SpringSecurity整合ssm

最新推荐文章于 2024-06-21 15:05:38 发布

做技术我是认真的

最新推荐文章于 2024-06-21 15:05:38 发布

阅读量732

点赞数

分类专栏： java spring 文章标签： java spring servlet

本文链接：https://blog.csdn.net/qq_34091529/article/details/131412438

版权

java 同时被 2 个专栏收录

22 篇文章 2 订阅

订阅专栏

spring

3 篇文章 0 订阅

订阅专栏

SpringSecurity

1. SpringSecurity 框架简介

Spring 是非常流行和成功的 Java 应用开发框架，Spring Security 正是 Spring 家族中的成员。Spring Security 基于 Spring 框架，提供了一套 Web 应用安全性的完整解决方案。

正如你可能知道的关于安全方面的两个主要区域是“认证”和“授权”（或者访问控制），一般来说，Web 应用的安全性包括用户认证（Authentication）和用户授权 **（Authorization）**两个部分，这两点也是 Spring Security 重要核心功能。

（1）用户认证指的是：验证某个用户是否为系统中的合法主体，也就是说用户能否访问该系统。用户认证一般要求用户提供用户名和密码。系统通过校验用户名和密码来完成认证过程。通俗点说就是系统认为用户是否能登录

（2）用户授权指的是验证某个用户是否有权限执行某个操作。在一个系统中，不同用户所具有的权限是不同的。比如对一个文件来说，有的用户只能进行读取，而有的用户可以进行修改。一般来说，系统会为不同的用户分配不同的角色，而每个角色则对应一系列的权限。通俗点讲就是系统判断用户是否有权限去做某些事情。

2. SpringSecurity入门案例 (认证)

2.1. 创建maven工程（web工程）加入依赖

  <properties> 
    <maven.compiler.source>8</maven.compiler.source>  
    <maven.compiler.target>8</maven.compiler.target>  
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <spring.version>5.0.4.RELEASE</spring.version>
    <spring.security.version>5.0.1.RELEASE</spring.security.version>
  </properties>
  <dependencies>
    <dependency>
      <groupId>org.aspectj</groupId>
      <artifactId>aspectjweaver</artifactId>
      <version>1.8.6</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aop</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-core</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-web</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-webmvc</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-context-support</artifactId>
      <version>5.1.6.RELEASE</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-test</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-jdbc</artifactId>
      <version>${spring.version}</version>
    </dependency>

    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
      <version>${spring.security.version}</version>
    </dependency>
    <dependency>
      <groupId>javax.annotation</groupId>
      <artifactId>jsr250-api</artifactId>
      <version>1.0</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
      <version>${spring.security.version}</version>
    </dependency>
    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>javax.servlet-api</artifactId>
      <version>3.1.0</version>
      <scope>provided</scope>
    </dependency>

  </dependencies>
  <build>
    <plugins>
      <!-- java编译插件 -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <configuration>
          <source>1.8</source>
          <target>1.8</target>
          <encoding>UTF-8</encoding>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.tomcat.maven</groupId>
        <artifactId>tomcat7-maven-plugin</artifactId>
        <configuration>
          <!-- 指定端口 -->
          <port>8080</port>
          <!-- 请求路径 -->
          <path>/</path>
        </configuration>
      </plugin>
    </plugins>
  </build>

2.2 创建页面

登录页面(login.jsp)

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
    <link rel="icon" href="图标路径;base64,aWNv">
</head>
<body>
    <h1>login.jsp</h1>
    <form action="/login" method="post">
        用户名：<input type="text" name="username" value=""><br>
        密码：<input type="password" name="password" value=""><br>
        <input type="submit" value="登录">
    </form>
</body>
</html>

登录失败页面(fail.jsp)

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
    <h1>登录失败</h1>
</body>
</html>

登录成功页面（index.jsp）

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
  <h1>登录成功</h1>
</body>
</html>

2.3 resource下创建spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security.xsd">
    
    <!-- 配置不过滤的资源（静态资源及登录相关） -->
    <security:http pattern="/login.jsp" security="none"/>
    <security:http pattern="/fail.jsp" security="none"/>
    <security:http pattern="/css/**" security="none"/>
    <security:http pattern="/img/**" security="none"/>
    <security:http pattern="/js/**" security="none"/>
    <!--
    http：用于定义相关权限控制
    auto-config：是否自动配置
        设置为true时框架会提供默认的一些配置，例如提供默认的登录页面、登出处理等
        设置为false时需要显示提供登录表单配置，否则会报错
	use-expressions：用于指定intercept-url中的access属性是否使用SPEL表达式-->
    <security:http auto-config="true" use-expressions="false">
		<!--intercept-url: 指定哪些资源不需要进行权限校验，可以使用通配符-->
        <!-- 配置资源连接，访问任何资源，都需要拥有ROLE_USER或者ROLE_ADMIN任意一个角色 -->
        <security:intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN"/>

