前端的登录页面写完了之后呢,开始写后台的登录接口了,后台的登录接口是用Spring Security写的
一、服务端环境搭建
1、创建一个vhr的spring boot项目,并添加spring web、mysql、mybatis和spring srcurity的依赖
2、在pom文件里面添加mysql的版本号和阿里巴巴的druid连接池依赖
com.alibaba
druid-spring-boot-starter
1.1.10
mysql
mysql-connector-java
runtime
5.1.27
3、要用mybatis逆向工具把实体类和mapper类生成出来,生成的效果如下图所示
4、要在启动类上面加上@MapperScan=@MapperScan(basePackages = "com.lqg.vhr.mapper")
@SpringBootApplication
@MapperScan(basePackages = "com.lqg.vhr.mapper")
public class VhrApplication {
public static void main(String[] args) {
SpringApplication.run(VhrApplication.class, args);
}
}
5、再在pom文件的build标签里面配一个resource,因为我的xml文件是写在mapper包下面,打包的时候有可能会过滤掉,所以要配resource,配置代码如下
src/main/resources
src/main/java
**/*.xml
org.springframework.boot
spring-boot-maven-plugin
6、在application.properties的配置文件里面配置数据库连接属性
spring.datasource.type=com.alibaba.druid.pool.DruidDataSource
spring.datasource.username=root
spring.datasource.password=123456
#如果需要把数据库部署到linux服务器上,需要加上?useUnicode=true&characterEncoding=UTF-8,确保连接传输的时候的编码也是utf-8
spring.datasource.url=jdbc:mysql://localhost:3306/vur?useUnicode=true&characterEncoding=UTF-8
二、服务端登录接口制作(一)
1、在Hr实体类里面实现UserDetails接口并重写它的方法,用Spring Security自定义登录接口的话就需要让hr类实现UserDetails,如下代码
/*** hr* @author*如果我们需要从数据库里面加载用户,那么我们在定义用户的时候就要实现一个接口UserDetails* UserDetails想当于是一个规范,所有人都得实现它,这样的话以后我要获取用户名我就知道就是username,我要获取密码就是password*/
public class Hr implements UserDetails {
/*** hrID*/
private Integer id;
/*** 姓名*/
private String name;
/*** 手机号码*/
private String phone;
/*** 住宅电话*/
private String telephone;
/*** 联系地址*/
private String address;
/*** 是否可用*/
private Boolean enabled;
/*** 用户名*/
private String username;
/*** 密码*/
private String password;
private String userface;
private String remark;
public Integer getId() {
return id;
}
public void setId(Integer id) {
this.id = id;
}
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
public String getPhone() {
return phone;
}
public void setPhone(String phone) {
this.phone = phone;
}
public String getTelephone() {
return telephone;
}
public void setTelephone(String telephone) {
this.telephone = telephone;
}
public String getAddress() {
return address;
}
public void setAddress(String address) {
this.address = address;
}
public void setEnabled(Boolean enabled) {
this.enabled = enabled;
}
@Override
public String getUsername() {
return username;
}
@Override
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public String getUserface() {
return userface;
}
public void setUserface(String userface) {
this.userface = userface;
}
public String getRemark() {
return remark;
}
public void setRemark(String remark) {
this.remark = remark;
}
@Override
public String toString() {
return "Hr{" +
"id=" + id +
", name='" + name + '\'' +
", phone='" + phone + '\'' +
", telephone='" + telephone + '\'' +
", address='" + address + '\'' +
", enabled=" + enabled +
", username='" + username + '\'' +
", password='" + password + '\'' +
", userface='" + userface + '\'' +
", remark='" + remark + '\'' +
'}';
}
/*** 账户是否没有过期* @return*/
@Override
public boolean isAccountNonExpired() {
return true;
}
/*** 账户是否被锁定* @return*/
@Override
public boolean isAccountNonLocked() {
return true;
}
/*** 密码是否没有过期* @return*/
@Override
public boolean isCredentialsNonExpired() {
return true;
}
/*** 是否可用* @return*/
@Override
public boolean isEnabled() {
return enabled;
}
public void setUsername(String username) {
this.username = username;
}
/***返回用户的所有角色* @return*/
@Override
public Collection extends GrantedAuthority> getAuthorities() {
return null;
}
}
2、创建一个service包,并创建一个HrService类,该类实现了UserDetailsService类,并重写了该类的loadUserByUsername方法,把HrMapper用 @Autowired 注解注入进来,详细代码如下:
@Service
public class HrService implements UserDetailsService {
@Autowired
HrMapper hrMapper;
/*** 根据用户名加载user对象* @param username* @return* @throws UsernameNotFoundException*/
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
Hr hr = hrMapper.loadUserByUsername(username);
