SpringBoot整合SpringSecurity

已于 2023-01-18 02:21:13 修改
阅读量2.3k 收藏 12
点赞数
分类专栏： security 文章标签： springboot
于 2023-01-18 00:55:49 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/Stu_Shaw/article/details/128722364
版权
一、准备相关工具类
  1. 导入依赖
        <!--security安全启动器-->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <!--JWT（token构建工具）-->
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
        </dependency>
        <!--JWT报错，jdk版本-->
        <dependency>
            <groupId>javax.xml.bind</groupId>
            <artifactId>jaxb-api</artifactId>
            <version>2.3.0</version>
        </dependency>
        <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-impl</artifactId>
            <version>2.3.0</version>
        </dependency>
        <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-core</artifactId>
            <version>2.3.0</version>
        </dependency>
        <dependency>
            <groupId>javax.activation</groupId>
            <artifactId>activation</artifactId>
            <version>1.1.1</version>
        </dependency>
  1. IpUtil工具类
package com.xxz.common.utils;

import org.springframework.http.HttpHeaders;
import org.springframework.http.server.reactive.ServerHttpRequest;

import javax.servlet.http.HttpServletRequest;
import java.net.InetAddress;
import java.net.UnknownHostException;

/**
 * 获取ip地址
 */
public class IpUtil {

    public static String getIpAddress(HttpServletRequest request) {
        String ipAddress = null;
        try {
            ipAddress = request.getHeader("x-forwarded-for");
            if (ipAddress == null || ipAddress.length() == 0 || "unknown".equalsIgnoreCase(ipAddress)) {
                ipAddress = request.getHeader("Proxy-Client-IP");
            }
            if (ipAddress == null || ipAddress.length() == 0 || "unknown".equalsIgnoreCase(ipAddress)) {
                ipAddress = request.getHeader("WL-Proxy-Client-IP");
            }
            if (ipAddress == null || ipAddress.length() == 0 || "unknown".equalsIgnoreCase(ipAddress)) {
                ipAddress = request.getRemoteAddr();
                if (ipAddress.equals("127.0.0.1")) {
                    // 根据网卡取本机配置的IP
                    InetAddress inet = null;
                    try {
                        inet = InetAddress.getLocalHost();
                    } catch (UnknownHostException e) {
                        e.printStackTrace();
                    }
                    ipAddress = inet.getHostAddress();
                }
            }
            // 对于通过多个代理的情况，第一个IP为客户端真实IP,多个IP按照','分割
            if (ipAddress != null && ipAddress.length() > 15) { // "***.***.***.***".length()
                // = 15
                if (ipAddress.indexOf(",") > 0) {
                    ipAddress = ipAddress.substring(0, ipAddress.indexOf(","));
                }
            }
        } catch (Exception e) {
            ipAddress="";
        }
        // ipAddress = this.getRequest().getRemoteAddr();

        return ipAddress;
    }

    public static String getGatwayIpAddress(ServerHttpRequest request) {
        HttpHeaders headers = request.getHeaders();
        String ip = headers.getFirst("x-forwarded-for");
        if (ip != null && ip.length() != 0 && !"unknown".equalsIgnoreCase(ip)) {
            // 多次反向代理后会有多个ip值，第一个ip才是真实ip
            if (ip.indexOf(",") != -1) {
                ip = ip.split(",")[0];
            }
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = headers.getFirst("Proxy-Client-IP");
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = headers.getFirst("WL-Proxy-Client-IP");
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = headers.getFirst("HTTP_CLIENT_IP");
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = headers.getFirst("HTTP_X_FORWARDED_FOR");
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = headers.getFirst("X-Real-IP");
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddress().getAddress().getHostAddress();
        }
        return ip;
    }
}
  1. JwtHelper工具类
package com.xxz.common.utils;

import io.jsonwebtoken.*;
import org.springframework.util.StringUtils;

import java.util.Date;

/**
 * 生成JSON Web令牌的工具类
 */
public class JwtHelper {

    //token过期时间
    private static long tokenExpiration = 365 * 24 * 60 * 60 * 1000;
    //加密秘钥
    private static String tokenSignKey = "1234567890";

    //根据用户id和用户名称生成token字符串
    public static String createToken(String userId, String username) {
        String token = Jwts.builder()
                .setSubject("AUTH-USER") //设置主题
                .setExpiration(new Date(System.currentTimeMillis() + tokenExpiration)) //设置过期时间
                .claim("userId", userId) //有效载荷
                .claim("username", username) //有效载荷
                .signWith(SignatureAlgorithm.HS512, tokenSignKey) //HS512集成自定义密钥方式加密
                .compressWith(CompressionCodecs.GZIP) //字符串压缩处理
                .compact();
        return token;
    }

    //从token字符串获取userid
    public static String getUserId(String token) {
        try {
            if (StringUtils.isEmpty(token)) return null;
            // Jwt解析(parse) ， 通过密钥(tokenSignKey) 进行
            Jws<Claims> claimsJws = Jwts.parser().setSigningKey(tokenSignKey).parseClaimsJws(token);
            Claims claims = claimsJws.getBody(); //获取载荷主体部分
            String userId = (String) claims.get("userId"); //获取有效信息
            return userId;
        } catch (Exception e) {
            e.printStackTrace();
            return null;
        }
    }

    //从token字符串获取username
    public static String getUsername(String token) {
        try {
            if (StringUtils.isEmpty(token)) return "";

            Jws<Claims> claimsJws = Jwts.parser().setSigningKey(tokenSignKey).parseClaimsJws(token);
            Claims claims = claimsJws.getBody();
            return (String) claims.get("username");
        } catch (Exception e) {
            e.printStackTrace();
            return null;
        }
    }

