SpringSecurity的应用

1.配置文件

修改仙姑吗的pom.xml，添加依赖

<!-- spring-security --> <dependency>     <groupId>org.springframework.security</groupId>     <artifactId>spring-security-web</artifactId> </dependency> <dependency>     <groupId>org.springframework.security</groupId>     <artifactId>spring-security-config</artifactId> </dependency>

修改web.xml 加入以下配置

<!-- 配置Spring加载文件--> <context-param>     <param-name>contextConfigLocation</param-name>     <param-value>classpath:applicationContext*.xml</param-value> </context-param> <!-- 配置Spring的核心监听器 --> <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <!-- 配置SpringSecurity委派过滤器 --> <filter>     <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping>     <filter-name>springSecurityFilterChain</filter-name>     <url-pattern>/*</url-pattern> </filter-mapping>

在项目/src/main/resources/目录下创建applicationContext-security.xm

<?xml version="1.0" encoding="utf-8"?> <beans xmlns="http://www.springframework.org/schema/beans"        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"        xmlns:security="http://www.springframework.org/schema/security"        xmlns:dubbo="http://code.alibabatech.com/schema/dubbo"        xmlns:context="http://www.springframework.org/schema/context"        xsi:schemaLocation="http://www.springframework.org/schema/beans        http://www.springframework.org/schema/beans/spring-beans.xsd        http://www.springframework.org/schema/security        http://www.springframework.org/schema/security/spring-security.xsd        http://code.alibabatech.com/schema/dubbo        http://code.alibabatech.com/schema/dubbo/dubbo.xsd        http://www.springframework.org/schema/context        http://www.springframework.org/schema/context/spring-context.xsd">     <!--########## 配置请求URL拦截规则 ##########-->     <!-- 配置哪些请求URL不被拦截 -->     <security:http pattern="/*.html" security="none"/>     <security:http pattern="/css/**" security="none"/>     <security:http pattern="/img/**" security="none"/>     <security:http pattern="/js/**" security="none"/>     <security:http pattern="/plugins/**" security="none"/>     <security:http pattern="/seller/save" security="none"/>     <!-- 配置哪些请求URL需要拦截 -->     <security:http use-expressions="false">         <!-- 配置剩余的请求地址都需要ROLE_SELLER角色或权限才可以访问 -->         <security:intercept-url pattern="/**" access="ROLE_SELLER"/>         <!-- 配置开启表单登录 -->         <security:form-login login-page="/shoplogin.html"                 default-target-url="/admin/index.html" always-use-default-target="true"                 authentication-failure-url="/shoplogin.html"/>         <!-- 配置跨站请求伪造不可用-->         <security:csrf disabled="true"/>         <!-- 配置头部分，指定框架页策略(iframe子窗口也可以访问)-->         <security:headers>             <security:frame-options policy="SAMEORIGIN"/>         </security:headers>         <!-- 配置退出登录 -->         <security:logout logout-url="/logout"/>     </security:http>     <!-- 配置认证管理器 -->     <security:authentication-manager>         <!-- 配置认证提供者 -->         <security:authentication-provider                 user-service-ref="userDetailsService"/>     </security:authentication-manager>     <!-- ############## 配置dubbo服务消费者 ############## -->     <!-- 配置当前应用的名称 -->     <dubbo:application name="pinyougou-shop-web"/>     <!-- 配置zookeeper作为注册中心，发现服务地址 -->     <dubbo:registry address="zookeeper://192.168.12.131:2181"/>     <!-- 配置引用单个服务，产生服务接口代理对象 -->     <dubbo:reference id="sellerService" interface="com.pinyougou.sellergoods.service.SellerService"/>     <!-- 配置自定义的认证服务 -->     <bean id="userDetailsService" class="com.pinyougou.shop.service.UserDetailsServiceImpl">         <property name="sellerService" ref="sellerService"/>     </bean> </beans>

创建UserDetailsServiceImpl.java，实现 UserDetailsService 接口

import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import java.util.ArrayList; import java.util.List; /**  * 用户认证服务类  * @author lee.siu.wah  * @version1.0  * <p>File Created at 2018-01-02<p>  */ public class UserDetailsServiceImpl implements UserDetailsService {     @Override     publicUserDetails loadUserByUsername(String username) // username由前端页面传来             throws UsernameNotFoundException {         /** 创建List集合封装角色或权限*/         List<GrantedAuthority> grantedAuths = new ArrayList<>();         /** 添加角色*/         grantedAuths.add(new SimpleGrantedAuthority("ROLE_SELLER"));         /** 返回用户信息对象 */         return new User(username,"123456", grantedAuths);     } }

说明：经过上述配置，用户在输入密码123456时就会通过（用户名随意）