        <!--登录：
        1. login-page 自定义登录页url,默认为/login
        2. login-processing-url form表单提交时指定的action
        3. default-target-url 默认登录成功后跳转的url
        4. authentication-failure-url 登录失败后跳转的url
        5. username-parameter 用户名的请求字段 默认为userName
        6. password-parameter 密码的请求字段 默认为password-->
        <security:form-login login-page="/login.jsp"
                             login-processing-url="/login" username-parameter="username"
                             password-parameter="password"
                             authentication-failure-url="/fail.jsp"
                             default-target-url="/index.jsp" />
        <!-- 登出：
         invalidate-session 是否删除session
         logout-url：登出处理链接
         logout-success-url：登出成功页面
         注：登出操作 只需要链接到 logout即可登出当前用户 -->
        <security:logout invalidate-session="true" logout-url="/logout"
                         logout-success-url="/login.jsp"/>
        <!-- 关闭CSRF,默认是开启的 跨域攻击-->
        <!--csrf：对应CsrfFilter过滤器
        disabled：是否启用CsrfFilter过滤器，如果使用自定义登录页面需要关闭此项，
        否则登录操作会被禁用（403）
        (自定义登录页面,,框架认为我们的页面不安全,
        需要关闭验证过滤器,默认登录页面有隐藏域,_scrf ,如果使用自定义登录页面,
        没有关闭验证过滤器,框架会拒绝访问.)
        -->
        <security:csrf disabled="true"/>
    </security:http>

    <!--authentication-manager：认证管理器，用于处理认证操作-->
    <security:authentication-manager>
        <!--authentication-provider：认证提供者，执行具体的认证逻辑-->
        <security:authentication-provider>
           <!-- user-service：用于获取用户信息，提供给authentication-provider进行认证-->
            <security:user-service>
                <!--自定义用户名密码-->
                <!--
                user：定义用户信息，可以指定用户名、密码、角色，后期可以改为从数据库查询用户信息
                {noop}：表示当前使用的密码为明文
                -->
                <!--{noop}：spring security默认是加密认证，添加此字段表示不加密认证。
				user用户拥有book:add权限和ROLE_USER角色-->
                <security:user name="user" password="{noop}user123"
                               authorities="book:add,ROLE_USER"/>
                <security:user name="admin" password="{noop}admin123"
                               authorities="ROLE_ADMIN"/>
            </security:user-service>
        </security:authentication-provider>
    </security:authentication-manager>

</beans>

2.4 web.xml配置

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
                             http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
         version="4.0">
    <display-name>Archetype Created Web Application</display-name>
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring-security.xml</param-value>
    </context-param>
    <!--
		1. DelegatingFilterProxy用于整合第三方框架
           整合Spring Security时过滤器的名称必须为springSecurityFilterChain，
           否则会抛出NoSuchBeanDefinitionException异常
        2. DelegatingFilterProxy是Spring的Web模块中的一个类，
           它提供了让HTTP请求在到达实际目的地之前通过过滤器的功能。
    -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
</web-app>

2.5 项目结构

2.6 启动tomcat

2.7 访问页面

登录成功后跳转到：http://localhost:8080/ 根路径中，展示的是index.jsp页面：

3. 权限管理

3.1 创建maven的web工程并加入依赖

<properties> 
    <maven.compiler.source>8</maven.compiler.source>  
    <maven.compiler.target>8</maven.compiler.target>  
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <spring.version>5.0.4.RELEASE</spring.version>
    <spring.security.version>5.0.1.RELEASE</spring.security.version>
  </properties>
  <dependencies>
    <dependency>
      <groupId>org.aspectj</groupId>
      <artifactId>aspectjweaver</artifactId>
      <version>1.8.6</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aop</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-core</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-web</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-webmvc</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-context-support</artifactId>
      <version>5.1.6.RELEASE</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-test</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-jdbc</artifactId>
      <version>${spring.version}</version>
    </dependency>

    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
      <version>${spring.security.version}</version>
    </dependency>
    <dependency>
      <groupId>javax.annotation</groupId>
      <artifactId>jsr250-api</artifactId>
      <version>1.0</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
      <version>${spring.security.version}</version>
    </dependency>
    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>javax.servlet-api</artifactId>
      <version>3.1.0</version>
      <scope>provided</scope>
    </dependency>

  </dependencies>
  <build>
    <plugins>
      <!-- java编译插件 -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <configuration>
          <source>1.8</source>
          <target>1.8</target>
          <encoding>UTF-8</encoding>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.tomcat.maven</groupId>
        <artifactId>tomcat7-maven-plugin</artifactId>
        <configuration>
          <!-- 指定端口 -->
          <port>8080</port>
          <!-- 请求路径 -->
          <path>/</path>
        </configuration>
      </plugin>
    </plugins>
  </build>
</project>

