学习spring security(一 ) demo

时间 2019-11-09

原文原文链接

1.跟着spring官方给的guide作个demo,来学习spring security.html

首先引入依赖：java

dependencies {
    compile('org.springframework.boot:spring-boot-starter-web')
    compile('org.springframework.boot:spring-boot-starter-thymeleaf')
    compile('org.springframework.cloud:spring-cloud-starter-security')
    testCompile group: 'junit', name: 'junit', version: '4.12'
}

2.配置springmvc web

package com.test.security;

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class MvcConfig implements WebMvcConfigurer {


    public void addViewControllers(ViewControllerRegistry registry) {

        registry.addViewController("/home").setViewName("home");
        registry.addViewController("/").setViewName("home");
        registry.addViewController("/hello").setViewName("hello");
        registry.addViewController("/login").setViewName("login");
    }

}

3.配置spring securityspring

package com.test.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {


    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
                .antMatchers("/", "/home").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                .logout()
                .permitAll();
    }


    @Bean
    @Override
    public UserDetailsService userDetailsService() {
        UserDetails user =
                User.withDefaultPasswordEncoder()
                        .username("user")
                        .password("password")
                        .roles("USER")
                        .build();

        return new InMemoryUserDetailsManager(user);
    }
}

以上配置作了以下工做安全

除了“/”,”/home”(首页),”/login”(登陆),”/logout”(注销),以外，其余路径都须要认证,以上4个path是容许全部人全部角色访问。
指定“/login”该路径为登陆页面，当未认证的用户尝试访问任何受保护的资源时，都会跳转到“/login”,好比若是用户访问下面的hello页面时，也会跳转到/login.
默认指定“/logout”为注销页面
配置一个内存中的用户认证器，使用user/password做为用户名和密码，具备USER角色

4.项目的启动点mvc

package com.test.security;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class application {


    public static void main(String[] args) {
        SpringApplication.run(application.class, args);

    }
}

5.接下来是要访问的页面，其中home.html,login.html是不受安全控制的页面；app

而hello.html页面是受安全控制的。ide

home.html 主要是欢迎页面，并有个跳转连接到hello页面，可是hello页面须要安全验证spring-boot

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
<head>
    <title>Spring Security Example</title>
</head>
<body>
<h1>Welcome!</h1>
<p>Click <a th:href="@{/hello}">here</a> to see a greeting.</p>
</body>
</html>

hello.htmlpost

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
<head>
    <title>Hello World!</title>
</head>
<body>
<h1 th:inline="text">Hello [[${#httpServletRequest.remoteUser}]]!</h1>
<form th:action="@{/logout}" method="post">
    <input type="submit" value="Sign Out"/>
</form>
</body>
</html>

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
<head>
    <title>Spring Security Example </title>
</head>
<body>
<div th:if="${param.error}">
    Invalid username and password.
</div>
<div th:if="${param.logout}">
    You have been logged out.
</div>
<form th:action="@{/login}" method="post">
    <div><label> User Name : <input type="text" name="username"/> </label></div>
    <div><label> Password: <input type="password" name="password"/> </label></div>
    <div><input type="submit" value="Sign In"/></div>
</form>
</body>
</html>

运行后运行结果以下：

登陆http://localhost:8080/ 跳转到home页面

而后点击here要去往hello页面，点击here后跳转到如下要输入用户名和密码的页面，由于要访问hello页面是须要权限的。

此时输入一个错误的用户名和密码，

点击登陆，会爆出错误的信息以下：

若是输入正确的，用户名和密码，以上在SecurityConfiguration类中设置的user password，会出现如下页面：

而后点击sign out