pom.xml添加依赖html
<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-thymeleaf</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency>
建立SpringSecurity配置类java
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; @Configuration @EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .antMatchers("/", "/home").permitAll() .anyRequest().authenticated() .and() .formLogin() .loginPage("/login") .permitAll() .and() .logout() .permitAll(); } @Autowired public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { //inMemoryAuthentication 从内存中获取 auth .inMemoryAuthentication() .passwordEncoder(new BCryptPasswordEncoder()) .withUser("admin") .password(new BCryptPasswordEncoder() .encode("123456")).roles("USER"); } }
经过@EnableWebSecurity注解开启Spring Security的功能
继承WebSecurityConfigurerAdapter,并重写它的方法来设置一些web安全的细节
configure(HttpSecurity http)方法,经过authorizeRequests()定义哪些URL须要被保护、哪些不须要被保护。例如以上代码指定了/和/home不须要任何认证就能够访问,其余的路径都必须经过身份验证。
经过formLogin()定义当须要用户登陆时候,转到的登陆页面。
configureGlobal(AuthenticationManagerBuilder auth)方法,在内存中建立了一个用户,该用户的名称为admin,密码为123456,用户角色为USER。web
控制器:spring
@Controller public class HelloController { @RequestMapping("/") public String index() { return "index"; } @RequestMapping("/hello") public String hello() { return "hello"; } @RequestMapping(value = "/login", method = RequestMethod.GET) public String login() { return "login"; } }
index.html安全
<!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3"> <head> <title>Spring Security入门</title> </head> <body> <h1>欢迎使用Spring Security!</h1> <p>点击 <a th:href="@{/hello}">这里</a> 打个招呼吧</p> </body> </html>
hello.htmlapp
<!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3"> <head> <title>Hello World!</title> </head> <body> <h1 th:inline="text">Hello [[${#httpServletRequest.remoteUser}]]!</h1> <form th:action="@{/logout}" method="post"> <input type="submit" value="注销"/> </form> </body> </html>
login.html框架
<!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3"> <head> <title>Spring Security Example </title> </head> <body> <div th:if="${param.error}"> 用户名或密码错 </div> <div th:if="${param.logout}"> 您已注销成功 </div> <form th:action="@{/login}" method="post"> <div><label> 用户名 : <input type="text" name="username"/> </label></div> <div><label> 密 码 : <input type="password" name="password"/> </label></div> <div><input type="submit" value="登陆"/></div> </form> </body> </html>
运行:ide
打开index.html,点击这里,若是没有登陆进入登陆页,已登陆跳转到hello.htmlspring-boot
转载于:这篇文章web安全