目录
一、创建项目
pom.xml 加入关键依赖
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
启动类
@SpringBootApplication
@RestController
public class RunApplication {
public static void main(String[] args) {
SpringApplication.run(RunApplication.class, args);
}
@GetMapping("/hi")
public String home(@RequestParam(value = "name", defaultValue = "forezp") String name) {
return "hi " + name + " ,i am";
}
}
application.yml加入配置
server:
port: 8001
测试
启动,浏览器输入http://localhost:8081/hi,访问结果:
二、加入security模块
加入依赖
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
重新启动,浏览器输入http://localhost:8081/hi,访问弹出登陆界面:
这是security自带默认的登陆界面。
需要配置一个用户的账户密码
在application.yml添加
spring:
security:
user:
name: user
password: 111
重新启动,在登陆界面输入上面的账号密码,可看到hi接口可以正常访问。
三、自定义账号验证
一般的账号密码记录在数据库中,当用户登陆时,会根据用户名查找用户信息,并对密码做比较。
需要做以下操作
1、SecurityUser
继承UserDetails,用户实体类
public class ecurityUser implements UserDetails {
private static final long serialVersionUID=1L;
private String password;
private String name;
private List<GrantedAuthority> anthorities;
public SecurityUser(String name, String password) {
this.password = password;
this.name = name;
}
public void setAnthorities(List<GrantedAuthority> anthorities) {
this.anthorities = anthorities;
}
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return this.anthorities;
}
@Override
public String getPassword() {
return this.password;
}
@Override
public String getUsername() {
return this.name;
}
//账户是否未过期
@Override
public boolean isAccountNonExpired() {
return true;
}
//账户是否未锁定
@Override
public boolean isAccountNonLocked() {
return true;
}
//帐户密码是否未过期,一般有的密码要求性高的系统会使用到,比较每隔一段时间就要求用户重置密码
@Override
public boolean isCredentialsNonExpired() {
return true;
}
//账户是否可用
@Override
public boolean isEnabled() {
return true;
}
}
2、SecurityUserService
继承于UserDetailsService,用户服务类,输入用户名,根据用户名返回实体类,这里简单实现。
@Component
public class SecurityUserService implements UserDetailsService {
@Override
public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
SecurityUser user = new SecurityUser("user", "202cb962ac59075b964b07152d234b70");
user.setAnthorities(new ArrayList<>());
return user;
}
}
3、MyPasswordEncoder
继承于PasswordEncoder,密码加密类。security框架会自动执行加密类DelegatingPasswordEncoder,这个加密类要求密码格式
{id}xx
如果解析不多id,则会报错There is no PasswordEncoder mapped for the id "null"
所以自定义一个加密类
@Component
public class MyPasswordEncoder implements PasswordEncoder {
private Logger logger = LoggerFactory.getLogger(MyPasswordEncoder.class);
@Override
public String encode(CharSequence charSequence) {
return Md5Util.StringToMD5(charSequence.toString());
}
@Override
public boolean matches(CharSequence rawPassword, String encodedPassword) {
String encodeStr = encode(rawPassword);
logger.info("raw:{},encoded:{}", encodeStr, encodedPassword);
return encodedPassword.equalsIgnoreCase(encodeStr);
}
}
4、SecurityConfig
继承于WebSecurityConfigurerAdapter,配置类:设置策略和各种配置好。
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private SecurityUserService userService;
@Autowired
private MyPasswordEncoder passwordEncoder;
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userService).passwordEncoder(passwordEncoder);
}
}
将用户服务和密码加密设置好。
5、测试
重启服务,浏览器输入http://localhost:8081/hi后,输入账号:user 密码:123。得到正确结果。