    //无需定义token删除，客户端扔掉即可

    public static void main(String[] args) {
        String token = JwtHelper.createToken("1", "test");
        System.out.println(token);

        String userId = JwtHelper.getUserId(token);
        System.out.println(userId);

        String username = JwtHelper.getUsername(token);
        System.out.println(username);
    }
}
  1. MD5工具类
package com.xxz.common.utils;

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;


public final class MD5 {

    public static String encrypt(String strSrc) {
        try {
            char hexChars[] = { '0', '1', '2', '3', '4', '5', '6', '7', '8',
                    '9', 'a', 'b', 'c', 'd', 'e', 'f' };
            byte[] bytes = strSrc.getBytes();
            MessageDigest md = MessageDigest.getInstance("MD5");
            md.update(bytes);
            bytes = md.digest();
            int j = bytes.length;
            char[] chars = new char[j * 2];
            int k = 0;
            for (int i = 0; i < bytes.length; i++) {
                byte b = bytes[i];
                chars[k++] = hexChars[b >>> 4 & 0xf];
                chars[k++] = hexChars[b & 0xf];
            }
            return new String(chars);
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
            throw new RuntimeException("MD5加密出错！！+" + e);
        }
    }


}
  1. ResponseUtil响应工具类
package com.xxz.common.utils;

import com.xxz.common.result.Result;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;

import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class ResponseUtil {

    public static void out(HttpServletResponse response, Result r) {
        ObjectMapper mapper = new ObjectMapper();
        response.setStatus(HttpStatus.OK.value());
        response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);
        try {
            mapper.writeValue(response.getWriter(), r);
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}
二、认证

在这里插入图片描述

  1. 自定义密码组件 MD5
package com.xxz.system.custom;

import com.xxz.common.utils.MD5;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;

//一、自定义密码处理组件
@Component
public class CustomMD5Password implements PasswordEncoder {

    @Override
    public String encode(CharSequence rawPassword) {
        //进行MD5加密
        return MD5.encrypt(rawPassword.toString());
    }

    @Override
    public boolean matches(CharSequence rawPassword, String encodePassword) {
        //判断是否相等
        return encodePassword.equals(MD5.encrypt(rawPassword.toString()));
    }
}
  1. 自定义用户对象
package com.xxz.system.custom;

import com.xxz.model.system.SysUser;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.User;

import java.util.Collection;

//二、自定义用户类（继承Security里的User类）
public class CustomUser extends User {

    /**
     * 我们自己的用户实体对象，要调取用户信息时直接获取这个实体对象
     */
    private SysUser sysUser;

    public CustomUser(SysUser sysUser, Collection<? extends GrantedAuthority> authorities){
        //调用父类构造器初始化信息
        super(sysUser.getUsername(), sysUser.getPassword(), authorities);
        this.sysUser = sysUser;
    }

    public SysUser getSysUser() {
        return sysUser;
    }

    public void setSysUser(SysUser sysUser) {
        this.sysUser = sysUser;
    }

    @Override
    public String toString() {
        return "CustomUser{" +
                "sysUser=" + sysUser +
                '}';
    }
}
  1. 自定义业务查询方法
package com.xxz.system.service;

import com.xxz.model.system.SysUser;
import com.xxz.system.custom.CustomUser;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Component;

import java.util.Collections;

//三、自定义根据前端数据的用户参数-获取用户数据的业务类及业务查询方法，默认时从内存中获取查询用户信息（需要在Security配置类中配置内存相关存储用户信息）
@Component
public class UserDetailServiceImpl implements UserDetailsService {

    //定义自己的业务类,用于查询数据库信息
    @Autowired
    private SysUserService sysUserService;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //调用业务类查询数据库
        SysUser sysUser = sysUserService.getUserInfoByUserName(username);
        //判断用户是否为空
        if(null == sysUser){
            throw new UsernameNotFoundException("用户不存在");
        }
        //判断用户状态是否可用
        if(sysUser.getStatus().intValue() == 0){
            throw new RuntimeException("用户已禁用...");
        }
        //返回自定义角色对象信息
        return new CustomUser(sysUser, Collections.emptyList());
    }
}
  1. 自定义认证过滤器
package com.xxz.system.filter;

import com.fasterxml.jackson.databind.ObjectMapper;
import com.xxz.common.result.Result;
import com.xxz.common.result.ResultCodeEnum;
import com.xxz.common.utils.JwtHelper;
import com.xxz.common.utils.ResponseUtil;
import com.xxz.model.vo.LoginVo;
import com.xxz.system.custom.CustomUser;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.authentication.event.InteractiveAuthenticationSuccessEvent;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

/**
 * 登入过滤器，继承UserNamePasswordAuthenticationFilter , 对用户名密码进行登录校验
 */

//四、自定义认证过滤器 //继承               UsernamePasswordAuthenticationFilter
public class TokenLoginFilter extends UsernamePasswordAuthenticationFilter {

    //定义构造器用于做当前登录过滤器初始化
    public TokenLoginFilter(AuthenticationManager authenticationManager){
        //设置/初始化  认证管理器
        this.setAuthenticationManager(authenticationManager);
        //取消 只针对post请求
        this.setPostOnly(false);
        //指定登录接口及提交方式，可以指定任意路径
        this.setRequiresAuthenticationRequestMatcher(
                new AntPathRequestMatcher("/admin/system/index/login", "POST"));
    }

