Spring Security 6使用数据库存储用户权限

1. 创建表

• 在默认设置下，Spring Security 使用两张表来存储用户信息，创建它们的SQL命令（以MySQL 位为例）如下：

create table users(
      id int not null auto_increment,
      username varchar(50) not null,
      password varchar(500) not null,
      enabled int not null,
      primary key(id)
);
create table authorities(
   id int not null auto_increment,
   username varchar(50) not null,
   authority varchar(50) not null,
   primary key(id)
);

2.添加现目依赖

• 添加jdbc

 <dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-jdbc</artifactId>
 </dependency>

• 添加mysql

<dependency>
  <groupId>com.mysql</groupId>
  <artifactId>mysql-connector-j</artifactId>
</dependency>

3.配置JDBC

• 配置数据源(application.properties)。（实际情况下，应该用脚本的形式注入，避免数据库泄露.）

spring.datasource.url=jdbc:mysql://localhost:3303/new_security
spring.datasource.username=root
spring.datasource.password=123456

4. 配置存取权限

• 新建@configration 修饰的MyWebSecurityConfig的类下配置SecurityFilterChain

 @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(
                requests->{
                    //访问public控制器的请求“放行
                    requests.requestMatchers("/public/**").permitAll();
                    //访问security控制器的请求“需要认证”
                    requests.requestMatchers("/private/**").hasRole("ADMIN");
                }
        );
        http.formLogin(withDefaults());
        http.httpBasic(withDefaults());
        return http.build();
    }

• 直接使用Spring Security 的内置组件

    @Bean
    public UserDetailsService myUserDetailsService(DataSource dataSource) {
        return new JdbcUserDetailsManager(dataSource);

    };
    //为了学习方便，直接使用明文存储密码
    @Bean
    public PasswordEncoder myPasswordEncoder() {
        return NoOpPasswordEncoder.getInstance();
    };