web.xml配置
<context-param>
<param-name>contextConfigLocation</param-name><param-value>classpath*:applicationContext-*.xml</param-value>
</context-param>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
application-security.xml配置
- <?xmlversion="1.0"encoding="UTF-8"?>
- <beans:beansxmlns="http://www.springframework.org/schema/security"
- xmlns:beans="http://www.springframework.org/schema/beans"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans
- http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
- http://www.springframework.org/schema/security
- http://www.springframework.org/schema/security/spring-security-3.0.xsd">
- <!--auto-config=true则使用from-login.如果不使用该属性则默认为http-basic(没有session).
- access-denied-page:出错后跳转到的错误页面;
- -->
- <httpauto-config="true"access-denied-page="/common/403.jsp">
- <!--intercept-url:拦截器,可以设定哪些路径需要哪些权限来访问.filters=none不使用过滤,也可以理解为忽略
- 只有ROLE_USER角色的用户才能访问 -->
- <intercept-urlpattern="/index.jsp"access="ROLE_USER"/>
- <intercept-urlpattern="/login.jsp"filters="none"/>
- <intercept-urlpattern="/common/**"filters="none"/>
- <intercept-urlpattern="/script/**"filters="none"/>
- <intercept-urlpattern="/admin.jsp"access="ROLE_ADMIN"/>
- <intercept-urlpattern="/user.jsp"access="ROLE_USER"/>
- <!--session-management是针对session的管理.这里可以不配置.如有需求可以配置.-->
- <!--id登陆唯一.后登陆的账号会挤掉第一次登陆的账号error-if-maximum-exceeded="true"禁止2次登陆;
- session-fixation-protection="none"防止伪造sessionid攻击.用户登录成功后会销毁用户当前的session.
- 创建新的session,并把用户信息复制到新session中.
- -->
- <session-managementsession-fixation-protection="none">
- <concurrency-control/>
- </session-management>
- <!--login-page:默认指定的登录页面.authentication-failure-url:出错后跳转页面.default-target-url:成功登陆后跳转页面-->
- <form-loginlogin-page="/login.jsp"
- authentication-failure-url="/common/403.jsp"
- default-target-url="/admin.jsp"/>
- <!--logout-success-url:成功注销后跳转到的页面;-->
- <logoutlogout-success-url="/login.jsp"/>
- <http-basic/>
- </http>
- <!--权限管理操作-->
- <authentication-manager>
- <authentication-provider>
- <!-- 把密码和盐值指定的内容合并在一起,如用户名是tom,密码是123456的用户在数据库中存放的密码应为“123456{tom}”的md5值-->
- <password-encoderhash="md5">
- <salt-sourceuser-property="username"/>
- </password-encoder>
- -->
- <!--注入dataSource验证数据库中的用户名.密码.账号状态.和权限相关;-->
- <jdbc-user-servicedata-source-ref="dataSource"
- users-by-username-query="selectusername,password,enabledfromuserwhereusername=?andenabled=1"
- authorities-by-username-query="selectu.username,r.namefromuserujoinuser_roleuronu.uid=ur.uidjoinroleronr.rid=ur.ridwhereu.username=?"/>
- <!--
- 使用固定的用户名和密码及权限来做验证.
- <user-service>
- <username="admin"password="admin"authorities="ROLE_USER,ROLE_ADMIN"/>
- <username="user"password="user"authorities="ROLE_USER"/>
- </user-service>
- -->
- </authentication-provider>
- </authentication-manager>
-
防止一个用户重复登录好几次-第二次登录会让第一次登录失效。 通常我们更想防止第二次登录,这时候我们可以使用
<session-management> <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" /> </session-management>
-
- </beans:beans>
获取当前用户信息
Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal(); if (principal instanceof UserDetails) { String username = ((UserDetails)principal).getUsername(); } else { String username = principal.toString(); }
登陆后操作
public class AuthenticationSuccessHandler extendsSavedRequestAwareAuthenticationSuccessHandler {
登陆是操作(如添加验证码)
public class validateCodeUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter{