加入springsecurity配置 #####

<?xml version="1.0" encoding="UTF-8" ?>
    <beans:beans
            xmlns="http://www.springframework.org/schema/security"
            xmlns:beans="http://www.springframework.org/schema/beans"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://www.springframework.org/schema/beans
              http://www.springframework.org/schema/beans/spring-beans.xsd
              http://www.springframework.org/schema/security
                  http://www.springframework.org/schema/security/spring-security-4.2.xsd">
    
        
        <http pattern="/images/**" security="none"/>
        <http pattern="/login.shtml" security="none"/>
        <http pattern="/login/fail.shtml" security="none"/>
        <http pattern="/register.shtml" security="none"/>
    
    
        
        <http auto-config="true" use-expressions="false">
            
            <intercept-url pattern="/**" access="ROLE_ADMIN"/>
            
    
            
            <form-login login-page="/login.shtml"
                        default-target-url="/admin/user/list.shtml"
                        authentication-failure-url="/login/fail.shtml"
                        always-use-default-target="true"
                        username-parameter="username1"
                        password-parameter="password1"/>
    
            
            <csrf disabled="true"/>
    
    
            
            <logout logout-success-url="/images/1.png"/>
    
        </http>
    
        
        <authentication-manager>
            <authentication-provider user-service-ref="userDetailsServiceImpl">
                
                
    
    
                
                <password-encoder ref="encoder"/>
    
                
                
    
    
            </authentication-provider>
        </authentication-manager>
    
        
        <beans:bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
            <beans:constructor-arg name="strength" value="9"/>
        </beans:bean>
    
    
        
        <beans:bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource" destroy-method="close">
            <beans:property name="url"
                            value="jdbc:mysql://127.0.0.1:3306/springsecuritydb?characterEncoding=utf8&serverTimezone=GMT%2B8"/>
            <beans:property name="username" value="root"/>
            <beans:property name="password" value="root"/>
            <beans:property name="driverClassName" value="com.mysql.cj.jdbc.Driver"/>
            <beans:property name="maxActive" value="10"/>
            <beans:property name="minIdle" value="5"/>
        </beans:bean>
    
    	
        <beans:bean class="cn.hqlearn.service.UserDetailsServiceImpl" id="userDetailsServiceImpl"/>
    
    
    </beans:beans>

#### 2.2 springsecurity入门学习 ####

##### 2.2.1 案例介绍 #####

###### 2.2.1.1 创建UserController ######

package cn.hqlearn.controller;
    
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.RequestMapping;
    
    @Controller
    @RequestMapping(value = "/admin/user")
    public class UserController {
        
        @RequestMapping(value = "/list")
        public String list(){
        
            return "user_list";
        }
    }

###### 2.2.1.2 在/WEB-INF/view添加user\_list.jsp ######

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
    <html>
    <head>
        <title>欢迎来到SpringSecurity的世界</title>
    </head>
    <body>
    <table>
        <h2>欢迎来到SpringSecurity的世界!</h2><br>
        <tr>
            <td>用户ID</td>
            <td>姓名</td>
            <td>年龄</td>
        </tr>
        <tr>
            <td>1</td>
            <td>张三</td>
            <td>12</td>
        </tr>
        <tr>
            <td>2</td>
            <td>李四</td>
            <td>21</td>
        </tr>
        <tr>
            <td>3</td>
            <td>王五</td>
            <td>22</td>
        </tr>
        <tr>
            <td>4</td>
            <td>王麻子</td>
            <td>34</td>
        </tr>
    </table>
    <div>
        <a href="/logout">退出</a>
    </div>
    </body>
    </html>

###### 2.2.1.3 实现对/admin进行拦截校验 ######

在spring-security.xml配置文件中

###### 2.2.1.4 添加授权用户数据库表 ######

use springsecuritydb;
    CREATE TABLE users(
      username VARCHAR(50) NOT NULL,
      password VARCHAR(50) NOT NULL,
      enable VARCHAR(50) not null,
      PRIMARY KEY (username)
    )ENGINE=INNODB DEFAULT CHARSET = utf8;
    
    INSERT into users(username,PASSWORD ,enable)VALUES('zzhua','123456','true');
    
    CREATE table authorities(
      username VARCHAR(50) NOT NULL,
      authority VARCHAR(50) NOT NULL,
      PRIMARY KEY (username)
    )ENGINE=INNODB DEFAULT CHARSET = utf8;
    
    INSERT into authorities(username,authority)VALUES('zzhua','ROLE_ADMIN');

##### 2.2.2 springsecurity常用配置 #####

###### 2.2.2.1 取消安全校验 ######

在spring-security.xml配置文件中

###### 2.2.2.2 自定义登录页面和 登录错误信息处理 ######

自定义登录jsp界面

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
    <html>
    <head>
        <title>登录</title>
    </head>
    <body>
    <h2>欢迎登录</h2>
    <form name="f" action="/login" method="post">
        <table>
            <tr>
                <td>用户名：</td>
                <td><input name="username1" type="text" value=""></td>
            </tr>
            <tr>
                <td>密码：</td>
                <td><input name="password1" type="password"></td>
            </tr>
            <tr>
                <td colspan="2"><input name="submit" type="submit" value="LOGIN"></td>
            </tr>
            <tr>
                <td colspan="2">${msg}</td>
            </tr>
        </table>
    </form>
    </body>
    </html>

在spring-security.xml配置文件中

自定义LoginController

package cn.hqlearn.controller;
    
    import org.springframework.stereotype.Controller;
    import org.springframework.ui.Model;
    import org.springframework.web.bind.annotation.RequestMapping;
    
    @Controller
    public class LoginController {
        
    
        /**
         * /login.shtml
         * 跳转到登录界面
         *
         * @return
         */
        @RequestMapping(value = "/login")
        public String login() {
        
            return "login";
        }
    
        @RequestMapping(value = "/login/fail")
        public String loginfail(Model model) {
        
            model.addAttribute("msg", "账号或密码不正确");
            return "login";
        }
    }

###### 2.2.2.3 加密密码匹配 ######

在spring-security.xml配置文件中

<authentication-manager>
            <authentication-provider user-service-ref="userDetailsServiceImpl">
                
                <password-encoder ref="encoder"/>
            </authentication-provider>
        </authentication-manager>
    
        
        <beans:bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
            <beans:constructor-arg name="strength" value="9"/>
        </beans:bean>

###### 2.2.2.4 登出 ######

在spring-security.xml配置文件中

###### 2.2.2.5 自定义用户校验 ######

实现org.springframework.security.core.userdetails.UserDetailsService接口 重写loadUserByUsername()

package cn.hqlearn.service;
    
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.authority.SimpleGrantedAuthority;
    import org.springframework.security.core.userdetails.User;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    
    import java.util.ArrayList;
    import java.util.List;
    
    /**
     * @author zzh
     */
    public class UserDetailsServiceImpl implements UserDetailsService {
        
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        
    
            String password = "$2a$10$xK7b5GRqsZuOlrbz2iZ9DOWQORWmgMXEpLHEqimAHgCRWH3wAqDjy";
    
            List<GrantedAuthority> grantedList = new ArrayList<>();
            grantedList.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
            grantedList.add(new SimpleGrantedAuthority("ROLE_USER"));
    
            User user = new User(username, password, grantedList);
            return user;
        }
    }

在spring-security.xml配置文件中引入

<authentication-manager>
            <authentication-provider user-service-ref="userDetailsServiceImpl">
            </authentication-provider>
        </authentication-manager>
        </beans:bean>