授权管理和自定义403页面

Spring EL 权限表达式

表达式	描述
permitAll()	总是返回true，表示允许所有访问（认证不认证都可访问 URL或方法）
denyAll()	总是返回false，表示拒绝所有访问（永远访问不到指定的 URL或方法）
isAnonymous()	当前用户是一个匿名用户（未登录用户）允许访问，返回true
isRememberMe()	当前用户是通过Remember-Me自动登录的允许访问，返回true
isAuthenticated()	当前用户是已经登录认证成功的允许访问（包含了rememberMe自动登录的），返回true
isFullyAuthenticated()	如果当前用户既不是一个匿名用户，同时也不是通过Remember-Me自动登录的，则允许访问（可以理解为通过页面输入帐户信息认证的）
hasRole(String role)	当前用户拥有指定角色权限的允许访问，返回true。注意: 指定的角色名(如： ADMIN ) SpringSecurity 底层会在前面拼接 ROLE_ 字符串，所以在UserDetailsService实现类，数据库返回的角色名要有ROLE_ADMIN
hasAnyRole([role1, role2])	多个角色以逗号分隔的字符串。如果当前用户拥有指定角色中的任意一个则允许访问，返回true
hasAuthority(String authority)	当前用户拥有指定权限标识的允许访问，返回true。注意：和 hasRole区别是， hasAuthority 不会在前面拼接 ROLE_ 字符串
hasAnyAuthority([auth1,auth2])	多个权限标识是以逗号分隔的字符串。如果当前用户拥有指定权限标识中的任意一个则允许访问，返回true
hasIpAddress("192.168.1.1/29")	限制指定IP或指定范围内的IP才可以访问

代码案例

 @Component("customUserDetailsService")
public class CustomUserDetailsService implements UserDetailsService {
 
    @Autowired
    PasswordEncoder passwordEncoder;
 
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        if(!"admin".equalsIgnoreCase(username)) {
            throw new UsernameNotFoundException("用户名或密码错误");
        }
        String password = passwordEncoder.encode("admin");
        return new User(username, password, AuthorityUtils.commaSeparatedStringToAuthorityList("ADMIN"));
    }
 
}
 
# security配置类
@Override
protected void configure(HttpSecurity http) throws Exception {
    http.formLogin()
            .loginProcessingUrl("/login")
            .successHandler(customAuthenticationSuccessHandler)
            .failureHandler(customAuthenticationFailureHandler)
            .defaultSuccessUrl("/success").permitAll()
            .and().authorizeRequests()
            .antMatchers("/test1").hasRole("admin")  // 该接口需要role_admin权限
            .antMatchers(HttpMethod.GET, "/role").hasAuthority("sys:role")  // 拥有sys:role权限就可以访问get方式的/role
            .antMatchers(HttpMethod.GET, "/permission").access("hasAuthority('sys:permission') or hasAnyRole('ADMIN')") // 拥有sys:permission或者admin
            .antMatchers("/test").permitAll()  // 不需要认证就能访问
            .anyRequest().authenticated()  // 其他请求需要认证
            .and().csrf().disable();
}

测试test1
自定义403页面

 /resource/static目录下新建403.html
 
# security配置类中添加如下
http.exceptionHandling().accessDeniedPage("/403.html");

 # 新建403.scss
# 在链接1中获取到scss代码，复制到403.scss中
# 用vscode打开，下载插件Live Sass Compiler和Live Server
# 点击vscode右下角的Watch Sass进行转换，转为css
# 将css和js引入到html中
# 将html复制到/resource/static路径下

html模板

 <!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>403</title>
<style>
@import url("https://fonts.googleapis.com/css?family=Share+Tech+Mono|Montserrat:700");
* {
  margin: 0;
  padding: 0;
  border: 0;
  font-size: 100%;
  font: inherit;
  vertical-align: baseline;
  box-sizing: border-box;
  color: inherit;
}
 
body {
  background-image: linear-gradient(120deg, #4f0088 0%, #000000 100%);
  height: 100vh;
}
 
h1 {
  font-size: 45vw;
  text-align: center;
  position: fixed;
  width: 100vw;
  z-index: 1;
  color: rgba(255, 255, 255, 0.1490196078);
  text-shadow: 0 0 50px rgba(0, 0, 0, 0.07);
  top: 50%;
  transform: translateY(-50%);
  font-family: "Montserrat", monospace;
}
 
div {
  background: rgba(0, 0, 0, 0);
  width: 70vw;
  position: relative;
  top: 50%;
  transform: translateY(-50%);
  margin: 0 auto;
  padding: 30px 30px 10px;
  box-shadow: 0 0 150px -20px rgba(0, 0, 0, 0.5);
  z-index: 3;
}
 
