Spring Security 之学习路途

时间 2021-01-04

标签 html 前端 java git github web spring 数据库 json app 栏目 Spring 繁體版

原文原文链接

Spring Security 学习之旅开端

SpringSecurity 开始

项目：Githubhtml

1. 引入依赖

<parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.4.1</version>
        <relativePath/> 
   </parent>
  <dependency>
          <groupId>org.springframework.boot</groupId>
          <artifactId>spring-boot-starter-security</artifactId>
  </dependency>

在manven依赖仓库中：

前端

2. 配置Security

1.在包下建立SecurityCconfig类,重写configure方法，其中WebSecurity web，能够定义忽略路径java

@Override
    public void configure(WebSecurity web) throws Exception {
        //忽略拦截
        web.ignoring().antMatchers("/sayHello","/doLogin");
    }

HttpSecurity http 能够拦截请求,能够定义登陆、登出等等

@Override
    protected void configure(HttpSecurity http) throws Exception {
       http.authorizeRequests()//开启登陆
               //表示访问，ex/index 这个接口，须要具有admin角色
                .antMatchers("/es/**").hasRole("admin")
               //表示剩余的其余接口，登陆以后能访问
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
               //登陆处理接口
                .loginProcessingUrl("/doLogin")
               //定义登陆时，用户名的key，默认为username
                .usernameParameter("username")
               //定义登陆时，用户密码的key，默认为password
                .passwordParameter("password")
               //定义登陆成功的处理器
                .successHandler(new AuthenticationSuccessHandler() {
                    @Override
                    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
                      response.setContentType("application/json;charset=utf-8");
                        response.sendRedirect("/success.html");//重定向到一个页面
                        MyUserDetails detail= (MyUserDetails)authentication.getPrincipal();
                        System.out.println(detail);
                    }
                })
                .failureHandler(new AuthenticationFailureHandler() {
                    @Override
                    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
                        response.setContentType("application/json;charset=utf-8");
                        PrintWriter out = response.getWriter();
                        ResponseBean responseBean = ResponseBean.sendByCode("you have login failure !", 401);
                        String result = new ObjectMapper().writeValueAsString(responseBean);
                        out.write(result);
                        out.flush();
                    }
                })
               //和表单登陆相关的接口通通都直接经过
                .permitAll()
                .and()
                .logout()
                .logoutUrl("/logout")
                .logoutSuccessHandler(new LogoutSuccessHandler() {
                    @Override
                    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
                        response.setContentType("application/json;charset=utf-8");
                        PrintWriter out = response.getWriter();
                        out.write("you have login out success !");
                        out.flush();
                    }
                })
                .permitAll()
                .and()
                .httpBasic()
                .and()
                .csrf().disable();

    }

简单的表单登陆配置，这里的logou是Get请求，若要Post请求，则增长一行
git

logoutRequestMatcher(new AntPathRequestMatcher("/logout","POST"))

and至关于ssm中标签的结束，permitAll表示登陆相关的页面、操做不要拦截。github

定义密码加密

因为security自带盐，用明文加密的都不同，省去了咱们不少时间。web

@Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

引入JPA依赖

<dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-jdbc</artifactId>
 </dependency>
        <!-- jpa -->
  <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
 <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <version>1.16.10</version>
 </dependency>

建立Use类

@Data
@Entity(name = "t_user")
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Integer id;
    private String username;
    private String password;
    private Integer enabled;
    private Integer locked;
}

建立Role类，为MyDetail做准备

@Data
@Entity(name = "t_role")
public class Role {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Integer id;
    private String name;
    private String chineseName;
}

建立MyDetail类，实现UserDetail

@Data
public class MyUserDetails implements UserDetails {

    private User user;

    private List<Role> roles;

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        List<SimpleGrantedAuthority> authorities = new ArrayList<>();
        if (roles != null && roles.size() > 0) {
            for (Role role : roles) {
                authorities.add(new SimpleGrantedAuthority(role.getName()));
            }
        }
        return authorities;
    }

    @Override
    public String getPassword() {
        return user == null ? null : user.getPassword();
    }

    @Override
    public String getUsername() {
        return user == null ? null : user.getUsername();
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        Integer locked = user.getLocked();
        if (locked == 0) {
            return true;
        }
        return false;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        Integer enabled = user.getEnabled();
        if (enabled == 1) {
            return true;
        }
        return false;
    }

    @Override
    public String toString() {
        return "MyUserDetails{" +
                "user=" + user +
                ", roles=" + roles +
                '}';
    }
}

编写注入实体方法

在测试类中，建立对象，jpa会自动去建立表格。作一个示范，因为学习，我先建立的表格，大家能够少走弯路了。好比下面这样:

实体，加注解
spring

@Data
@Entity(name = "t_hill_heavy")
public class HillHeavy {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Integer id;
    private String username;
    private Boolean handsome;
    private String gender;
    private Integer high;
    private boolean rich;

建立Dao
数据库

public interface HillHeavyDao extends JpaRepository<HillHeavy,Integer> {
    /**
     * 查询
     * @param username 用户名
     * @author 山沉
     * @date 2020/12/28 22:42
     * @return {@link HillHeavy}
     */
    HillHeavy findHillHeavyByUsername(String username);
}

在测试类中：
json

@SpringBootTest
class EsSearchApplicationTests {
    private static final Logger logger = LoggerFactory.getLogger(EsSearchApplicationTests.class);

    @Resource
    private HillHeavyDao hillHeavyDao;

    @Test
    void contextLoads() {
        HillHeavy hillHeavy = new HillHeavy();
        hillHeavy.setUsername("山沉");
        hillHeavy.setHandsome(true);
        hillHeavy.setHigh(180);
        hillHeavy.setGender("男");
        hillHeavy.setRich(true);
        hillHeavyDao.save(hillHeavy);
        logger.info("实体----->{}",hillHeavy);
    }

}

这样在用dao层去注入实体，在数据库中，也会生成表格，数据。以下：
app

是有点自恋，啊。原谅想帅的小胖子。

有了表结构，在UserServiceImpl类，去实现UserDetailService类，重写loadUserByUserName(String username)

在此方法中，从数据库中根据username，查询出用户，角色，返回UserDetail对象。

@Override
 public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
     User user = userMapper.selectUser(username);
     MyUserDetails details = new MyUserDetails();
     if(user == null){
         throw new BadCredentialsException("this username or password is not true!");
     }
     details.setUser(user);
     Integer id = user.getId();
     List<Role> roles = userMapper.selectRole(id);
     details.setRoles(roles);
     return details;
 }

3. 测试登陆

到此，咱们的表单登陆，就成功了。经过doLogin登陆，携带user信息，进入UsernamePasswordAuthenticationFilter 中，注入用户信息。在从表中得到用户信息与之对比，而后经过登陆成功或失败返回给前端JSON格式。

在这里说下，successHandler 是比较强大的，在里面能够做重定向，也能够获取用户信息，等等。集成 defaultSuccessUrl() successForwardUrl() 。

defaultSuccessUrl 能够指定登陆成功的跳转页面，好比输入 welcome/say,来到login.html 页面。登陆成功后，会来的welcome/say。
sccessForwardUrl 指定登陆成功后，到那里。无论登陆前你操做的哪个接口，成功后一概到指定的路径。

测试登陆