第9章 保护Web应用--Spring Security 之 HelloWord

概述：

Web安全保驾护航，涉及面很广，从前端到数据库都有，先简单用一下Spring Security Demo 来感受一下功能

1、开发环境：

JDK 1.8

maven 3.5

eclipse Neon

2、工程结构：

3、web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
  <display-name>spring-security-helloworld</display-name>
  <servlet>
  	<servlet-name>mvc-dispatcher</servlet-name>
  	<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
  	<load-on-startup>1</load-on-startup>
  	
  </servlet>
  <servlet-mapping>
  	<servlet-name>mvc-dispatcher</servlet-name>
  	<url-pattern>/</url-pattern>
  	
  </servlet-mapping>
  <listener>
  	<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>
  <context-param>
  	<param-name>contextConfigLocation</param-name>
  	<param-value>classpath:spring-security.xml</param-value>
  </context-param>
  <filter>
  	<filter-name>springSecurityFilterChain</filter-name>
  	<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>
  <filter-mapping>
  	<filter-name>springSecurityFilterChain</filter-name>
  	<url-pattern>/*</url-pattern>
  </filter-mapping>
  
</web-app>

总结：

1、在没有显示引入Springmvc.xml 配置文件，默认是WEB-INF/{servlet-name}-servlet.xml  例如上面自动寻找 WEB-INF/mvc-dispatcher-servlet.xml,当然也可以显示指定

2、配置spring-security.xml 安全策略相关的

3、配置一个过滤器代理，通过代理去关联具体的过滤器

4、pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.jack</groupId>
  <artifactId>spring-security-helloworld</artifactId>
  <version>0.0.1-SNAPSHOT</version>
  <name>spring-security-helloworld</name>

	<licenses>
		<license>
			<name>The Apache Software License, Version 2.0</name>
			<url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
			<distribution>repo</distribution>
		</license>
	</licenses>
	<properties>
		<jdk.version>1.8</jdk.version>
		<spring.version>4.3.8.RELEASE</spring.version>
		<spring.security.version>3.2.3.RELEASE</spring.security.version>
		<jstl.version>1.2</jstl.version>
	</properties>

	<dependencies>

		<!-- Spring 3 dependencies -->
		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>spring-core</artifactId>
			<version>${spring.version}</version>
		</dependency>

		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>spring-web</artifactId>
			<version>${spring.version}</version>
		</dependency>

		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>spring-webmvc</artifactId>
			<version>${spring.version}</version>
		</dependency>

		<!-- Spring Security -->
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-web</artifactId>
			<version>${spring.security.version}</version>
		</dependency>

		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-config</artifactId>
			<version>${spring.security.version}</version>
		</dependency>

		<!-- jstl for jsp page -->
		<dependency>
			<groupId>jstl</groupId>
			<artifactId>jstl</artifactId>
			<version>${jstl.version}</version>
		</dependency>

	</dependencies>

	<build>
		<finalName>SpringSecurityHelloWorld</finalName>
		<plugins>

			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-compiler-plugin</artifactId>
				<version>2.3.2</version>
				<configuration>
					<source>${jdk.version}</source>
					<target>${jdk.version}</target>
				</configuration>
			</plugin>

			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-eclipse-plugin</artifactId>
				<version>2.9</version>
				<configuration>
					<downloadSources>true</downloadSources>
					<downloadJavadocs>false</downloadJavadocs>
					<wtpversion>2.0</wtpversion>
				</configuration>
			</plugin>

		</plugins>
	</build>
	
</project>

总结：

1、这里引入Spring Security 的jar包有

<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>${spring.security.version}</version>
</dependency>


<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>${spring.security.version}</version>
</dependency>

5、mvc-dispatcher-servlet.xml

<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:context="http://www.springframework.org/schema/context"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="
        http://www.springframework.org/schema/beans     
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
        http://www.springframework.org/schema/context 
        http://www.springframework.org/schema/context/spring-context-3.0.xsd">
        
   <context:component-scan base-package="com.jack.*"/>     
   
   <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
   	<property name="prefix">
   		<value>/WEB-INF/pages/</value>
   	</property>
   	<property name="suffix">
   		<value>.jsp</value>
   	</property>
   </bean>

</beans>

6、spring-security.xml 主要配置文件

<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd">
   
<http auto-config="true">
<intercept-url pattern="/admin**" access="ROLE_USER"/>
</http>
<authentication-manager>
<authentication-provider>
<user-service>
<user name="jack" password="123456" authorities="ROLE_USER"/>
</user-service>
</authentication-provider>
</authentication-manager>
</beans:beans>

总结：

1、<http>表示拦截http请求， auto-config="true" 表示自动处理请求出现各种情况，例如输错了提示信息

2、<intercept-url > 表示拦截具体url地址 pattern就是正则表达式， access 表示通过角色

3、<authentication-manager>表示验证经理，<authentication-provider>提供通行票

4、<user-service>表示用户登录功能，弹出输入框， authorities 跟 access 值一样

7、HelloController.java 

package com.jack.controller;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.servlet.ModelAndView;

@Controller
public class HelloController {
	
	@RequestMapping(value={"/","/welcome**"}, method=RequestMethod.GET)
	public ModelAndView welcomePage(){
		
		ModelAndView model = new ModelAndView();
		model.addObject("title", "Spring Security Hello World");
		model.addObject("message", "This is welcom page!");
		model.setViewName("hello");
		return model;
	}
	
	@RequestMapping(value ="/admin**", method= RequestMethod.GET)
	public ModelAndView adminPage(){
		ModelAndView model = new ModelAndView();
		model.addObject("title", "SpringSecurity Hello World");
		model.addObject("message", "This is protected page!");
		model.setViewName("admin");
		
		return model;
	}
	
}

总结：

1、一般情况返回一个字符串对应jsp，这里可以返回一个视图，model可以带数据，model也可以设置视图名称

2、addObject() 可以直接在jsp通过 ${title} 形式获取数据

8、jsp

hello.jsp

<%@page session="false"%>
<html>
<body>
	<h1>Title : ${title}</h1>	
	<h1>Message : ${message}</h1>	
</body>
</html>

admin.jsp

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%@ page session="true" %>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Insert title here</title>
</head>
<body>
	<h1>Title: ${title }</h1>
	<h1>Message: ${message }</h1>
	<c:if test="${pageContext.request.userPrincipal.name !=null }">
		 <h2>Welcome : ${pageContext.request.userPrincipal.name}
           | <a href="<c:url value="/j_spring_security_logout" />" > Logout</a></h2>
	</c:if>
</body>
</html>

总结：

1、这里有一个if 判断， pageContext.request.userPrincipal.name 表示作用域为页面Request请求userPrincipal.name 表示通过安全检查姓名

2、Logout注销的意思，/j_spring_security_logout 这句话就是去掉pageContext.request.userPrincipal.name 的值为空，下次需要输入用户名和密码进入

9、效果：

欢迎页

admin.jsp

输入错误密码

输入正确密码

总结：

本质上AOP切面功能，执行请求进行拦截处理，包括这里输入框界面

参考地址：https://www.mkyong.com/spring-security/spring-security-hello-world-example/