P {
  font-family: "Share Tech Mono", monospace;
  color: #f5f5f5;
  margin: 0 0 20px;
  font-size: 17px;
  line-height: 1.2;
}
 
span {
  color: #f0c674;
}
 
i {
  color: #8abeb7;
}
 
div a {
  text-decoration: none;
}
 
b {
  color: #81a2be;
}
 
a.avatar {
  position: fixed;
  bottom: 15px;
  right: -100px;
  -webkit-animation: slide 0.5s 4.5s forwards;
          animation: slide 0.5s 4.5s forwards;
  display: block;
  z-index: 4;
}
 
a.avatar img {
  border-radius: 100%;
  width: 44px;
  border: 2px solid white;
}
 
@-webkit-keyframes slide {
  from {
    right: -100px;
    transform: rotate(360deg);
    opacity: 0;
  }
  to {
    right: 15px;
    transform: rotate(0deg);
    opacity: 1;
  }
}
 
@keyframes slide {
  from {
    right: -100px;
    transform: rotate(360deg);
    opacity: 0;
  }
  to {
    right: 15px;
    transform: rotate(0deg);
    opacity: 1;
  }
}
</style>
</head>
<body>
<h1>403</h1>
<div><p>> <span>ERROR CODE</span>: "<i>HTTP 403 Forbidden</i>"</p>
    <p>> <span>ERROR DESCRIPTION</span>: "<i>Access Denied. You Do Not Have The Permission To Access This Page On This Server</i>"</p>
    <p>> <span>ERROR POSSIBLY CAUSED BY</span>: [<b>execute access forbidden, read access forbidden, write access forbidden, ssl required, ssl 128 required, ip address rejected, client certificate required, site access denied, too many users, invalid configuration, password change, mapper denied access, client certificate revoked, directory listing denied, client access licenses exceeded, client certificate is untrusted or invalid, client certificate has expired or is not yet valid, passport logon failed, source access denied, infinite depth is denied, too many requests from the same client ip</b>...]</p>
    <p>> <span>SOME PAGES ON THIS SERVER THAT YOU DO HAVE PERMISSION TO ACCESS</span>: [<a href="/">Home Page</a>, <a href="/">About Us</a>, <a href="/">Contact Us</a>, <a href="/">Blog</a>...]</p><p>> <span>HAVE A NICE DAY SIR AXLEROD :-)</span></p>
</div>
 
<script>
var str = document.getElementsByTagName('div')[0].innerHTML.toString();
var i = 0;
document.getElementsByTagName('div')[0].innerHTML = "";
 
setTimeout(function() {
    var se = setInterval(function() {
        i++;
        document.getElementsByTagName('div')[0].innerHTML = str.slice(0, i) + "|";
        if (i == str.length) {
            clearInterval(se);
            document.getElementsByTagName('div')[0].innerHTML = str;
        }
    }, 10);
},0);
</script>
</body>
</html>

posted @ 2022-06-27 15:48 DogLeftover 阅读(67) 评论(0) 编辑收藏举报

刷新页面返回顶部

登录后才能查看或发表评论，立即登录或者逛逛博客园首页

相关博文：

· 动态数据认证与认证处理

· security学习案例总结

· Spring Boot 整合

· Spring Security 动态url权限控制

· Spring Security 4 权限和角色控制

阅读排行：
· 全程不用写代码，我用AI程序员写了一个飞机大战
· MongoDB 8.0这个新功能碉堡了，比商业数据库还牛
· 记一次.NET内存居高不下排查解决与启示
· 白话解读 Dapr 1.15：你的「微服务管家」又秀新绝活了
· DeepSeek 开源周回顾「GitHub 热点速览」

授权管理和自定义403页面

我的标签

合集 (4)

随笔分类 (1350)

阅读排行榜

推荐排行榜

	@Component("customUserDetailsService")
	public class CustomUserDetailsService implements UserDetailsService {

	@Autowired
	PasswordEncoder passwordEncoder;

	@Override
	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
	if(!"admin".equalsIgnoreCase(username)) {
	throw new UsernameNotFoundException("用户名或密码错误");
	}
	String password = passwordEncoder.encode("admin");
	return new User(username, password, AuthorityUtils.commaSeparatedStringToAuthorityList("ADMIN"));
	}

	}

	# security配置类
	@Override
	protected void configure(HttpSecurity http) throws Exception {
	http.formLogin()
	.loginProcessingUrl("/login")
	.successHandler(customAuthenticationSuccessHandler)
	.failureHandler(customAuthenticationFailureHandler)
	.defaultSuccessUrl("/success").permitAll()
	.and().authorizeRequests()
	.antMatchers("/test1").hasRole("admin") // 该接口需要role_admin权限
	.antMatchers(HttpMethod.GET, "/role").hasAuthority("sys:role") // 拥有sys:role权限就可以访问get方式的/role
	.antMatchers(HttpMethod.GET, "/permission").access("hasAuthority('sys:permission') or hasAnyRole('ADMIN')") // 拥有sys:permission或者admin
	.antMatchers("/test").permitAll() // 不需要认证就能访问
	.anyRequest().authenticated() // 其他请求需要认证
	.and().csrf().disable();
	}

