SpringSecurity 笔记

依赖

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>

配置

com/binx/security/config/ApplicationConfig.java

查看代码

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableGlobalMethodSecurity(securedEnabled = true,prePostEnabled = true)
public class ApplicationConfig {
    @Bean
    PasswordEncoder passwordEncoder() {
        return PasswordEncoderFactories.createDelegatingPasswordEncoder();
    }
}

com/binx/security/config/SecurityConfig.java

查看代码

package com.binx.security.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl;
import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;

import javax.sql.DataSource;

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Autowired
    private DataSource dataSource;

    @Bean
    public PersistentTokenRepository persistentTokenRepository(){
        JdbcTokenRepositoryImpl jdbcTokenRepository = new JdbcTokenRepositoryImpl();
        jdbcTokenRepository.setDataSource(dataSource);
        return jdbcTokenRepository;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.logout().logoutUrl("/logout").logoutSuccessUrl("/site/hello").permitAll();
        http.exceptionHandling().accessDeniedPage("/403.html");
        http.formLogin().loginPage("/login.html")// 登录页面
                .loginProcessingUrl("/login.do")//登录请求页面
                .defaultSuccessUrl("/site/index").permitAll()//登录后跳转页面
                .and().authorizeRequests()//权限控制
                .antMatchers("/","/site/hello","/user/pre").permitAll()//不需要登录的页面
//                .antMatchers("/site/auth").hasAuthority("admin")//拥有对应的角色才可以访问
//                .antMatchers("site/auth").hasAnyAuthority("admin","user")
//                .antMatchers("/site/auth").hasRole("admin")
                .anyRequest().authenticated()//其他页面登录后即可访问
                .and().rememberMe().tokenRepository(persistentTokenRepository())
                .tokenValiditySeconds(60)
                .userDetailsService(userDetailsService)
                .and().csrf().disable();//关闭csrf
    }
}

Controller

com/binx/security/controller/SiteController.java

查看代码

package com.binx.security.controller;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.annotation.Secured;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("site")
public class SiteController {

    @Autowired
    private PasswordEncoder passwordEncoder;

    @GetMapping("index")
    public String index(){
        return passwordEncoder.encode("123456");
    }

    @GetMapping("hello")
    public String hello(){
        return "hello";
    }

    @GetMapping("auth")
//    @Secured("ROLE_admin")
    @PreAuthorize("hasAuthority('admin')")
    public String auth(){
        return "auth";
    }


}

 

com/binx/security/controller/UserController.java

查看代码

package com.binx.security.controller;

import com.binx.security.entity.User;
import org.springframework.security.access.prepost.PostFilter;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.access.prepost.PreFilter;
import org.springframework.web.bind.annotation.*;

import java.util.ArrayList;
import java.util.List;

@RestController
@RequestMapping("user")
public class UserController {

    @GetMapping("list")
    @PostFilter("filterObject.username=='XuBin'")
    public List<User> getAll() {
        ArrayList<User> list = new ArrayList<>();
        list.add(new User(1L, "XuBin", "666666"));
        list.add(new User(2L, "Sxy", "123456"));
        System.out.println(list);
        return list;//返回结果经过过滤
    }

    @PostMapping("pre")
    @PreFilter("filterObject.id%2==0")
    public List<User> getTestPreFilter(@RequestBody List<User> list) {
        System.out.println(list);//方法内的参数已经经过了过滤
        return list;
    }
}

 

实体类

查看代码

package com.binx.security.controller;

import com.binx.security.entity.User;
import org.springframework.security.access.prepost.PostFilter;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.access.prepost.PreFilter;
import org.springframework.web.bind.annotation.*;

import java.util.ArrayList;
import java.util.List;

@RestController
@RequestMapping("user")
public class UserController {

    @GetMapping("list")
    @PostFilter("filterObject.username=='Jack'")
    public List<User> getAll() {
        ArrayList<User> list = new ArrayList<>();
        list.add(new User(1L, "Jack", "666666"));
        list.add(new User(2L, "Rose", "123456"));
        System.out.println(list);
        return list;//返回结果经过过滤
    }

    @PostMapping("pre")
    @PreFilter("filterObject.id%2==0")
    public List<User> getTestPreFilter(@RequestBody List<User> list) {
        System.out.println(list);//方法内的参数已经经过了过滤
        return list;
    }
}

 

UserDetailsService

com/binx/security/service/SystemUserService.java

查看代码

package com.binx.security.service;

import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.binx.security.mapper.UserMapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
import com.binx.security.entity.User;

@Service
public class SystemUserService implements org.springframework.security.core.userdetails.UserDetailsService {

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Autowired
    private UserMapper userMapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        QueryWrapper<User> wrapper=new QueryWrapper<>();
        wrapper.eq("username",username);
        User user = userMapper.selectOne(wrapper);
        if(user == null){
            throw new UsernameNotFoundException("用户不存在");
        }
        return new org.springframework.security.core.userdetails.User(user.getUsername(),user.getPassword(),
                AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_admin,admin"));
    }


}