3.2 创建springmvc.xml文件

<beans xmlns="http://www.springframework.org/schema/beans"
	   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	   xmlns:context="http://www.springframework.org/schema/context"
	   xmlns:p="http://www.springframework.org/schema/p"
	   xmlns:mvc="http://www.springframework.org/schema/mvc"
	   xmlns:aop="http://www.springframework.org/schema/aop"
	   xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context
		http://www.springframework.org/schema/context/spring-context.xsd
		http://www.springframework.org/schema/mvc
        http://www.springframework.org/schema/mvc/spring-mvc.xsd
        http://www.springframework.org/schema/aop
        http://www.springframework.org/schema/aop/spring-aop.xsd">
	<context:component-scan base-package="com.jz" use-default-filters="false">
		<context:include-filter type="annotation"
								expression="org.springframework.stereotype.Controller"/>
	</context:component-scan>
	<mvc:annotation-driven></mvc:annotation-driven>
	<mvc:default-servlet-handler></mvc:default-servlet-handler>
	<bean id="viewResolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver">
		<property name="prefix" value="/"></property>
		<property name="suffix" value=".jsp"></property>
	</bean>
	<!--
		支持AOP的注解支持，AOP底层使用代理技术
		JDK动态代理，要求必须有接口
		cglib代理，生成子类对象，proxy-target-class="true" 默认使用cglib的方式
	-->
	<aop:aspectj-autoproxy proxy-target-class="true"/>
</beans>

3.3 spring-security.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security.xsd">
    <!-- 配置不过滤的资源（静态资源及登录相关） -->
    <security:http pattern="/login.jsp" security="none"/>
    <security:http pattern="/fail.jsp" security="none"/>
    <security:http pattern="/css/**" security="none"/>
    <security:http pattern="/img/**" security="none"/>
    <security:http pattern="/js/**" security="none"/>
    <!--
    http：用于定义相关权限控制
    auto-config：是否自动配置
        设置为true时框架会提供默认的一些配置，例如提供默认的登录页面、登出处理等
        设置为false时需要显示提供登录表单配置，否则会报错
   use-expressions="false":禁用spEL表达式-->
    <security:http auto-config="true" use-expressions="false">

        <!-- 配置资源连接，访问任何资源，都需要拥有ROLE_USER或者ROLE_ADMIN任意一个角色 -->
        <security:intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN"/>

        <!--登录：
        1. login-page 自定义登录页url,默认为/login
        2. login-processing-url form表单提交时指定的action
        3. default-target-url 默认登录成功后跳转的url
        4. authentication-failure-url 登录失败后跳转的url
        5. username-parameter 用户名的请求字段 默认为userName
        6. password-parameter 密码的请求字段 默认为password-->
        <security:form-login login-page="/login.jsp"
                             login-processing-url="/login" username-parameter="username"
                             password-parameter="password" authentication-failure-url="/fail.jsp"
                             default-target-url="/index.jsp" />
        <!-- 登出：
         invalidate-session 是否删除session
         logout-url：登出处理链接
         logout-success-url：登出成功页面
         注：登出操作 只需要链接到 logout即可登出当前用户 -->
        <security:logout invalidate-session="true" logout-url="/logout"
                         logout-success-url="/login.jsp"/>
        <!-- 关闭CSRF,默认是开启的 跨域攻击-->
        <security:csrf disabled="true"/>
        <!-- 尝试访问没有权限的页面时跳转的页面 -->
        <security:access-denied-handler error-page="/error-noauth.jsp"/>
    </security:http>

    <!--SpringSecurity认证管理器-->
    <security:authentication-manager>
        <security:authentication-provider>
            <security:user-service>
                <!--自定义用户名密码-->
                <!--{noop}：spring security默认是加密认证，添加此字段表示不加密认证。-->
                <security:user name="user" password="{noop}user123"
                               authorities="book:add,ROLE_USER"/>
                <security:user name="admin" password="{noop}admin123"
                               authorities="ROLE_ADMIN"/>
            </security:user-service>
        </security:authentication-provider>
    </security:authentication-manager>

    <!--开启jsr250注解-->
    <security:global-method-security jsr250-annotations="enabled"
                                     pre-post-annotations="enabled"
                                     secured-annotations="enabled"/>
</beans>

3.4 创建以下页面

index.jsp (登录成功主页)

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
<span style="color: blue;font-size: 20px">
  【当前登录用户[${sessionScope.SPRING_SECURITY_CONTEXT.authentication.principal.username}]】
</span>
<h1>主页--->登录成功</h1>
  <a href="/logout">退出</a><br/><hr>
  <a href="/book/list">书籍列表</a><br/><hr>
  <a href="/book/add">新增书籍</a><br/><hr>
  <a href="/book/update">书籍用户</a><br/><hr>
  <a href="/book/delete">删除书籍</a><br/><hr>
</body>
</html>

