2019/07/17工作日志
一、拦截器与过滤器
- 在项目中加入拦截器与过滤器
a)拦截器:拦截的是 action,说白了拦截的是访问路径
b)过滤器:可以几乎过滤掉所有的东西
配置拦截器:interceptor
c)新建拦截器包和类
这一项内容只是进行了初步了解,在过滤器与拦截器完成后为了使用Spring-Security,又将原本已有代码去除。
二、实现权限框架,Spring-Security的使用
目标:
1.完成spring-security的配置以及应用
Spring-security :
理解: 是spring 项目组中 提供 安全认证服务的框架
认证:验证用户密码是否正确的过程
授权:对用户所能访问的资源进行控制
应用步骤:
1. 导架包 – Pom.xml
2. 配置web.xml
3. 新建 Spring-Security.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security.xsd">
<security:global-method-security pre-post-annotations="enabled" jsr250-annotations="enabled" secured-annotations="enabled"></security:global-method-security>
<!-- 配置不拦截的资源 -->
<security:http pattern="/login.jsp" security="none"/>
<security:http pattern="/failer.jsp" security="none"/>
<security:http pattern="/css/**" security="none"/>
<security:http pattern="/img/**" security="none"/>
<security:http pattern="/plugins/**" security="none"/>
<security:http auto-config="true" use-expressions="true">
<!-- 配置具体的拦截的规则 pattern="请求路径的规则" access="访问系统的人,必须有ROLE_USER的角色" -->
<security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')"/>
<security:form-login login-page="/login.jsp"
login-processing-url="/login.do"
default-target-url="/index.jsp"
authentication-failure-url="/failer.jsp"
authentication-success-forward-url="/pages/main.jsp"/>
<!-- 关闭跨域请求 -->
<security:csrf disabled="true"/>
<!--退出并跳转到首页-->
<security:logout invalidate-session="true" logout-url="/logout.do" logout-success-url="/login.jsp"></security:logout>
</security:http>
<!-- 切换成数据库中的用户名和密码 -->
<security:authentication-manager>
<security:authentication-provider user-service-ref="userService">
<!-- 配置加密的方式
<security:password-encoder ref="passwordEncoder"/> -->
</security:authentication-provider>
</security:authentication-manager>
<!-- 配置加密类 -->
<bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
</beans>
4. Web.xml里,加载配置文件
5. UserService继承 UserDeatilsService,
取当前的用户信息
<security:authentication property=“principal.username”></security:authentication>