// 判断用户名是否为空,为空则抛出异常 if (username==null){
throw new UsernameNotFoundException("用户名不存在!");
}
return hr;
}
}
3、在HrMapper接口中添加loadUserByUsername方法,代码如下
@Repository
public interface HrMapper {
int deleteByPrimaryKey(Integer id);
int insert(Hr record);
int insertSelective(Hr record);
Hr selectByPrimaryKey(Integer id);
int updateByPrimaryKeySelective(Hr record);
int updateByPrimaryKey(Hr record);
/*** 通过用户名查找用户* @param username* @return*/
Hr loadUserByUsername(String username);
}
4、在HrMapper.xml文件中加上如下代码
select * from hr where username=#{username}
5、重新创建一个config包,并创建一个SecurityConfig类,该类继承了WebSecurityConfigurerAdapter
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
HrService hrService;
@Bean
PasswordEncoder passwordEncoder(){
return new BCryptPasswordEncoder();
}
//要有一个configure方法吧hrService整进来 @Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(hrService);
}
}
6、创建一个controller包,并创建一个HelloController类,代码如下:
@RestController
public class HelloController {
@GetMapping("/hello")
public String hello(){
return "欢迎进入登录页面!";
}
}
7、登录成功的话,前端是json,前后端分离之后,前端的页面跳转由前端自己去控制,后端只需提供接口,后端只需要返回json数据就行
8、在SecurityConfig里面继续进行配置登录成功或者登录失败向前端传送json数据
①、重写configure方法
@Override
protected void configure(HttpSecurity http) throws Exception {
super.configure(http);
}
②、通过http.authorizeRequests()进行配置其他请求都是登录之后才能访问的、表单登录、修改默认登录的username、password、处理表单登录的url路径、处理表单登录的url路径、
登录成功的处理、登录失败的处理、跟登录相关的接口就能直接访问、注销成功后的回调、
注销成功后的回调
//配置登录成功或者登录失败向前端传送json数据 @Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
//剩下的其他请求都是登录之后就能访问的 .anyRequest().authenticated()
.and()
//表单登录 .formLogin()
//修改默认登录的username .usernameParameter("username")
//修改默认登录的password .passwordParameter("password")
//处理表单登录的url路径 .loginProcessingUrl("/doLogin")
//默认看到的登录页面,如果是前后端分离的话,就不用处理表单登录的url路径 .loginPage("/login")
//登录成功的处理 .successHandler(new AuthenticationSuccessHandler() {
@Override
public void onAuthenticationSuccess(HttpServletRequest req, HttpServletResponse resp, Authentication authentication) throws IOException, ServletException {
//如果登录成功就返回一段json resp.setContentType("application/json;charset=utf-8");
//这是往出写的 PrintWriter out = resp.getWriter();
//登录成功的hr对象 Hr hr = (Hr)authentication.getPrincipal();
RespBean ok = RespBean.ok("登录成功!", hr);
//把hr写成字符串 String s = new ObjectMapper().writeValueAsString(ok);
//把字符串写出去 out.write(s);
out.flush();
out.close();
}
})
//登录失败的处理 .failureHandler(new AuthenticationFailureHandler() {
@Override
public void onAuthenticationFailure(HttpServletRequest req, HttpServletResponse resp, AuthenticationException exception) throws IOException, ServletException {
//如果登录成功就返回一段json resp.setContentType("application/json;charset=utf-8");
//这是往出写的 PrintWriter out = resp.getWriter();
RespBean respBean = RespBean.error("登录失败!");
if(exception instanceof LockedException){
respBean.setMsg("账户被锁定,请联系管理员!");
}else if (exception instanceof CredentialsExpiredException){
respBean.setMsg("密码过期,请联系管理员!");
}else if (exception instanceof AccountExpiredException){
respBean.setMsg("账户过期,请联系管理员!");
}else if (exception instanceof DisabledException){
respBean.setMsg("账户被禁用,请联系管理员!");
}else if (exception instanceof BadCredentialsException){
respBean.setMsg("用户名或者密码输入错误,清联系管理员!");
}
out.write(new ObjectMapper().writeValueAsString(respBean));
out.flush();
out.close();
}
})
//跟登录相关的接口就能直接访问 .permitAll()
.and()
.logout()
//注销成功后的回调 .logoutSuccessHandler(new LogoutSuccessHandler() {
@Override
public void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
}
})
.permitAll()
.and()
//关闭csrf攻击 .csrf().disable();
}
9、通过postman进行测试
访问hello接口,出现404,本来应该出来401的,但是访问hello接口的时候,它发现你没有登录,所以要你去登录页,SecurityConfig类里面没有配置登录页,所以就报404
我再去访问doLogin,访问结果图片如下:
登录成功,再在postman里面测试hello接口
访问成功
三、服务端登录接口制作(一)
1、因为访问hello接口返回的是404,所以要把页面改成返回成json格式的数据,重新创建一个LoginController,代码如下:
@RestController
public class LoginController {
@GetMapping("/login")
public RespBean login(){
return RespBean.error("尚未登录,请登录!")