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
    <link rel="icon" href="图标路径;base64,aWNv">
</head>
<body>
    <h1>login.jsp</h1>
    <form action="/login" method="post">
        用户名：<input type="text" name="username" value=""><br>
        密码：<input type="password" name="password" value=""><br>
        <input type="submit" value="登录">
    </form>
</body>
</html>

main.jsp(书籍管理主页)

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
    <h1>书籍管理页面</h1>
    <h2>${msg}</h2>
</body>
</html>

fail.jsp(登录失败页面)

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
    <h1 style="background: hotpink">登录失败</h1>
</body>
</html>

error-noauth.jsp(没有权限跳转页面)

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
    <h1 style="color: red">您无权访问</h1>
</body>
</html>

3.5 创建BookController

package com.jz.controller;
import org.springframework.security.access.annotation.Secured;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
@Controller
@RequestMapping("book")
public class BookController {
    @GetMapping("/list")
    //@PreAuthorize("hasAnyAuthority('book:list')")
    public String bookList(Model model) {
        System.out.println("访问书籍查询界面成功!");
        model.addAttribute("msg","访问书籍查询界面成功!");
        return "main";
    }
    @GetMapping("/add")
    //@PreAuthorize("hasAnyAuthority('book:add','book:insert')")
    public String bookAdd(Model model) {
        System.out.println("访问书籍新增界面成功!");
        model.addAttribute("msg","访问书籍新增界面成功!");
        return "main";
    }
    @GetMapping("/update")
    //必须有book:edit权限才能访问bookUpdate方法
    //@PreAuthorize("hasAnyAuthority('book:edit')")
    public String bookUpdate(Model model) {
        System.out.println("访问书籍修改界面成功!");
        model.addAttribute("msg","访问书籍修改界面成功!");
        return "main";
    }
    @GetMapping("/delete")
    //只要具有"ROLE_USER","ROLE_ADMIN"任意一种角色就可以访问。
    //@Secured({"ROLE_USER", "ROLE_ADMIN"})
    public String bookDelete(Model model) {
        System.out.println("访问书籍删除界面成功!");
        model.addAttribute("msg","访问书籍删除界面成功!");
        return "main";
    }
}

3.6 web.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
                             http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
         version="4.0">

    <display-name>Archetype Created Web Application</display-name>

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring-security.xml</param-value>
    </context-param>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener
        </listener-class>
    </listener>

    <!--
        DelegatingFilterProxy是Spring的Web模块中的一个类，
        它提供了让HTTP请求在到达实际目的地之前通过过滤器的功能。
    -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter>
        <filter-name>encodingFilter</filter-name>
        <filter-class>org.springframework.web.filter.CharacterEncodingFilter
        </filter-class>
    </filter>
    <filter-mapping>
        <filter-name>encodingFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>



    <servlet>
        <servlet-name>dispatcherServlet</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath:springmvc.xml</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>dispatcherServlet</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>
</web-app>

3.7 测试

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-0p78F2Pz-1687834244153)(image/1686296507798.png)]

主页：

权限测试：点击书籍列表由于user用户没有book:list权限所以访问失败：

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-QIlWoTTs-1687834244154)(image/1686296621698.png)]

4. 数据库读取用户、权限、角色信息

由于用户名和密码都是设置的固定的，正常我们应该从数据库读取用户名密码信息；

由于权限角色也是设置的固定的，正常也应该从数据库中读取；下面说一下如何从数据库读取用户名、密码、角色、权限信息；

4.1 表结构

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-IFwQY7dv-1687834244154)(image/1686493595955.png)]

4.2 创建表

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-sARELHbb-1687834244155)(image/1686493657040.png)]

4.3 创建maven的web工程并加入依赖

  <properties> 
    <maven.compiler.source>8</maven.compiler.source>  
    <maven.compiler.target>8</maven.compiler.target>  
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>  
    <spring.version>5.0.4.RELEASE</spring.version>  
    <spring.security.version>5.0.1.RELEASE</spring.security.version> 
  </properties>  
  <dependencies>
    <!--mysql的驱动包-->
    <dependency>
      <groupId>mysql</groupId>
      <artifactId>mysql-connector-java</artifactId>
      <version>5.1.38</version>
    </dependency>
    <!--mybatis核心-->
    <dependency>
      <groupId>org.mybatis</groupId>
      <artifactId>mybatis</artifactId>
      <version>3.4.6</version>
    </dependency>
    <!--spring整合mybatis-->
    <dependency>
      <groupId>org.mybatis</groupId>
      <artifactId>mybatis-spring</artifactId>
      <version>1.3.2</version>
    </dependency>
    <!--加入分页的依赖-->
    <dependency>
      <groupId>com.github.pagehelper</groupId>
      <artifactId>pagehelper</artifactId>
      <version>5.1.10</version>
    </dependency>
    <!--导入C3P0连接池-->
    <dependency>
      <groupId>com.mchange</groupId>
      <artifactId>c3p0</artifactId>
      <version>0.9.5.2</version>
    </dependency>
    <!--junit-->
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <version>4.12</version>
      <scope>test</scope>
    </dependency>
    <!--日志包-->
    <dependency>
      <groupId>log4j</groupId>
      <artifactId>log4j</artifactId>
      <version>1.2.17</version>
    </dependency>