	/resource/static目录下新建403.html

	# security配置类中添加如下
	http.exceptionHandling().accessDeniedPage("/403.html");

	# 新建403.scss
	# 在链接1中获取到scss代码，复制到403.scss中
	# 用vscode打开，下载插件Live Sass Compiler和Live Server
	# 点击vscode右下角的Watch Sass进行转换，转为css
	# 将css和js引入到html中
	# 将html复制到/resource/static路径下

	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="UTF-8">
	<title>403</title>
	<style>
	@import url("https://fonts.googleapis.com/css?family=Share+Tech+Mono\|Montserrat:700");
	* {
	margin: 0;
	padding: 0;
	border: 0;
	font-size: 100%;
	font: inherit;
	vertical-align: baseline;
	box-sizing: border-box;
	color: inherit;
	}

	body {
	background-image: linear-gradient(120deg, #4f0088 0%, #000000 100%);
	height: 100vh;
	}

	h1 {
	font-size: 45vw;
	text-align: center;
	position: fixed;
	width: 100vw;
	z-index: 1;
	color: rgba(255, 255, 255, 0.1490196078);
	text-shadow: 0 0 50px rgba(0, 0, 0, 0.07);
	top: 50%;
	transform: translateY(-50%);
	font-family: "Montserrat", monospace;
	}

	div {
	background: rgba(0, 0, 0, 0);
	width: 70vw;
	position: relative;
	top: 50%;
	transform: translateY(-50%);
	margin: 0 auto;
	padding: 30px 30px 10px;
	box-shadow: 0 0 150px -20px rgba(0, 0, 0, 0.5);
	z-index: 3;
	}

	P {
	font-family: "Share Tech Mono", monospace;
	color: #f5f5f5;
	margin: 0 0 20px;
	font-size: 17px;
	line-height: 1.2;
	}

	span {
	color: #f0c674;
	}

	i {
	color: #8abeb7;
	}

	div a {
	text-decoration: none;
	}

	b {
	color: #81a2be;
	}

	a.avatar {
	position: fixed;
	bottom: 15px;
	right: -100px;
	-webkit-animation: slide 0.5s 4.5s forwards;
	animation: slide 0.5s 4.5s forwards;
	display: block;
	z-index: 4;
	}

	a.avatar img {
	border-radius: 100%;
	width: 44px;
	border: 2px solid white;
	}

	@-webkit-keyframes slide {
	from {
	right: -100px;
	transform: rotate(360deg);
	opacity: 0;
	}
	to {
	right: 15px;
	transform: rotate(0deg);
	opacity: 1;
	}
	}

	@keyframes slide {
	from {
	right: -100px;
	transform: rotate(360deg);
	opacity: 0;
	}
	to {
	right: 15px;
	transform: rotate(0deg);
	opacity: 1;
	}
	}
	</style>
	</head>
	<body>
	<h1>403</h1>
	<div><p>> <span>ERROR CODE</span>: "<i>HTTP 403 Forbidden</i>"</p>
	<p>> <span>ERROR DESCRIPTION</span>: "<i>Access Denied. You Do Not Have The Permission To Access This Page On This Server</i>"</p>
	<p>> <span>ERROR POSSIBLY CAUSED BY</span>: [<b>execute access forbidden, read access forbidden, write access forbidden, ssl required, ssl 128 required, ip address rejected, client certificate required, site access denied, too many users, invalid configuration, password change, mapper denied access, client certificate revoked, directory listing denied, client access licenses exceeded, client certificate is untrusted or invalid, client certificate has expired or is not yet valid, passport logon failed, source access denied, infinite depth is denied, too many requests from the same client ip</b>...]</p>
	<p>> <span>SOME PAGES ON THIS SERVER THAT YOU DO HAVE PERMISSION TO ACCESS</span>: [<a href="/">Home Page</a>, <a href="/">About Us</a>, <a href="/">Contact Us</a>, <a href="/">Blog</a>...]</p><p>> <span>HAVE A NICE DAY SIR AXLEROD :-)</span></p>
	</div>

	<script>
	var str = document.getElementsByTagName('div')[0].innerHTML.toString();
	var i = 0;
	document.getElementsByTagName('div')[0].innerHTML = "";

	setTimeout(function() {
	var se = setInterval(function() {
	i++;
	document.getElementsByTagName('div')[0].innerHTML = str.slice(0, i) + "\|";
	if (i == str.length) {
	clearInterval(se);
	document.getElementsByTagName('div')[0].innerHTML = str;
	}
	}, 10);
	},0);
	</script>
	</body>
	</html>