    //重写获取用户信息方法
    @Override
    public Authentication attemptAuthentication(
            HttpServletRequest request,
            HttpServletResponse response) throws AuthenticationException {

        try {
            //以流的方式获取前端请求接口封装的用户对象
            LoginVo loginVo = new ObjectMapper().readValue(request.getInputStream(), LoginVo.class);
            //创建UsernamePasswordAuthenticationToken对象，封装用户名和密码，得到认证对象
            Authentication authenticationToken =
                    new UsernamePasswordAuthenticationToken(loginVo.getUsername(), loginVo.getPassword());
            //返回目标认证对象
            Authentication authentication = this.getAuthenticationManager().authenticate(authenticationToken);
            System.out.println("authenticate ===== " + authentication);
            return authentication;
        }catch (IOException e){
            e.printStackTrace();
        }
        return null;
    }

    //重写登录成功调用/执行
    @Override
    protected void successfulAuthentication(HttpServletRequest request,
                                            HttpServletResponse response,
                                            FilterChain chain,
                                            Authentication auth) throws IOException, ServletException {
        //auth : 表示当前认证对象
        //1.获取认证对象
        CustomUser customUser = (CustomUser) auth.getPrincipal();
        System.out.println("===========================================================");
        System.out.println("===========================================================");
        System.out.println("===========================================================");
        System.out.println(" auth.getDetails(); : ==== " +  auth);
        System.out.println("===========================================================");
        System.out.println("===========================================================");
        System.out.println("===========================================================");
        //2.生成token
        String token = JwtHelper.createToken(customUser.getSysUser().getId(), customUser.getSysUser().getUsername());
        //3.返回（通过响应工具）
        Map<String, Object> map = new HashMap<>();
        map.put("token", token);
        ResponseUtil.out(response, Result.ok(map));
    }

    //重写登录失败调用/执行
    @Override
    protected void unsuccessfulAuthentication(HttpServletRequest request,
                                              HttpServletResponse response,
                                              AuthenticationException e) throws IOException, ServletException {
       //判断当前异常是否属于运行时异常
        if(e.getCause() instanceof RuntimeException){
            ResponseUtil.out(response, Result.build(null, 204, e.getMessage()));
        }else{
            ResponseUtil.out(response, Result.build(null, ResultCodeEnum.LOGIN_MOBLE_ERROR));
        }

    }


}
  1. 自定义同一返回结果 Result and ResultCodeEnum
package com.xxz.common.result;

import lombok.Data;

/**
 * 统一放回结果  [五、自定义同一返回结果 Result and ResultCodeEnum]
 * @param <T>
 */
@Data
public class Result<T> {

    //返回码
    private Integer code;

    //返回消息
    private String message;

    //返回数据
    private T data;

    public Result(){}

    // 返回数据
    protected static <T> Result<T> build(T data) {
        Result<T> result = new Result<T>();
        if (data != null)
            result.setData(data);
        return result;
    }

    public static <T> Result<T> build(T body, Integer code, String message) {
        Result<T> result = build(body);
        result.setCode(code);
        result.setMessage(message);
        return result;
    }

    public static <T> Result<T> build(T body, ResultCodeEnum resultCodeEnum) {
        Result<T> result = build(body);
        result.setCode(resultCodeEnum.getCode());
        result.setMessage(resultCodeEnum.getMessage());
        return result;
    }

    public static<T> Result<T> ok(){
        return Result.ok(null);
    }

    /**
     * 操作成功
     * @param data  baseCategory1List
     * @param <T>
     * @return
     */
    public static<T> Result<T> ok(T data){
        Result<T> result = build(data);
        return build(data, ResultCodeEnum.SUCCESS);
    }

    public static<T> Result<T> fail(){
        return Result.fail(null);
    }

    /**
     * 操作失败
     * @param data
     * @param <T>
     * @return
     */
    public static<T> Result<T> fail(T data){
        Result<T> result = build(data);
        return build(data, ResultCodeEnum.FAIL);
    }

    public Result<T> message(String msg){
        this.setMessage(msg);
        return this;
    }

    public Result<T> code(Integer code){
        this.setCode(code);
        return this;
    }
}


package com.xxz.common.result;

import lombok.Getter;

@Getter
public enum ResultCodeEnum {

    SUCCESS(200,"成功"),
    FAIL(201, "失败"),
    SERVICE_ERROR(2012, "服务异常"),
    DATA_ERROR(204, "数据异常"),
    ILLEGAL_REQUEST(205, "非法请求"),
    REPEAT_SUBMIT(206, "重复提交"),
    ARGUMENT_VALID_ERROR(210, "参数校验异常"),

    LOGIN_AUTH(208, "未登陆"),
    PERMISSION(209, "没有权限"),
    ACCOUNT_ERROR(214, "账号不正确"),
    PASSWORD_ERROR(215, "密码不正确"),
    LOGIN_MOBLE_ERROR( 216, "账号不正确"),
    ACCOUNT_STOP( 217, "账号已停用"),
    NODE_ERROR( 218, "该节点下有子节点，不可以删除")
    ;

    private Integer code;

    private String message;

    private ResultCodeEnum(Integer code, String message) {
        this.code = code;
        this.message = message;
    }
}
  1. 自定义认证解析过滤器
package com.xxz.system.filter;

import com.xxz.common.result.Result;
import com.xxz.common.result.ResultCodeEnum;
import com.xxz.common.utils.JwtHelper;
import com.xxz.common.utils.ResponseUtil;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Collections;

