Spring Security简单总结

最新推荐文章于 2024-07-07 20:23:20 发布

quincy

最新推荐文章于 2024-07-07 20:23:20 发布

阅读量210

点赞数

分类专栏：听课记录

本文链接：https://blog.csdn.net/quincy/article/details/105152977

版权

听课记录专栏收录该内容

10 篇文章 0 订阅

订阅专栏

Spring Security是一个基于Filter的安全框架，用于处理HTTP请求的认证和授权。它通过Request Matching来决定过滤器链的适用性。配置包括引入依赖、设置自定义规则以及授权逻辑。在实际应用中，需要启用Web安全配置，并根据需求定制规则。

摘要由CSDN通过智能技术生成

技术原理

Spring security 就是一个filter,然后又把request 分发给spring security内部注册的filters.

Note：Request Matching for Dispatch and Authorization

A security filter chain (or equivalently a WebSecurityConfigurerAdapter) has a request matcher that is used for deciding whether to apply it to an HTTP request. Once the decision is made to apply a particular filter chain, no others are applied. But within a filter chain you can have more fine grained control of authorization by setting additional matchers in the HttpSecurity configurer

使用步骤：

引入依赖

<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity5</artifactId>
    <!--<version>3.0.4.RELEASE</version>-->
</dependency>
<!-- 导入依赖  -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

配置相关文件，

就是配置自己rule认证跟授权规则，后面稍微解释。
测试代码编写

配置自己网站的rule 认证跟授权规则

// 适配器模式 不影响原来业务代码的情况下，实现了动态增加功能！
@Configuration
@Order(SecurityProperties.BASIC_AUTH_ORDER - 10)
public class ApplicationConfigurerAdapter extends WebSecurityConfigurerAdapter {
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.antMatcher("/foo/**")
     ...;
  }
}

@EnableWebSecurity 可能应该也是需要的，然后根据网站的跳转逻辑添加自己的规则。

参考文档

https://spring.io/guides/topicals/spring-security-architecture

https://docs.spring.io/spring-security/site/docs/5.3.1.BUILD-SNAPSHOT/reference/html5/#modules

https://www.thymeleaf.org/doc/articles/springsecurity.html