Spring Security

狂神说 Spring Security

SecurityConfig.java

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    //链式编程
    //权限
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //首页所有人可以访问，功能页只有对应有权限的人才可以访问
        //请求授权的规则~
        http.authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/level1/**").hasRole("vip1")
                .antMatchers("/level2/**").hasRole("vip2")
                .antMatchers("/level3/**").hasRole("vip3");
        //没有权限默认会到登录页面，需要开启登录的页面   login
        http.formLogin()
        //自定义登录页(有问题)
        //.loginPage("/toLogin")
        //自定义登录提交请求
        .loginProcessingUrl("/toLogin");
        //自定义用户名 映射 name
        //.usernameParameter("username")
        //自定义密码 映射 name
        //.passwordParameter("password");

        //防止网站攻击：get post
        http.cors().disable();//关闭csrf功能

        //注销，
        http.logout()
        //注销成功跳到首页
        .logoutSuccessUrl("/");

        //记住我功能
        http.rememberMe();//P37
        //自定义参数
        //.rememberMeParameter("remember-me");
    }
    //认证 ， springboot 2.1.x 可以直接使用~
    //密码编码：PasswordEncoder
    //在Spring Security 5.0+新增了很多的加密方法~
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //这些数据正常应该从数据库中读
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                .withUser("kuangshen").password(new BCryptPasswordEncoder().encode("123456")).roles("vip2","vip3")
                .and()
                .withUser("root").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2","vip3")
                .and()
                .withUser("guest").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1");
        ;
    }

RouterController.java

@Controller
public class RouterController {
    @RequestMapping({"/","/index"})
    public String index(){
        return "index";
    }
    @RequestMapping("/toLogin")
    public String toLogin(){
        return "views/login";
    }
    @RequestMapping("/level1/{id}")
    public String leve1 (@PathVariable("id") int id){
        return "views/level1/"+id;
    }
    @RequestMapping("/level2/{id}")
    public String leve2 (@PathVariable("id") int id){
        return "views/level2/"+id;
    }
    @RequestMapping("/level3/{id}")
    public String leve3 (@PathVariable("id") int id){
        return "views/level3/"+id;
    }
}

index.html

<!--需要添加sec-->
<html lang="en" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">


<!--未登录-->
<div sec:authorize="!isAuthenticated()">
	<a class="item" th:href="@{/toLogin}">
		<i class="address card icon"></i> 登录
	</a>
</div>
<!--已登录-->
<div sec:authorize="isAuthenticated()">
	<a class="item">
		用户名:<span sec:authentication="name"></span>
		角色:<span sec:authentication="principal.authorities"></span>
	</a>
</div>
<!--已登录-->
<div sec:authorize="isAuthenticated()">
	<a class="item" th:href="@{/logout}">
		<i class="sign-out icon"></i> 注销
	</a>
</div>

<div class="column" sec:authorize="hasRole('vip1')"><!--拥有VIP1权限的-->
<div class="column" sec:authorize="hasRole('vip2')"><!--拥有VIP2权限的-->
<div class="column" sec:authorize="hasRole('vip3')"><!--拥有VIP3权限的-->

<form th:action="@{/toLogin}" method="post">
	<div class="field">
		<label>Username</label>
		<div class="ui left icon input">
			<input type="text" placeholder="Username" name="username">
			<i class="user icon"></i>
		</div>
	</div>
	<div class="field">
		<label>Password</label>
		<div class="ui left icon input">
			<input type="password" name="password">
			<i class="lock icon"></i>
		</div>
	</div>
	<div class="field">
		记住我<input type="checkbox" name="remember-me"/>
	</div>
	<input type="submit" class="ui blue submit button"/>
</form>