//六、自定义认证解析过滤器
public class TokenAuthenticationFilter extends OncePerRequestFilter {

    public TokenAuthenticationFilter(){

    }

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {

        logger.info("uri: " + request.getRequestURI());
        //如果时登录接口，直接放行（每个项目的登录接口不同）
        if("/admin/system/index/login".equals(request.getRequestURI())){
            //放行
            filterChain.doFilter(request, response);
            //停止运行
            return;
        }
        //调用自定义方法，获取用户信息认证对象
        UsernamePasswordAuthenticationToken authentication = getAuthentication(request);
        //如果不为空，则存储到SecurityContextHolder对象中
        if(null != authentication){
            SecurityContextHolder.getContext().setAuthentication(authentication);
            //放行
            filterChain.doFilter(request, response);
        }else{
            //如果为空，则返回结果信息
            ResponseUtil.out(response, Result.build(null, ResultCodeEnum.PERMISSION));
        }

    }

    //定义获取用户信息认证对象，通过token获取
    private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request){

        //token置于header里面
        String token = request.getHeader("token");
        logger.info("token: " + token);
        //token不为空则获取token中的用户信息
        if(!StringUtils.isEmpty(token)){
            String username = JwtHelper.getUsername(token);
            logger.info("username: " + username);
            //如果用户名不为空则返回目标认证对象
            if(!StringUtils.isEmpty(username)){
                return new UsernamePasswordAuthenticationToken(username, null, Collections.emptyList());
            }
        }

        return null;
    }
}
  1. Security核心配置类
package com.xxz.system.config;

import com.xxz.system.custom.CustomMD5Password;
import com.xxz.system.filter.TokenAuthenticationFilter;
import com.xxz.system.filter.TokenLoginFilter;
import com.xxz.system.service.UserDetailServiceImpl;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

/**
 * 六、配置SpirngSecurity配置类（自定义大整合）
 */
@Configuration
@EnableWebSecurity //开启SpringSecurity的默认行为
@Slf4j //日志
public class MySecurityConfig extends WebSecurityConfigurerAdapter {

    //导入自己编写的查询业务类（默认是providerService去内存查找）
    @Autowired
    private UserDetailServiceImpl userDetailsService;

    //导入我们自己编写的加密工具类
    @Autowired
    private CustomMD5Password customMD5Password;

    /**
     *  用户认证管理器
     * @return
     * @throws Exception
     */
    @Bean
    @Override
    protected AuthenticationManager authenticationManager()throws Exception{
        log.info("AuthenticationManager用户认证管理器 + 加入容器.......");
        log.info("当前注入对象UserDetailsService ： ===== " + userDetailsService);
        return super.authenticationManager();
    }

    @Override
    protected void configure(HttpSecurity http)throws Exception{
        //这是配置的关键，决定那些接口开启防护，那些接口绕过防护
        http
                //关闭csrf
                .csrf().disable()
                //开启跨域以便前端调用接口
                .cors()
                .and()
                .authorizeRequests()
                //指定某些接口不需要通过认证即可访问， 登录接口肯定是不需要的
                .antMatchers("/admin/system/index/login").permitAll()
                //这里的意思是其他所有接口需要认证才能访问
                .anyRequest().authenticated()
                .and()
                //TokenAuthenticationFilter放到UsernamePasswordAuthenticationFilter的前面
                .addFilterBefore(new TokenAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
                .addFilter(new TokenLoginFilter(authenticationManager()));

        //禁用session
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception{
        //指定UserDetailService和加密器（使用自定义的）
        log.info("指定UserDetailService和加密器（使用自定义的） + 加入容器.......");
        auth.userDetailsService(userDetailsService).passwordEncoder(customMD5Password);
    }

    /**
     * 配置那些请求不拦截
     * 排除swagger 相关请求
     * @param web
     * @throws Exception
     */
    @Override
    public void configure(WebSecurity web)throws Exception{
        web.ignoring().antMatchers(
                "/favicon.ico",
                "/swagger-resources/**",
                "/webjars/**", "/v2/**",
                "/swagger-ui.html",
                "/doc.html");
    }

}
三、授权

在这里插入图片描述

  1. 修改loadUserByUsername查询用户权限操作数据返回
package com.xxz.system.service;

import com.xxz.model.system.SysMenu;
import com.xxz.model.system.SysUser;
import com.xxz.model.vo.RouterVo;
import com.xxz.system.custom.CustomUser;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Component;

import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;

//三、自定义根据前端数据的用户参数-获取用户数据的业务类及业务查询方法，默认时从内存中获取查询用户信息（需要在Security配置类中配置内存相关存储用户信息）
@Component
public class UserDetailServiceImpl implements UserDetailsService {

    //定义自己的业务类,用于查询数据库信息
    @Autowired
    private SysUserService sysUserService;

    //注入菜单模块业务
    @Autowired
    private SysMenuService sysMenuService;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //调用业务类查询数据库
        SysUser sysUser = sysUserService.getUserInfoByUserName(username);
        //判断用户是否为空
        if(null == sysUser){
            throw new UsernameNotFoundException("用户不存在");
        }
        //判断用户状态是否可用
        if(sysUser.getStatus().intValue() == 0){
            throw new RuntimeException("用户已禁用...");
        }
        //返回自定义角色对象信息
        //[授权 new ：根据用户userid查询操作权限数据（获取当前用户所有->权限操作符）]
        List<String> userPermsList = sysMenuService.findUserButtonListByUserId(sysUser.getId());
        //转换成Security要求的格式数据
        List<SimpleGrantedAuthority> authorities = new ArrayList<>();
        //遍历所有权限操作符
        for (String perm : userPermsList) {
            authorities.add(new SimpleGrantedAuthority(perm.trim()));
        }
        // [old return]
//        return new CustomUser(sysUser, Collections.emptyList());
        //[new return ]
        return new CustomUser(sysUser, authorities);
    }
}
  1. 配置Redis，存储当前用户权限数据SpringSecurity配置（将权限数据封装成SpringSecurity中的Authentication类）
  • [引入redis依赖到我们的security项目中]
        <!--redis依赖-->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-redis</artifactId>
        </dependency>
  • [application.yml配置redis服务配置]
# server
server:
  port: 8800

