JavaWeb-SpringSecurity实现需求-判断请求是否以html结尾

时间 2019-11-09

标签 javaweb springsecurity 实现需求判断请求是否 html 结尾栏目 Java 繁體版

原文原文链接

　　系列博文html

　　项目已上传至guthub　　传送门java

　　JavaWeb-SpringSecurity初认识　　传送门git

　　JavaWeb-SpringSecurity在数据库中查询登录用户　　传送门github

　　JavaWeb-SpringSecurity自定义登录页面　　传送门web

　　JavaWeb-SpringSecurity实现需求-判断请求是否以html结尾　　传送门spring

　　JavaWeb-SpringSecurity自定义登录配置　　传送门数据库

　　JavaWeb-SpringSecurity图片验证ImageCode　　传送门安全

　　JavaWeb-SpringSecurity记住我功能　　传送门app

　　JavaWeb-SpringSecurity使用短信验证码登录　　传送门ide

　　需求

　　　　请求来了，判断请求是否以html结尾，是以html结尾则重定向到登录页面，不是以html结尾就须要进行身份认证

　　首先咱们在SecurityConfig.java中configure()方法中修改自定义登录页面访问路径为/require，打开SpringSecurity对/require请求的身份认证

protected void configure(HttpSecurity http) throws Exception{
        //表单验证(身份认证)
        http.formLogin()
            //自定义登录页面
            .loginPage("/require")
            //若是URL为loginPage,则用SpringSecurity中自带的过滤器去处理该请求
            .loginProcessingUrl("/loginPage")
            .and()
            //请求受权
            .authorizeRequests()
            //在访问咱们的URL时，咱们是不须要省份认证，能够当即访问
            .antMatchers("/login.html","/require").permitAll()
            //全部请求都被拦截，跳转到(/login请求中)
            .anyRequest()
            //都须要咱们身份认证
            .authenticated()
            //SpringSecurity保护机制
            .and().csrf().disable();
    }

　　在controller层下建立SecurityController.java做为用户发起的请求

    @RequestMapping("/require")
    public String require()
    {
        //判断以前的请求是否以html结尾
        
        //若是是，重定向到登录页面
        
        //若是不是，咱们就让他身份认证
        
        return null;
    }

package com.Gary.GaryRESTful.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;


//Web应用安全适配器
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter{

    //告诉SpringSecurity密码用什么加密的
    @Bean
    public PasswordEncoder passwordEncoder()
    {
        return new BCryptPasswordEncoder();
    }
    
    

    protected void configure(HttpSecurity http) throws Exception{
        //表单验证(身份认证)
        http.formLogin()
            //自定义登录页面
            .loginPage("/require")
            //若是URL为loginPage,则用SpringSecurity中自带的过滤器去处理该请求
            .loginProcessingUrl("/loginPage")
            .and()
            //请求受权
            .authorizeRequests()
            //在访问咱们的URL时，咱们是不须要省份认证，能够当即访问
            .antMatchers("/login.html","/require").permitAll()
            //全部请求都被拦截，跳转到(/login请求中)
            .anyRequest()
            //都须要咱们身份认证
            .authenticated()
            //SpringSecurity保护机制
            .and().csrf().disable();
    }
    
}

SecurityConfig.java

package com.Gary.GaryRESTful.controller;

import org.springframework.web.bind.annotation.RequestMapping;

public class SecurityController {

    @RequestMapping("require")
    public String require()
    {
        //判断以前的请求是否以html结尾
        
        //若是是，重定向到登录页面
        
        //若是不是，咱们就让他身份认证
        
        return null;
    }
    

}

SecurityController.java

　　完成需求编码阶段SecurityController.java

　　//拿到转发跳转到以前的请求
    private RequestCache requestCache = new HttpSessionRequestCache();
    
    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
    
    @RequestMapping("/require")
    //返回的状态码(401)
    @ResponseStatus(code=HttpStatus.UNAUTHORIZED)
    public String require(HttpServletRequest request , HttpServletResponse response) throws IOException
    {
        //拿到了以前的请求
        SavedRequest savedRequest = requestCache.getRequest(request, response);
        if(savedRequest != null)
        {
            //url就是引起跳转以前咱们的请求
            String url = savedRequest.getRedirectUrl();
            //判断以前的请求是否以html结尾
            if(StringUtils.endsWithIgnoreCase(url, ".html"))
            {
                //若是是，重定向到登录页面
                redirectStrategy.sendRedirect(request, response, "/login.html");
            }