    <dependency>
      <groupId>org.aspectj</groupId>
      <artifactId>aspectjweaver</artifactId>
      <version>1.8.6</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aop</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-core</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-web</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <!--Jackson依赖-->
    <dependency>
      <groupId>com.fasterxml.jackson.core</groupId>
      <artifactId>jackson-databind</artifactId>
      <version>2.9.9</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-webmvc</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-context-support</artifactId>
      <version>5.1.6.RELEASE</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-test</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-jdbc</artifactId>
      <version>${spring.version}</version>
    </dependency>

    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
      <version>${spring.security.version}</version>
    </dependency>
    <dependency>
      <groupId>javax.annotation</groupId>
      <artifactId>jsr250-api</artifactId>
      <version>1.0</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
      <version>${spring.security.version}</version>
    </dependency>
    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>javax.servlet-api</artifactId>
      <version>3.1.0</version>
      <scope>provided</scope>
    </dependency> 
  </dependencies>  
  <build> 
    <plugins> 
      <!-- java编译插件 -->  
      <plugin> 
        <groupId>org.apache.maven.plugins</groupId>  
        <artifactId>maven-compiler-plugin</artifactId>  
        <configuration> 
          <source>1.8</source>  
          <target>1.8</target>  
          <encoding>UTF-8</encoding> 
        </configuration> 
      </plugin>  
      <plugin> 
        <groupId>org.apache.tomcat.maven</groupId>  
        <artifactId>tomcat7-maven-plugin</artifactId>  
        <configuration> 
          <!-- 指定端口 -->  
          <port>8080</port>  
          <!-- 请求路径 -->  
          <path>/</path> 
        </configuration> 
      </plugin> 
    </plugins> 
  </build> 
</project>

4.3 创建实体类

user类：

package com.jz.pojo;
import java.io.Serializable;
public class User implements Serializable {

  private Integer id;
  private String email;
  private String username;
  private String password;
  private String phoneNum;
  private Integer status;//是否可用（1 可用  2不可用）


  public Integer getId() {
    return id;
  }

  public void setId(Integer id) {
    this.id = id;
  }


  public String getEmail() {
    return email;
  }

  public void setEmail(String email) {
    this.email = email;
  }


  public String getUsername() {
    return username;
  }

  public void setUsername(String username) {
    this.username = username;
  }


  public String getPassword() {
    return password;
  }

  public void setPassword(String password) {
    this.password = password;
  }


  public String getPhoneNum() {
    return phoneNum;
  }

  public void setPhoneNum(String phoneNum) {
    this.phoneNum = phoneNum;
  }


  public Integer getStatus() {
    return status;
  }

  public void setStatus(Integer status) {
    this.status = status;
  }

}

Permission类

package com.jz.pojo;


import java.io.Serializable;

public class Permission  implements Serializable {

  private Integer id;
  private String permissionName;
  private String url;


  public Integer getId() {
    return id;
  }

  public void setId(Integer id) {
    this.id = id;
  }


  public String getPermissionName() {
    return permissionName;
  }

  public void setPermissionName(String permissionName) {
    this.permissionName = permissionName;
  }


  public String getUrl() {
    return url;
  }

  public void setUrl(String url) {
    this.url = url;
  }

}

Role类：

package com.jz.pojo;


import java.io.Serializable;

public class Role  implements Serializable {

  private Integer id;
  private String roleName;
  private String roleDesc;


  public Integer getId() {
    return id;
  }

  public void setId(Integer id) {
    this.id = id;
  }


  public String getRoleName() {
    return roleName;
  }

  public void setRoleName(String roleName) {
    this.roleName = roleName;
  }


  public String getRoleDesc() {
    return roleDesc;
  }

  public void setRoleDesc(String roleDesc) {
    this.roleDesc = roleDesc;
  }

}

4.4 mapper接口

UserMapper

package com.jz.mapper;

import com.jz.pojo.User;

public interface UserMapper {
    //登录的方法
    public User getUserByUsernamePassword(String username);
}