# mp
mybatis-plus:
  configuration:
    log-impl: org.apache.ibatis.logging.stdout.StdOutImpl #查看日志
  mapper-locations: classpath:mapper/*.xml

# spring
spring:
  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver
    url: jdbc:mysql://localhost:3306/guigu-auth?characterEncoding=utf-8&useSSL=false&zeroDateTimeBehavior=convertToNull
    username: root
    password: root

# 日期格式问题
  jackson:
    date-format: yyyy-MM-dd HH:mm:ss
    time-zone: GMT+8

# redis
  redis:
    host: 127.0.0.1
    port: 6379
    database: 0
    timeout: 1800000
    password:
    jedis:
      pool:
        max-active: 20 #最大连接数
        max-wait: -1 #最大阻塞等待时间（负数表示没有限制）
        max-idle: 5 #最大空闲
        min-idle: 0 #最小空闲
  • [注意：Linux要修改配置文件-支持远程连接]
    在这里插入图片描述
  • [指定配置文件启动]
    在这里插入图片描述
  1. 修改过滤器

3.1认证过滤器

package com.xxz.system.filter;

import com.alibaba.fastjson.JSON;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.xxz.common.result.Result;
import com.xxz.common.result.ResultCodeEnum;
import com.xxz.common.utils.JwtHelper;
import com.xxz.common.utils.ResponseUtil;
import com.xxz.model.vo.LoginVo;
import com.xxz.system.custom.CustomUser;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.authentication.event.InteractiveAuthenticationSuccessEvent;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

/**
 * 登入过滤器，继承UserNamePasswordAuthenticationFilter , 对用户名密码进行登录校验
 */

//四、自定义认证过滤器 //继承               UsernamePasswordAuthenticationFilter
public class TokenLoginFilter extends UsernamePasswordAuthenticationFilter {

    //[new 授权]
    private RedisTemplate redisTemplate;

    //定义构造器用于做当前登录过滤器初始化 [new 授权]
    public TokenLoginFilter(AuthenticationManager authenticationManager, RedisTemplate redisTemplate){
        //设置/初始化  认证管理器
        this.setAuthenticationManager(authenticationManager);
        //取消 只针对post请求
        this.setPostOnly(false);
        //指定登录接口及提交方式，可以指定任意路径
        this.setRequiresAuthenticationRequestMatcher(
                new AntPathRequestMatcher("/admin/system/index/login", "POST"));
        //[new 授权]
        this.redisTemplate = redisTemplate;
    }

    //重写获取用户信息方法
    @Override
    public Authentication attemptAuthentication(
            HttpServletRequest request,
            HttpServletResponse response) throws AuthenticationException {

        try {
            //以流的方式获取前端请求接口封装的用户对象
            LoginVo loginVo = new ObjectMapper().readValue(request.getInputStream(), LoginVo.class);
            //创建UsernamePasswordAuthenticationToken对象，封装用户名和密码，得到认证对象
            Authentication authenticationToken =
                    new UsernamePasswordAuthenticationToken(loginVo.getUsername(), loginVo.getPassword());
            //返回目标认证对象
            Authentication authentication = this.getAuthenticationManager().authenticate(authenticationToken);
            System.out.println("authenticate ===== " + authentication);
            return authentication;
        }catch (IOException e){
            e.printStackTrace();
        }
        return null;
    }

    //重写登录成功调用/执行
    @Override
    protected void successfulAuthentication(HttpServletRequest request,
                                            HttpServletResponse response,
                                            FilterChain chain,
                                            Authentication auth) throws IOException, ServletException {
        //auth : 表示当前认证对象
        //1.获取认证对象
        CustomUser customUser = (CustomUser) auth.getPrincipal();
        System.out.println("===========================================================");
        System.out.println("===========================================================");
        System.out.println("===========================================================");
        System.out.println(" auth.getDetails(); : ==== " +  auth);
        System.out.println("===========================================================");
        System.out.println("===========================================================");
        System.out.println("===========================================================");

        //[new 授权]：认证成功后，将用户数据存储到redis中 (以用户名称作为key，以Json作为存储数据)
        redisTemplate.opsForValue().set(customUser.getUsername(),
                JSON.toJSONString(customUser.getAuthorities()));

        //2.生成token
        String token = JwtHelper.createToken(customUser.getSysUser().getId(), customUser.getSysUser().getUsername());
        //3.返回（通过响应工具）
        Map<String, Object> map = new HashMap<>();
        map.put("token", token);
        ResponseUtil.out(response, Result.ok(map));
    }

    //重写登录失败调用/执行
    @Override
    protected void unsuccessfulAuthentication(HttpServletRequest request,
                                              HttpServletResponse response,
                                              AuthenticationException e) throws IOException, ServletException {
       //判断当前异常是否属于运行时异常
        if(e.getCause() instanceof RuntimeException){
            ResponseUtil.out(response, Result.build(null, 204, e.getMessage()));
        }else{
            ResponseUtil.out(response, Result.build(null, ResultCodeEnum.LOGIN_MOBLE_ERROR));
        }

    }


}

3.2解析过滤器

...
  1. 在项目中配置redis，完成controller相关代码
package com.xxz.system.filter;

import com.alibaba.fastjson.JSON;
import com.xxz.common.result.Result;
import com.xxz.common.result.ResultCodeEnum;
import com.xxz.common.utils.JwtHelper;
import com.xxz.common.utils.ResponseUtil;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import java.util.Map;

