1. pom.xml中设置
1.1 pom.xml设置打包方式为war
<packaging>war</packaging>
1.2引入依赖(Tomcat7插件可以不用)
<dependencies>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>5.0.5.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>5.0.5.RELEASE</version>
</dependency>
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>servlet-api</artifactId>
<version>2.5</version>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.apache.tomcat.maven</groupId>
<artifactId>tomcat7-maven-plugin</artifactId>
<configuration>
<port>8080</port>
<path>/</path>
</configuration>
</plugin>
</plugins>
</build>
2.web.xml配置
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://java.sun.com/xml/ns/javaee"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
version="2.5">
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring-security.xml</param-value>
</context-param>
<listener>
<listener-class>
org.springframework.web.context.ContextLoaderListener
</listener-class>
</listener>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
</web-app>
此时spring-security.xml显红
3.resources下创建spring-security.xml文件
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
<!--拦截页面规则-->
<http>
<!--没有ROLE_ADMIN角色就会被拦截所有资源访问-->
<intercept-url pattern="/**" access="hasAnyRole('ROLE_ADMIN')"/>
<!--登录-->
<form-login/>
<!--退出-->
<logout/>
</http>
<!--认证管理器-->
<authentication-manager>
<authentication-provider>
<user-service>
<!--配置登录名称为admin 密码不加密为123 拥有ROLE_ADMIN角色的权限-->
<user name="admin" password="{noop}123" authorities="ROLE_ADMIN"/>
</user-service>
</authentication-provider>
</authentication-manager>
</beans:beans>
4.创建一个页面并启动tomcat
4.1创建页面 略
4.2启动tomcat
4.2.1访问网页 自动跳转到/login并输入
4.2.2有时会弹出404 无视重新输入创建的网页
登录成功 跳转到创建的页面
5 spring-security.xml重新配置
5.1由于springSecurity自动创建的登录页面比较差指定网页
<!--登录
login-page 指定登录页面
default-target-url 指定跳转成功页面
authentication-failure-url 指定登录失败页面-->
<form-login
login-page="/login.html"
default-target-url="/success.html"
authentication-failure-url="/login_error.html"/>
由于之前配置的<intercept-url pattern="/**" access="hasRole('ROLE_ADMIN')"/>
没登录默认拦截所有资源,须配置放行指定的资源文件
5.1.2 放行指定资源
<http pattern="/login.html" security="none"/>
<http pattern="login_error.html" security="none"/>
5.1.3创建login.htm login_error.html success.html页面
login.html中action必须为/login 提交方式post name属性必须有username和password
<form action="/login" method="post">
<table>
<tr>
<td>用户名</td>
<td><input type="text" name="username"></td>
</tr>
<tr>
<td>密码</td>
<td><input type="text" name="password"></td>
</tr>
</table>
<input type="submit" value="登录">
</form>
5.1.4启动tomcat
访问 localhost:8080/success.html
5.1.4.1此时会自动跳转到自定义的login页面
5.1.4.2登录 提示403
5.1.4.3
由于springsecurity创建的表单带有一个隐藏域证,而自定义的页面提交没有
此时需要关闭掉验证
srping-security.xml中添加csrf标签
<!--拦截页面规则-->
<http>
<!--拦截-->
<intercept-url pattern="/**" access="hasRole('ROLE_ADMIN')"/>
<!--登录
login-page指定登录页面
default-target-url指定跳转成功页面
authentication-failure-url指定登录失败页面-->
<form-login
login-page="/login.html"
default-target-url="/success.html"
authentication-failure-url="/login_error.html"/>
<!--退出-->
<logout/>
<!--关闭csrf验证-->
<csrf disabled="true"/>
</http>
此时登录 成功
6 使用bcrypt加密策略
6.1 下载将BCrypt.java文件移动到项目中
6.1.1 创建BcryptDemo测试
public class BcryptDemo {
public static void main(String[] args) {
//获取盐
String gensalt = BCrypt.gensalt();
System.out.println(gensalt);
//使用盐加密123
String pw = BCrypt.hashpw("123", gensalt);
System.out.println(pw);
//判断123是否与加密后的密码相等
boolean checkpw = BCrypt.checkpw("123", pw);
System.out.println(checkpw);
}
}
运行
6.2 springSecurity配置
6.2.1加密方式一
将加密后的密码在user-service中使用
<authentication-manager>
<authentication-provider>
<user-service>
<user name="admin" password="{bcrypt}$2a$10$AS4KhUXju2vY0djQMNrTiO7mY9Td67wmKYGH27dL8MD0./K38u3D6" authorities="ROLE_ADMIN"/>
</user-service>
</authentication-provider>
</authentication-manager>
password大括号中常用的
1. {noop} 不使用加密策略
2. {bcrypt} 使用bcrypt加密策略
3. {md5} 使用md5加密策略
此时重新运行tomcat登录 成功
6.2.2加密方式二
6.2.2.1 创建一个java类实现UserDetailsService
com.demo.service.impl.UserDetailsServiceImpl
6.2.2.2 重写未实现的方法
public class UserDetailsServiceImpl implements UserDetailsService {
public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
List<GrantedAuthority> grantedAuthorityList = new ArrayList<GrantedAuthority>();
// 添加输入的用户名s的权限 实际是从数据库中读取
grantedAuthorityList.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
// 不限制用户名 只要密码是123就让登陆
return new User(s, "$2a$10$AS4KhUXju2vY0djQMNrTiO7mY9Td67wmKYGH27dL8MD0./K38u3D6", grantedAuthorityList);
}
}
6.2.2.3 spring-security.xml配置
<authentication-manager>
<authentication-provider user-service-ref="UserDetailsService">
<!--使用Bcrypt加密-->
<password-encoder ref="Bcrypt"/>
</authentication-provider>
</authentication-manager>
<beans:bean id="UserDetailsService" class="com.demo.service.impl.UserDetailsServiceImpl"/>
<beans:bean id="Bcrypt" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
重启tomcat登录 成功!
最终spring-security.xml配置文件
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
<!--放行指定资源-->
<http pattern="/login.html" security="none"/>
<http pattern="/login_error.html" security="none"/>
<!--拦截页面规则-->
<http>
<!--拦截-->
<intercept-url pattern="/**" access="hasRole('ROLE_ADMIN')"/>
<!--登录
login-page指定登录页面
default-target-url指定跳转成功页面
authentication-failure-url指定登录失败页面-->
<form-login
login-page="/login.html"
default-target-url="/success.html"
authentication-failure-url="/login_error.html"/>
<!--退出-->
<logout/>
<!--关闭csrf验证-->
<csrf disabled="true"/>
</http>
<!--认证管理器-->
<authentication-manager>
<authentication-provider user-service-ref="UserDetailsService">
<!--使用Bcrypt加密-->
<password-encoder ref="Bcrypt"/>
</authentication-provider>
</authentication-manager>
<beans:bean id="UserDetailsService" class="com.demo.service.impl.UserDetailsServiceImpl"/>
<beans:bean id="Bcrypt" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
</beans:beans>