RoleMapper

package com.jz.mapper;

import com.jz.pojo.Role;

import java.util.List;

public interface RoleMapper {
    /**
     * 根据用户ID查询角色信息
     * @param userId
     * @return
     */
    List<Role> selectRolesByUserId(Integer userId);

}

PermissionMapper

package com.jz.mapper;

import com.jz.pojo.Permission;

import java.util.List;

public interface PermissionMapper {
    /**
     * 根据用户ID查询权限
     * @param userId
     * @return
     */
    List<Permission> selectPermissionsByUserId(Integer userId);
}

4.5 mapper.xml文件

UserMapper.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.jz.mapper.UserMapper">
    <!--根据用户名和密码查询可用的用户-->
    <select id="getUserByUsernamePassword" resultType="User">
        select * from users where username=#{username}
        and status=1
    </select>
</mapper>

RoleMapper.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.jz.mapper.RoleMapper">
    <select id="selectRolesByUserId" resultType="Role">
        SELECT * FROM role WHERE id
         IN (SELECT r.id FROM role r,users_role ur
             WHERE r.id=ur.roleId AND userId=#{userId})
    </select>
</mapper>

Permission.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.jz.mapper.PermissionMapper">
    <select id="selectPermissionsByUserId" resultType="Permission">
        SELECT * FROM permission WHERE id IN(
        SELECT permissionId FROM role_permission WHERE  roleId IN(
        SELECT roleId  FROM users_role WHERE userId=#{userId}));
    </select>
</mapper>

4.6 权限角色查询的配置类

MyUserDetailsService.java

package com.jz.service;

import com.jz.mapper.PermissionMapper;
import com.jz.mapper.RoleMapper;
import com.jz.mapper.UserMapper;
import com.jz.pojo.Permission;
import com.jz.pojo.Role;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.InternalAuthenticationServiceException;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;

import java.util.ArrayList;
import java.util.List;

@Service("myUserDetailsService")
public class MyUserDetailsService implements UserDetailsService {
    @Autowired
    private UserMapper userMapper;
    @Autowired
    private RoleMapper roleMapper;
    @Autowired
    private PermissionMapper permissionMapper;
    //数据库查询权限角色信息
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //认证用户
      com.jz.pojo.User user= userMapper.getUserByUsernamePassword(username);
        //判断用户名是否存在
        if(user==null){
            throw new UsernameNotFoundException("用户不存在!");
        }
        ArrayList<GrantedAuthority> authorities = new ArrayList<>();
        //用户存在的话查询角色
        List<Role> roles = roleMapper.selectRolesByUserId(user.getId());
        System.out.println("============角色================");
        for (Role role : roles) {
            System.out.println(role.getRoleDesc());
            SimpleGrantedAuthority authority=new
                						SimpleGrantedAuthority(role.getRoleDesc());
            authorities.add(authority);
        }
        //查询权限
        List<Permission> permissions = 
            				permissionMapper.selectPermissionsByUserId(user.getId());
        System.out.println("============权限================");
        for (Permission permission : permissions) {
            System.out.println(permission.getUrl());
            SimpleGrantedAuthority authority=
                				new SimpleGrantedAuthority(permission.getUrl());
            authorities.add(authority);
        }
        return new User(username,user.getPassword(), authorities);
    }
}

4.7 相关配置文件

db.properties

jdbc.driver=com.mysql.jdbc.Driver
jdbc.url=jdbc:mysql://localhost:3306/securitydemo
jdbc.username=root
jdbc.password=1704

applicationContext.xml

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context
		http://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/tx
        http://www.springframework.org/schema/tx/spring-tx.xsd">
	<context:component-scan base-package="com.jz">
		<context:exclude-filter type="annotation"
								expression="org.springframework.stereotype.Controller"/>
	</context:component-scan>
	<!--配置数据源-->
	<context:property-placeholder location="classpath:db.properties"/>
	<bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource">
		<property name="driverClass" value="${jdbc.driver}"></property>
		<property name="jdbcUrl" value="${jdbc.url}"></property>
		<property name="user" value="${jdbc.username}"></property>
		<property name="password" value="${jdbc.password}"></property>
	</bean>
	<!--配置事务控制器-->
	<bean id="transactionManager"
		  class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
		<property name="dataSource" ref="dataSource"></property>
	</bean>
	<!--开启注解事务管理-->
	<tx:annotation-driven transaction-manager="transactionManager"/>
	<!--mybatis相关配置-->
	<bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">
		<!--配置数据源-->
		<property name="dataSource" ref="dataSource"></property>
		<!--加载sql映射文件-->
		<property name="mapperLocations" value="classpath:mappers/*.xml"></property>
		<!--设置别名-->
		<property name="typeAliasesPackage" value="com.jz"></property>
	</bean>
	<bean id="scannerConfigurer"
		  class="org.mybatis.spring.mapper.MapperScannerConfigurer">
		<property name="basePackage" value="com.jz.mapper"></property>
	</bean>
	<!-- 配置加密类 -->
	<bean id="passwordEncoder"
		  class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
</beans>