//六、自定义认证解析过滤器
public class TokenAuthenticationFilter extends OncePerRequestFilter {

    //[new 授权]：定义redis
    private RedisTemplate redisTemplate;

    //[new 授权]：引入redis/初始化redis对象
    public TokenAuthenticationFilter(RedisTemplate redisTemplate){
        this.redisTemplate = redisTemplate;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {

        logger.info("uri: " + request.getRequestURI());
        //如果时登录接口，直接放行（每个项目的登录接口不同）
        if("/admin/system/index/login".equals(request.getRequestURI())){
            //放行
            filterChain.doFilter(request, response);
            //停止运行
            return;
        }
        //调用自定义方法，获取用户信息认证对象
        UsernamePasswordAuthenticationToken authentication = getAuthentication(request);
        //如果不为空，则存储到SecurityContextHolder对象中
        if(null != authentication){
            SecurityContextHolder.getContext().setAuthentication(authentication);
            //放行
            filterChain.doFilter(request, response);
        }else{
            //如果为空，则返回结果信息
            ResponseUtil.out(response, Result.build(null, ResultCodeEnum.PERMISSION));
        }

    }

    //定义获取用户以及权限信息对象，通过token获取（new 授权：从redis中获取用户信息，包括权限信息）
    private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request){

        //token置于header里面
        String token = request.getHeader("token");
        logger.info("token: " + token);
        //token不为空则获取token中的用户信息
        if(!StringUtils.isEmpty(token)){
            String username = JwtHelper.getUsername(token);
            logger.info("username: " + username);
            //如果用户名不为空则返回目标认证对象
            if(!StringUtils.isEmpty(username)){
                //[new return 授权 ] ： 同时获取权限信息
                //根据用户名 key ，从redis中获取当前用户目标权限数据（所有权限操作符）
                String authoritiesString = (String)redisTemplate.opsForValue().get(username);
                //将权限数据转换成map集合（方便操作）
                List<Map> mapList = JSON.parseArray(authoritiesString, Map.class);
                //创建Security规定的权限对象集合，将目标权限数据封装成Security指定的
                List<SimpleGrantedAuthority> authorities = new ArrayList<>();
                for (Map map : mapList) {
                    authorities.add(new SimpleGrantedAuthority((String)map.get("authority")));
                }
                //最总返回目标数据
                return new UsernamePasswordAuthenticationToken(username, null, authorities);
                //[old return]
//                return new UsernamePasswordAuthenticationToken(username, null, Collections.emptyList());
            }
        }

        return null;
    }
}
  1. MySecurityConfig核心配置类也要修改
package com.xxz.system.config;

import com.xxz.system.custom.CustomMD5Password;
import com.xxz.system.filter.TokenAuthenticationFilter;
import com.xxz.system.filter.TokenLoginFilter;
import com.xxz.system.service.UserDetailServiceImpl;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

/**
 * 六、配置SpirngSecurity配置类（自定义大整合）
 */
@Configuration
@EnableWebSecurity //开启SpringSecurity的默认行为
@Slf4j //日志
@EnableGlobalMethodSecurity(prePostEnabled = true) //开启注解功能，默认禁用注解
public class MySecurityConfig extends WebSecurityConfigurerAdapter {

    //导入自己编写的查询业务类（默认是providerService去内存查找）
    @Autowired
    private UserDetailServiceImpl userDetailsService;

    //导入我们自己编写的加密工具类
    @Autowired
    private CustomMD5Password customMD5Password;

    //[new 权限]：注入redistemplate依赖
    @Autowired
    private RedisTemplate redisTemplate;

    /*
     *  用户认证管理器
     * @return
     * @throws Exception
     */
    @Bean
    @Override
    protected AuthenticationManager authenticationManager()throws Exception{
        log.info("AuthenticationManager用户认证管理器 + 加入容器.......");
        log.info("当前注入对象UserDetailsService ： ===== " + userDetailsService);
        return super.authenticationManager();
    }

    @Override
    protected void configure(HttpSecurity http)throws Exception{
        //这是配置的关键，决定那些接口开启防护，那些接口绕过防护
        http
                //关闭csrf
                .csrf().disable()
                //开启跨域以便前端调用接口
                .cors()
                .and()
                .authorizeRequests()
                //指定某些接口不需要通过认证即可访问， 登录接口肯定是不需要的
                .antMatchers("/admin/system/index/login").permitAll()
                //这里的意思是其他所有接口需要认证才能访问
                .anyRequest().authenticated()
                .and()
                //TokenAuthenticationFilter放到UsernamePasswordAuthenticationFilter的前面 [new 权限：注入redistemplate]
                .addFilterBefore(new TokenAuthenticationFilter(redisTemplate), UsernamePasswordAuthenticationFilter.class)
                .addFilter(new TokenLoginFilter(authenticationManager(), redisTemplate));

        //禁用session
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception{
        //指定UserDetailService和加密器（使用自定义的）
        log.info("指定UserDetailService和加密器（使用自定义的） + 加入容器.......");
        auth.userDetailsService(userDetailsService).passwordEncoder(customMD5Password);
    }

    /**
     * 配置那些请求不拦截
     * 排除swagger 相关请求
     * @param web
     * @throws Exception
     */
    @Override
    public void configure(WebSecurity web)throws Exception{
        web.ignoring().antMatchers(
                "/favicon.ico",
                "/swagger-resources/**",
                "/webjars/**", "/v2/**",
                "/swagger-ui.html",
                "/doc.html");
    }

