spring Security安全框架简单使用1.1--用户角色不可变简单配置

添加pom.xml依赖

<dependency>
	<groupId>org.springframework.security</groupId>
	<artifactId>spring-security-web</artifactId>		
</dependency>
<dependency>
	<groupId>org.springframework.security</groupId>
	<artifactId>spring-security-config</artifactId>		
</dependency>

修改web.xml

 <context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>classpath:spring/spring-security.xml</param-value>
	 </context-param>
	 <listener>
		<listener-class>
			org.springframework.web.context.ContextLoaderListener
		</listener-class>
	 </listener>	
	 <filter>  
		<filter-name>springSecurityFilterChain</filter-name>  		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>  
	 </filter>  
	 <filter-mapping>  
		<filter-name>springSecurityFilterChain</filter-name>  
		<url-pattern>/*</url-pattern>  
	 </filter-mapping>	

修改spring Security配置文件 spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
    					http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
    					http://www.springframework.org/schema/context
    					http://www.springframework.org/schema/context/spring-context-3.1.xsd
                		http://www.springframework.org/schema/tx
                		http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
                		http://www.springframework.org/schema/security
                		http://www.springframework.org/schema/security/spring-security.xsd">
                		
	    		<!-- 以下页面不被拦截 -->
					<http pattern="/login.html" security="none"></http>
					<http pattern="/css/**" security="none"></http>
					<http pattern="/img/**" security="none"></http>
					<http pattern="/js/**" security="none"></http>
					<http pattern="/plugins/**" security="none"></http>


           <!-- 页面拦截规则 -->
<http use-expressions="false">
	<intercept-url pattern="/*" access="ROLE_ADMIN" />
	<form-login login-page="/login.html"  default-target-url="/admin/index.html" authentication-failure-url="/login.html" always-use-default-target="true"/>	
	<csrf disabled="true"/>
	<headers>
		<frame-options policy="SAMEORIGIN"/>
	</headers>
</http>


            <!-- 认证管理器 -->
            <authentication-manager>
                <authentication-provider>
                    <user-service>
                        <user name="admin" password="123456" authorities="ROLE_USER"/>
                    </user-service>
                </authentication-provider>
            </authentication-manager>
</beans:beans>



	 
security="none"  设置此资源不被拦截. 
如果你没有设置登录页security="none"  ，将会出现以下错误 
 
因为登录页会被反复重定向。
login-page：指定登录页面。
authentication-failure-url：指定了身份验证失败时跳转到的页面。
default-target-url：指定了成功进行身份验证和授权后默认呈现给用户的页面。
csrf disabled="true"  关闭csrf ,如果不加会出现错误
 
CSRF（Cross-site request forgery）跨站请求伪造，也被称为“One Click Attack”或者Session Riding，通常缩写为CSRF或者XSRF，是一种对网站的恶意利用。

//配置内置框架页策略
<headers>
			<frame-options policy="SAMEORIGIN"/>
</headers>

always-use-default-target：指定了是否在身份验证通过后总是跳转到default-target-url属性指定的URL。

修改登录页面
其中表单id必须为“loginform”,可以改动，但没必要
必须设置的内容： action="/login" method=“post”
action地址为默认地址
name=“username”
name=“password”
οnclick="document:loginform.submit()"提交表单方法可自定义，此处为超链接提交

<form id="loginform" action="/login" method="post"  class="sui-form">
	<div class="input-prepend"><span class="add-on loginname"></span>
		<input id="prependedInput"  name="username" type="text" placeholder="邮箱/用户名/手机号" class="span2 input-xfat">
	</div>
	<div class="input-prepend"><span class="add-on loginpwd"></span>
		<input id="prependedInput"  name="password" type="password" placeholder="请输入密码" class="span2 input-xfat">
	</div>
	<div class="setting">
		<div id="slider">
			<div id="slider_bg"></div>
				<span id="label">>></span> <span id="labelTip">拖动滑块验证</span>
			</div>
		</div>
		<div class="logined">
		<a class="sui-btn btn-block btn-xlarge btn-danger" onclick="document:loginform.submit()" target="_blank">登&nbsp;&nbsp;录</a>
		</div>
</form>