springmvc.xml

<beans xmlns="http://www.springframework.org/schema/beans"
	   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	   xmlns:context="http://www.springframework.org/schema/context"
	   xmlns:p="http://www.springframework.org/schema/p"
	   xmlns:mvc="http://www.springframework.org/schema/mvc"
	   xmlns:aop="http://www.springframework.org/schema/aop"
	   xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context
		http://www.springframework.org/schema/context/spring-context.xsd
		http://www.springframework.org/schema/mvc
        http://www.springframework.org/schema/mvc/spring-mvc.xsd
        http://www.springframework.org/schema/aop
        http://www.springframework.org/schema/aop/spring-aop.xsd">
	<context:component-scan base-package="com.jz" use-default-filters="false">
		<context:include-filter type="annotation"
								expression="org.springframework.stereotype.Controller"/>
	</context:component-scan>
	<mvc:annotation-driven></mvc:annotation-driven>
	<mvc:default-servlet-handler></mvc:default-servlet-handler>
	<bean id="viewResolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver">
		<property name="prefix" value="/"></property>
		<property name="suffix" value=".jsp"></property>
	</bean>
	<!--
		支持AOP的注解支持，AOP底层使用代理技术
		JDK动态代理，要求必须有接口
		cglib代理，生成子类对象，proxy-target-class="true" 默认使用cglib的方式
	-->
	<aop:aspectj-autoproxy proxy-target-class="true"/>
</beans>

spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security.xsd">


    <!-- 配置不过滤的资源（静态资源及登录相关） -->
    <security:http pattern="/login.jsp" security="none"/>
    <security:http pattern="/fail.jsp" security="none"/>
    <security:http pattern="/css/**" security="none"/>
    <security:http pattern="/img/**" security="none"/>
    <security:http pattern="/plugins/**" security="none"/>
    <!--
    http：用于定义相关权限控制
    auto-config：是否自动配置
        设置为true时框架会提供默认的一些配置，例如提供默认的登录页面、登出处理等
        设置为false时需要显示提供登录表单配置，否则会报错
   use-expressions="false":禁用spEL表达式-->
    <security:http auto-config="true" use-expressions="false">

        <!-- 配置资源连接，访问任何资源，都需要拥有ROLE_USER -->
        <security:intercept-url pattern="/**" access="ROLE_USER"/>

        <!--登录：
        1. login-page 自定义登录页url,默认为/login
        2. login-processing-url form表单提交时指定的action
        3. default-target-url 默认登录成功后跳转的url
        4. authentication-failure-url 登录失败后跳转的url
        5. username-parameter 用户名的请求字段 默认为userName
        6. password-parameter 密码的请求字段 默认为password-->
        <security:form-login login-page="/login.jsp"
                             login-processing-url="/login"
                             username-parameter="username"
                             password-parameter="password"
                             authentication-failure-url="/fail.jsp"
                             default-target-url="/index.jsp"
                             />
        <!-- 登出：
         invalidate-session 是否删除session
         logout-url：登出处理链接
         logout-success-url：登出成功页面
         注：登出操作 只需要链接到 logout即可登出当前用户 -->
        <security:logout invalidate-session="true" logout-url="/logout"
                         logout-success-url="/login.jsp"/>
        <!-- 关闭CSRF,默认是开启的 跨域攻击-->
        <security:csrf disabled="true"/>
        <!-- 尝试访问没有权限的页面时跳转的页面 -->
        <security:access-denied-handler error-page="/error-noauth.jsp"/>
    </security:http>
    <!--认证管理器-->
    <security:authentication-manager>
        <security:authentication-provider user-service-ref="myUserDetailsService">
            <!-- 配置加密的方式 -->
            <security:password-encoder ref="passwordEncoder"/>
        </security:authentication-provider>

    </security:authentication-manager>
    <!--开启jsr250注解-->
    <security:global-method-security jsr250-annotations="enabled"
                                     pre-post-annotations="enabled"
                                     secured-annotations="enabled"/>
</beans>

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
		 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
		 xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
                             http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
		 version="4.0">


	<display-name>Archetype Created Web Application</display-name>

	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>classpath:applicationContext.xml,classpath:spring-security.xml</param-value>
	</context-param>
	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>

	<!--
        DelegatingFilterProxy是Spring的Web模块中的一个类，
        它提供了让HTTP请求在到达实际目的地之前通过过滤器的功能。
    -->
	<filter>
		<filter-name>springSecurityFilterChain</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>springSecurityFilterChain</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<filter>
		<filter-name>encodingFilter</filter-name>
		<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>encodingFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>



