上一个例子只是初探了一下Spring Security的用法,简单的不能再简单的。今天进一步去体验Spring Security的用法,丰富之前的例子。
在上一个demo的基础上改进之处:
1、使用自己编写的登录页面;
2、将明文密码进行MD5加密;
3、进行国际化;
4、是用自己定义的页面替代浏览器403无权访问提示;
5、设置session过期跳转页面;
6、防止多次登录;
自己定义的登陆页面如下:login.jsp
<%@ page language="java" pageEncoding="UTF-8"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>login</title>
<meta http-equiv="pragma" content="no-cache">
<meta http-equiv="cache-control" content="no-cache">
<meta http-equiv="expires" content="0">
</head>
<body οnlοad='document.f.j_username.focus();'>
<h3>
${sessionScope.SPRING_SECURITY_LAST_EXCEPTION.message}
<br/>
用户登录
</h3>
<form name='f' action='<%=request.getContextPath() %>/j_spring_security_check'
method='POST'>
<table>
<tr>
<td>User:</td>
<td><input type='text' name='j_username' value=''></td>
</tr>
<tr>
<td>Password:</td>
<td><input type='password' name='j_password' /></td>
</tr>
<tr>
<td colspan='2'>
<input name="submit" type="submit" />
</td>
</tr>
<tr>
<td colspan='2'>
<input name="reset" type="reset" />
</td>
</tr>
</table>
</form>
</body>
</html>
自定义无权访问页面accessDenied.jsp
<%@ page language="java" pageEncoding="UTF-8"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>无权访问</title>
</head>
<body>
您的访问被拒绝,您无权访问该资源
</body>
</html>
自定义Session过期页面sessionTimeout.jsp
<%@ page language="java" pageEncoding="utf-8"%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>用户登录已超时</title>
<style type="text/css">
body{
text-align: center;
}
#sessionOut {
margin-top: 50px;
padding: 15px 50px;
width: 500px;
border: 2px solid green;
background-color: yellow;
text-align: center;
}
a{
font-weight:bold;
font-family:"宋体";
font-size:18px;
}
</style>
</head>
<body>
<div id ="sessionOut">
您长时间未操作系统,为确保您的资料及数据信息安全,
系统自动超时退出,请重新<a href="http://<%=request.getRemoteAddr()%>:<%= request.getServerPort()%>/security1">登录</a>系统!
</div>
</body>
<script type="text/javascript">
if (self != top){
window.top.location = window.location;
}
</script>
</html>
修改配置文件applicationContext.xml达到以上功能:
<?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"> <!-- 指定被拒绝的页面 --> <http auto-config='true' access-denied-page="/accessDenied.jsp"> <!-- login-page表示用户登陆时显示我们自定义的login.jsp authentication-failure-url表示用户登陆失败时,跳转到哪个页面,并添加一个error=true参数作为登陆失败的标示 default-target-url表示登陆成功时,跳转到哪个页面 --> <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=true" default-target-url="/index.jsp" /> <!--登录页面不进行过滤,后面加一个*那是因为请求页面后面会带参数--> <intercept-url pattern="/login.jsp*" filters="none"/> <intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" /> <intercept-url pattern="/**" access="ROLE_USER" /> <!-- 检测失效的sessionId,超时时定位到另外一个URL --> <session-management invalid-session-url="/sessionTimeout.jsp" > <!-- 防止第二次登录 如果想让第一次登录失效第二次登录启用则不要配置error-if-maximum-exceeded="true" --> <concurrency-control max-sessions="1" error-if-maximum-exceeded="true"/> </session-management> </http> <authentication-manager> <authentication-provider> <!-- 加密用户的密码 --> <password-encoder hash="md5"/> <user-service> <!-- <user name="admin" password="admin" authorities="ROLE_USER, ROLE_ADMIN" /> <user name="user" password="user" authorities="ROLE_USER" /> --> <user name="admin" password="21232f297a57a5a743894a0e4a801fc3" authorities="ROLE_USER, ROLE_ADMIN" /> <user name="user" password="ee11cbb19052e40b07aac0ca060c23ee" authorities="ROLE_USER" /> </user-service> </authentication-provider> </authentication-manager> <!-- 国际化 --> <beans:bean id="messageSource" class="org.springframework.context.support.ReloadableResourceBundleMessageSource"> <!-- 如果不加载自己的国际化文件,去加载 Security 内部的国际化文件classpath:org/springframework/security/messages_zh_CN --> <beans:property name="basename" value="classpath:messages_zh_CN"/> </beans:bean> </beans:beans>
上面每个新添加的功能配置多进行了相应的注释说明。