}
  1. 通过Controller进行Security权限测试——以角色列表分页查询

在这里插入图片描述
在这里插入图片描述

    //逻辑删除
    @ApiOperation("逻辑删除接口")
    @PreAuthorize("hasAuthority('bnt.sysRole.remove')")
    @DeleteMapping("/remove/{id}")
    public Result removeRole(@PathVariable("id") Long id){
        boolean bool = sysRoleService.removeById(id);
        if(bool){
            return Result.ok();
        }else{
            return Result.fail();
        }
    }

    //查询所有
    @ApiOperation("查询所有角色接口")
    @PreAuthorize("hasAuthority('bnt.sysRole.list')")
    @GetMapping("/findAll")
    public Result findAllRole(){
        return Result.ok(sysRoleService.list());
    }

    //分页查询
    @ApiOperation("条件分页查询")
    @PreAuthorize("hasAuthority('bnt.sysRole.list')")
    @GetMapping("/{page}/{limit}")
    public Result  findPageQueryRole(@PathVariable("page") Long page, @PathVariable("limit") Long limit, SysRoleQueryVo sysRoleQueryVo){
        //创建apge对象
        System.out.println("page ==== " + page);
        System.out.println("limit ==== " + limit);
//        if(null == sysRoleQueryVo){
//            sysRoleQueryVo = new SysRoleQueryVo();
            sysRoleQueryVo.setRoleName("用户");
//        }
        System.out.println("========================" + sysRoleQueryVo.getRoleName() + "=========================");
        Page<SysRole> pageParam = new Page<>(page, limit);
        IPage<SysRole> pageModel = sysRoleService.mySelectPage(pageParam, sysRoleQueryVo);
        System.out.println(pageModel.getRecords());
        return Result.ok(pageModel);
    }
  1. 全局异常处理器配置
package com.xxz.system.exception;

import com.xxz.common.result.Result;
import com.xxz.common.result.ResultCodeEnum;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.ResponseBody;


/**
 * 全局异常处理器-通过aop方式
 */
@ControllerAdvice
public class GlobalExcetionHandler {

    //1.全局异常
    @ExceptionHandler(Exception.class)
    @ResponseBody
    public Result error(Exception e){
        return Result.fail().message("执行了全局异常处理");
    }

    //2.特定异常
    @ExceptionHandler(ArithmeticException.class)
    @ResponseBody
    public Result error(ArithmeticException e){
        return Result.fail().message("执行了特定异常处理");
    }


    //3.自定义异常
    @ExceptionHandler(GuiguException.class)
    @ResponseBody
    public Result error(GuiguException e){
        return Result.fail().message("执行了自定义异常处理");
    }

    /**
     * spring security的异常：[要导security包] import org.springframework.security.access.AccessDeniedException;
     * @param e
     * @return
     */
    //[new 权限]
    //4.无法访问异常
    @ExceptionHandler(AccessDeniedException.class)
    @ResponseBody
    public Result error(AccessDeniedException e){
        return Result.fail().code(ResultCodeEnum.PERMISSION.getCode()).message("没有当前功能操作权限");
    }

}
程序猿Mr.Shaw
关注
  • 0
    点赞
  • 踩
  • 12
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
专栏目录
SpringBoot整合Spring Security的详细教程
08-18
主要介绍了SpringBoot整合Spring Security的方法，本文给大家介绍的非常详细，对大家的学习或工作具有一定的参考借鉴价值,需要的朋友可以参考下
超详细——SpringBoot整合Spring Security
椿尼的博客
02-26 907
简介 Spring Security是一个功能强大且高度可定制的身份验证和访问控制框架。它是用于保护基于Spring的应用程序的实际标准。 Spring Security是一个框架，致力于为Java应用程序提供身份验证和授权。与所有Spring项目一样，Spring Security的真正强大之处在于可以轻松扩展以满足自定义要求。 SpringBoot底层默认的安全框架技术选型就是Spring Security，我们只需要简单的配置即可实现安全管理。 特征 全面和可扩展的身份验证和授权支持 防御会话固定，
springboot项目整合springSecurity框架流程
最新发布
weixin_67909064的博客
04-18 823
addFilter(new TokenVerifyFilter(super.authenticationManager())) // 绑定校验的接口（将步骤四定义的token校验过滤器扔进来）.addFilter(new TokenLoginFilter(super.authenticationManager())) // 绑定认证的接口（将步骤三定义的登录过滤器扔进来）auth.userDetailsService(mySecurityService) // 绑定自定义的认证Service。
微服务整合Spring Security实现用户的认证和授权
u014496893的博客
01-31 4972
一、Spring Security介绍 1、框架介绍 Spring 是一个非常流行和成功的 Java 应用开发框架。Spring Security 基于 Spring 框架，提供了一套 Web 应用安全性的完整解决方案。一般来说，Web 应用的安全性包括用户认证（Authentication）和用户授权（Authorization）两个部分。 （1）用户认证指的是：验证某个用户是否为系统中的合法主体，也就是说用户能否访问该系统。用户认证一般要求用户提供用户名和密码。系统通过校验用户名和密码来完成认证过程。
springBoot整合springSecurity
01-10
springBoot整合springSecurity完整代码
springboot整合SpringSecurity并实现简单权限控制
听钱塘信来的博客
11-28 6584
springboot整合SpringSecurity并实现简单权限控制
SpringBoot+Security+Vue前后端分离开发权限管理系统
04-10
适用人群所有的IT从业者，尤其适合快速掌握新技术，快速增长工作经验人群，对教育公平，教育公益，教育爱心公益人士课程概述该互联网实战项目是基于 Spring Boot 2+ SpringSecurity5+Element UI+Vue Admin Template+蚂蚁可视化AntV 等技术栈开发的项目，采用分布式，多模块，前后端分离开发。包括图形展示、权限管理、用户管理等功能。【后端技术】技术说明Spring Boot2MVC框架 开发的一站式解决方案Spring Security5 认证和授权框架MyBatisPlus3.3.1 基于 MyBatis 框架的快速研发框架MyBatisCode工具生成 MyBatis 相关代码Jackson提供了处理 JSON 数据的工具Lombok简化对象封装工具 Druid   数据库连接池 【前端技术】Vue       互联网最火的前端框架Vue Router路由框架Vuex全局状态管理框架Axios前端 HTTP 框架Element UI前端 UI 框架Vue Element Admin前端模板Antv  蚂蚁金服可视化技术，阿里巴巴可视化技术，天猫，淘宝，支付宝，花呗均使用AntV【开发工具】IntelliJ IDEA开发 IDESQLyog数据库连接客户端PostmanHTTP 请求工具【开发环境】工具版本JDK1.8MySQL5.7
Springboot整合SpringSecurity
weixin_59015876的博客
12-08 1653
Springboot,SpringSecurity
Springboot——整合SpringSecurity
qq_41297145的博客
12-30 2642
认证过程主要是实现AuthenticationManager， AuthenticationManager最重要的实现类是ProviderManager， 通过ProviderManager，可以管理AuthenticationProvider， 每个AuthenticationProvider都对应一种认证方式， 当所有认证方式不支持时，调用ProviderManager的parent认证。如果想要自定义配置，如自定义登录界面、自定义验证过程，或者想要整合一些工具，如Jwt，这个时候需要在。
狂神说SpringBoot18：集成SpringSecurity
热门推荐
狂神说
03-29 1万+
狂神说SpringBoot系列连载课程，通俗易懂，基于SpringBoot2.2.5版本，欢迎各位狂粉转发关注学习。未经作者授权，禁止转载SpringSecurity安全简介在 Web ...
Springboot整合Spring security+Oauth2+JWT搭建认证服务器，网关，微服务之间权限认证及授权
04-22
Springboot整合Spring security+Oauth2+JWT搭建认证服务器，网关，微服务之间权限认证及授权
springboot整合springSecurity
04-19
springboot整合springSecurity
springboot整合springsecurity小demo
07-19
关于springboot整合springsecurity的小demo，如需要连接数据库，可以去网上自己稍微看一下
SpringBoot整合SpringSecurity（通俗易懂）
u012102536的博客
08-01 1789
因为用户和角色是多对多关系，需要在用户中含有角色的对象，角色中含有用户的对象，创建DTO类而不再entity类中添加，是因为entity类属性是和表字段一一对应的，一般不推荐在entity类中添加与表字段无关的属性。–1个用户,拥有2个角色INSERTINTOuser2_role2VALUES(1,1,1);我们前面用户表中，用户和角色是绑定一起，用户就只有一个角色了，但实际上，用户可能拥有多个角色，角色拥有多个用户，是多对多的关系，所以需要重新设置用户表和角色表。...
SpringBoot整合Spring Security实现用户角色验证以及权限控制
爱吃鸡腿的明仔
01-14 5559
文章目录一。Spring Security介绍二。工程搭建1.工程结构图：2.导入依赖3.编写security配置类4.编写UserDetailsService验证类5.Dao层6.model层7.控制器层8.工具类9.配置文件10.jsp示例登录页面11.启动类三。数据库结构t_user（用户表）t_role（角色表）t_permission（权限表）t_user_role（用户角色表）t_permission（角色权限表）四。测试1.用户登录验证2.用户权限验证五。项目地址 一。Spring Secu
SpringBoot_整合SpringSecurity（前后端分离版）
骑大马挎大刀
02-27 4702
Spring Boot集成Spring Security
我是一只蘑菇17的博客
11-02 1429
开发Web应用，对页面的安全控制通常是必须的。比如：对于没有访问权限的用户需要转到登录表单页面。要实现访问控制的方法多种多样，可以通过Aop、拦截器实现，也可以通过框架实现，例如：Apache Shiro、Spring Security。很多成熟的大公司都会有专门针对用户管理方面有一套完整的SSO（单点登录），ACL（权限访问控制），UC(用户中心)系统。 但是在我们开发中小型系统的时候，往往还是优先选择轻量级可用的业内通用的框架解决方案。Spring Security 就是一个Spring生态中关于安全方
Springboot + SpringSecurity（一）
qq_50833522的博客
06-03 3720
基于springboot的脚手架已经搭建完成的基础，用Springbot+SpringSecurity来进行的用户登录认证与权限控制（认证与授权）。
springboot 整合springsecurity
10-13
要在Spring Boot中整合Spring Security，需要在pom.xml文件中添加Spring Security依赖项，并创建一个Security配置类来配置安全性规则和用户身份验证。以下是一个简单的示例： 1. 添加依赖项： ``` <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency> ``` 2. 创建Security配置类： ``` @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private UserDetailsService userDetailsService; @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .antMatchers("/admin/**").hasRole("ADMIN") .antMatchers("/user/**").hasAnyRole("ADMIN", "USER") .anyRequest().authenticated() .and() .formLogin() .and() .logout().logoutSuccessUrl("/login"); } @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userDetailsService); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } } ``` 在上面的示例中，我们配置了三个安全规则：只有具有ADMIN角色的用户才能访问/admin路径，具有ADMIN或USER角色的用户才能访问/user路径，其他所有请求都需要进行身份验证。我们还配置了一个自定义的UserDetailsService来加载用户信息，并使用BCryptPasswordEncoder来加密密码。

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值