	<servlet>
		<servlet-name>dispatcherServlet</servlet-name>
		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
		<init-param>
			<param-name>contextConfigLocation</param-name>
			<param-value>classpath:springmvc.xml</param-value>
		</init-param>
		<load-on-startup>1</load-on-startup>
	</servlet>
	<servlet-mapping>
		<servlet-name>dispatcherServlet</servlet-name>
		<url-pattern>/</url-pattern>
	</servlet-mapping>
</web-app>

4.8 创建页面

index.jsp

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
<span style="color: blue;font-size: 20px">
  【当前登录用户[${sessionScope.SPRING_SECURITY_CONTEXT.authentication.principal.username}]】
</span>
<h1>主页--->登录成功</h1>
  <a href="/logout">退出</a><br/><hr>
  <a href="/book/list">书籍列表</a><br/><hr>
  <a href="/book/add">新增书籍</a><br/><hr>
  <a href="/book/update">书籍修改</a><br/><hr>
  <a href="/book/delete">删除书籍</a><br/><hr>
</body>
</html>

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
    <link rel="icon" href="图标路径;base64,aWNv"/>
</head>
<body>
    <h1>login.jsp</h1>
    <form action="/login" method="post">
        用户名：<input type="text" name="username" value=""><br>
        密码：<input type="password" name="password" value=""><br>
        <input type="submit" value="登录">
    </form>
</body>
</html>

fail.jsp(登录失败页面)

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
    <h1 style="background: hotpink">登录失败</h1>
</body>
</html>

error-noauth.jsp(没有权限页面)

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
    <h1 style="color: red">您无权访问</h1>
</body>
</html>

main.jsp

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
    <h1>书籍管理页面</h1>
    <h2>${msg}</h2>
</body>
</html>

4.9 创建controller

package com.jz.controller;
import org.springframework.security.access.annotation.Secured;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
@RequestMapping("book")
public class BookController {
    @GetMapping("/list")
    @PreAuthorize("hasAnyAuthority('book:list')")
    public String bookList(Model model) {
        System.out.println("访问书籍查询界面成功!");
        model.addAttribute("msg","访问书籍查询界面成功!");
        return "main";
    }
    @GetMapping("/add")
    @PreAuthorize("hasAnyAuthority('book:add','book:insert')")
    public String bookAdd(Model model) {
        System.out.println("访问书籍新增界面成功!");
        model.addAttribute("msg","访问书籍新增界面成功!");
        return "main";
    }
    @GetMapping("/update")
    //必须有book:edit权限才能访问bookUpdate方法
    @PreAuthorize("hasAnyAuthority('book:edit')")
    public String bookUpdate(Model model) {
        System.out.println("访问书籍修改界面成功!");
        model.addAttribute("msg","访问书籍修改界面成功!");
        return "main";
    }
    @GetMapping("/delete")
    //只要具有"ROLE_USER","ROLE_ADMIN"任意一种角色就可以访问。
    @Secured({"ROLE_USER", "ROLE_ADMIN"})
    public String bookDelete(Model model) {
        System.out.println("访问书籍删除界面成功!");
        model.addAttribute("msg","访问书籍删除界面成功!");
        return "main";
    }
}

5.1 项目结构

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-GawiOlgH-1687834244156)(image/1686498532587.png)]

5.2 ssm整合springsecurity流程

1. 加入依赖包
2. 创建包结构（pojo、mapper、service、controller）
3. spring整合springmvc（springmvc.xml、applicationContext.xml）
4. 在web.xml文件中配置spring监听器、前端控制器、解决中文乱码的过滤器、DelegatingFilterProxy
5. spring整合mybatis（db.properties指定数据源,applicationContext.xml文件中配置整合mybatis）
6. 创建securitydemo数据库和表
7. 创建表对应的实体类
8. 创建实体类对应的mapper接口和xml文件
9. 在mapper接口和xml文件中写用户查询、角色查询、权限查询
10. 自定义认证管理器类：MyUserDetailsService（查询用户、角色、权限）进行认证
11. 创建spring-security.xml文件配置认证和授权
12. 创建BookController和一些jsp页面进行测试

5. 获取当前登陆了用户的方式

https://www.freesion.com/article/79481159731/

6. springsecurity认证流程

https://blog.csdn.net/msq16021/article/details/126143791

做技术我是认真的

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
SpringSecurity整合ssm

SpringSecurity1. SpringSecurity 框架简介Spring 是非常流行和成功的 Java 应用开发框架，Spring Security 正是 Spring 家族中的成员。Spring Security 基于 Spring 框架，提供了一套 Web 应用安全性的完整解决方案。正如你可能知道的关于安全方面的两个主要区域是“认证”和“授权”（或者访问控制），一般来说，Web 应用的安全性包括用户认证（Authentication）和用户授权 **（Authorization）
复制链接

扫一扫

专栏目录