spring3 升级4 spring security4.2.x配置

为了体验一下java8，只好把spring3升级到了4，因为Spring3对java8不能完全支持。工程采用了maven，因此简单的更改了pom.xml，这个没什么好解释的了，至于spring.xml，spring-mvc.xml，spring-hibernate.xml等文件，只需要把版本改成4.0即可，不贴源码了，改动最大的是spring-security.xml（网上有多种配置方式），如果像我一样对4不甚理解的同学，可以只配置spring-security.xml即可（毕竟跟以前的配置方式相类似）。

spring-security.xml配置参考：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
               http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
            http://www.springframework.org/schema/security
            http://www.springframework.org/schema/security/spring-security-4.2.xsd">
    <security:http pattern="/extjs/**" security="none"/>
    <security:http pattern="/js/**" security="none"/>
    <security:http pattern="/css/**" security="none"/>
    <security:http pattern="/loginlogout/toLogin" security="none"/>
    <security:http pattern="/loginlogout/login" security="none"/>
    <!--  Spring-Security 的配置 -->

    <security:http auto-config="true" use-expressions="true">
        <security:headers>
            <security:frame-options policy="SAMEORIGIN"/>
        </security:headers>
        <!--<security:access-denied-handler error-page="/user/denied"/>-->
        <security:intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>

        <security:csrf disabled="true"/>
        <security:form-login login-page="/loginlogout/toLogin"
                             authentication-failure-url="/loginlogout/logout"
                             default-target-url="/menu/toDemo" username-parameter="name" password-parameter="passwd"/>
        <security:logout
                logout-url="/loginlogout/logout"
                logout-success-url="/loginlogout/logout"
        />
        <security:session-management invalid-session-url="/loginlogout/toLogin"
                                     session-fixation-protection="newSession">