}
}
2、再把SecurityConfig配置类的注销成功后的回调完善一下,首先设置返回类型为json类型,然后使用resp.getWrite()方法进行输出,代码如下
//注销成功后的回调 .logoutSuccessHandler(new LogoutSuccessHandler() {
@Override
public void onLogoutSuccess(HttpServletRequest req, HttpServletResponse resp, Authentication authentication) throws IOException, ServletException {
resp.setContentType("application/json;charset=utf-8");
PrintWriter out = resp.getWriter();
out.write(new ObjectMapper().writeValueAsString(RespBean.ok("注销成功!")));
out.flush();
out.close();
}
})
SecurityConfig配置类的详细代码如下:
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
HrService hrService;
@Bean
PasswordEncoder passwordEncoder(){
return new BCryptPasswordEncoder();
}
//要有一个configure方法吧hrService整进来 @Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(hrService);
}
//配置登录成功或者登录失败向前端传送json数据 @Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
//剩下的其他请求都是登录之后就能访问的 .anyRequest().authenticated()
.and()
//表单登录 .formLogin()
//修改默认登录的username .usernameParameter("username")
//修改默认登录的password .passwordParameter("password")
//处理表单登录的url路径 .loginProcessingUrl("/doLogin")
//默认看到的登录页面,如果是前后端分离的话,就不用配置登录页面 .loginPage("/login")
//登录成功的处理 .successHandler(new AuthenticationSuccessHandler() {
@Override
public void onAuthenticationSuccess(HttpServletRequest req, HttpServletResponse resp, Authentication authentication) throws IOException, ServletException {
//如果登录成功就返回一段json resp.setContentType("application/json;charset=utf-8");
//这是往出写的 PrintWriter out = resp.getWriter();
//登录成功的hr对象 Hr hr = (Hr)authentication.getPrincipal();
hr.setPassword(null);
RespBean ok = RespBean.ok("登录成功!", hr);
//把hr写成字符串 String s = new ObjectMapper().writeValueAsString(ok);
//把字符串写出去 out.write(s);
out.flush();
out.close();
}
})
//登录失败的处理 .failureHandler(new AuthenticationFailureHandler() {
@Override
public void onAuthenticationFailure(HttpServletRequest req, HttpServletResponse resp, AuthenticationException exception) throws IOException, ServletException {
//如果登录成功就返回一段json resp.setContentType("application/json;charset=utf-8");
//这是往出写的 PrintWriter out = resp.getWriter();
RespBean respBean = RespBean.error("登录失败!");
if(exception instanceof LockedException){
respBean.setMsg("账户被锁定,请联系管理员!");
}else if (exception instanceof CredentialsExpiredException){
respBean.setMsg("密码过期,请联系管理员!");
}else if (exception instanceof AccountExpiredException){
respBean.setMsg("账户过期,请联系管理员!");
}else if (exception instanceof DisabledException){
respBean.setMsg("账户被禁用,请联系管理员!");
}else if (exception instanceof BadCredentialsException){
respBean.setMsg("用户名或者密码输入错误,请重新输入!");
}
out.write(new ObjectMapper().writeValueAsString(respBean));
out.flush();
out.close();
}
})
//跟登录相关的接口就能直接访问 .permitAll()
.and()
.logout()
//注销成功后的回调 .logoutSuccessHandler(new LogoutSuccessHandler() {
@Override
public void onLogoutSuccess(HttpServletRequest req, HttpServletResponse resp, Authentication authentication) throws IOException, ServletException {
resp.setContentType("application/json;charset=utf-8");
PrintWriter out = resp.getWriter();
out.write(new ObjectMapper().writeValueAsString(RespBean.ok("注销成功!")));
out.flush();
out.close();
}
})
.permitAll()
.and()
//关闭csrf攻击 .csrf().disable();
}
}