        }

        //若是不是，咱们就让他身份认证
        return new String("须要身份认证");
    }

package com.Gary.GaryRESTful.controller;

import java.io.IOException;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.http.HttpStatus;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.RedirectStrategy;
import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
import org.springframework.security.web.savedrequest.RequestCache;
import org.springframework.security.web.savedrequest.SavedRequest;
import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseStatus;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class SecurityController {

    //拿到转发跳转到以前的请求
    private RequestCache requestCache = new HttpSessionRequestCache();
    
    //能够用来作重定向
    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
    
    @RequestMapping("/require")
    //返回的状态码(401)
    @ResponseStatus(code=HttpStatus.UNAUTHORIZED)
    public String require(HttpServletRequest request , HttpServletResponse response) throws IOException
    {
        //拿到了以前的请求
        SavedRequest savedRequest = requestCache.getRequest(request, response);
        if(savedRequest != null)
        {
            //url就是引起跳转以前咱们的请求
            String url = savedRequest.getRedirectUrl();
            //判断以前的请求是否以html结尾
            if(StringUtils.endsWithIgnoreCase(url, ".html"))
            {
                //若是是，重定向到登录页面
                redirectStrategy.sendRedirect(request, response, "/login.html");
            
            }

        }

        //若是不是，咱们就让他身份认证
        return new String("须要身份认证");
    }
    

}

SecurityController.java

　　测试阶段

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>Insert title here</title>
</head>
<body>

<h1>Gary登录页面</h1>
    <form action="/loginPage" method="post">
    
        用户名：
        <input type="text" name="username">
        <br>
        密码：
        <input type="password" name="password">
        <br>
        <input type="submit">
    
    </form>

</body>
</html>

package com.Gary.GaryRESTful.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;


//Web应用安全适配器
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter{

    //告诉SpringSecurity密码用什么加密的
    @Bean
    public PasswordEncoder passwordEncoder()
    {
        return new BCryptPasswordEncoder();
    }
    
    

    protected void configure(HttpSecurity http) throws Exception{
        //表单验证(身份认证)
        http.formLogin()
            //自定义登录页面
            .loginPage("/require")
            //若是URL为loginPage,则用SpringSecurity中自带的过滤器去处理该请求
            .loginProcessingUrl("/loginPage")
            .and()
            //请求受权
            .authorizeRequests()
            //在访问咱们的URL时，咱们是不须要省份认证，能够当即访问
            .antMatchers("/login.html","/require").permitAll()
            //全部请求都被拦截，跳转到(/login请求中)
            .anyRequest()
            //都须要咱们身份认证
            .authenticated()
            //SpringSecurity保护机制
            .and().csrf().disable();
    }
    
}

SecurityConfig.java

package com.Gary.GaryRESTful.controller;

import java.io.IOException;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.http.HttpStatus;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.RedirectStrategy;
import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
import org.springframework.security.web.savedrequest.RequestCache;
import org.springframework.security.web.savedrequest.SavedRequest;
import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseStatus;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class SecurityController {

    //拿到转发跳转到以前的请求
    private RequestCache requestCache = new HttpSessionRequestCache();
    
    //能够用来作重定向
    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
    
    @RequestMapping("/require")
    //返回的状态码(401)
    @ResponseStatus(code=HttpStatus.UNAUTHORIZED)
    public String require(HttpServletRequest request , HttpServletResponse response) throws IOException
    {
        //拿到了以前的请求
        SavedRequest savedRequest = requestCache.getRequest(request, response);
        if(savedRequest != null)
        {
            //url就是引起跳转以前咱们的请求
            String url = savedRequest.getRedirectUrl();
            //判断以前的请求是否以html结尾
            if(StringUtils.endsWithIgnoreCase(url, ".html"))
            {
                //若是是，重定向到登录页面
                redirectStrategy.sendRedirect(request, response, "/login.html");
            
            }

        }

        //若是不是，咱们就让他身份认证
        return new String("须要身份认证");
    }
    

}

SecurityController.java