SpringSecurity笔记整理

yicj

已于 2024-09-01 16:14:59 修改

阅读量334

点赞数 7

文章标签：笔记 spring

于 2024-09-01 16:13:11 首次发布

本文链接：https://blog.csdn.net/yichengjie_c/article/details/141785810

版权

                    
                        
                    
                    自定义登录页面 
编写登录页面<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="https://www.thymeleaf.org">
<head>
    <title>Please Log In</title>
</head>
<body>
<h1>Please Log In</h1>
<form th:action="@{/login}" method="post">
    <div>
        <input type="text" name="username" placeholder="Username"/>
    </div>
    <div>
        <input type="password" name="password" placeholder="Password"/>
    </div>
    <input type="submit" value="Log in" />
</form>
</body>
</html>
 
编写LoginController@Controller
public class LoginController {
    @GetMapping("/login")
    public String login(){
        return "login" ;
    }
}
 
配置SpringSecurityhttp.formLogin(form -> form
    .loginPage("/login")
    .permitAll()
)
 
 
自定义AuthenticationManager 
方式一 Publish AuthenticationManager@EnableWebSecurity
public class SecurityConfig {
   @Bean
   public AuthenticationManager authenticationManager(
           UserDetailsService userDetailsService,
           PasswordEncoder passwordEncoder) {
      DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
      authenticationProvider.setUserDetailsService(userDetailsService);
      authenticationProvider.setPasswordEncoder(passwordEncoder);
      //
      ProviderManager providerManager = new ProviderManager(authenticationProvider);
      providerManager.setEraseCredentialsAfterAuthentication(false);
      //
      return providerManager;
   }
}
 
方式二 Configure global AuthenticationManagerBuilder@EnableWebSecurity
public class SecurityConfig {

   @Autowired
   public void configure(AuthenticationManagerBuilder builder) {
 	builder.eraseCredentials(false);
   }
}
 
 
Controller 自定义登录方法 
配置登录 http.authorizeHttpRequests(authorize -> authorize
       .requestMatchers(HttpMethod.POST,"/user/login").permitAll()
       .anyRequest().authenticated()
   )
 
编写登录方法 @PostMapping("/login")
 public Authentication login(@RequestBody LoginRequest loginRequest, HttpServletRequest request, HttpServletResponse response){
     //
     SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder.getContextHolderStrategy();
     //
     UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken.unauthenticated(
             loginRequest.username(), loginRequest.password());
     Authentication authentication = authenticationManager.authenticate(token);
     //
     SecurityContext context = securityContextHolderStrategy.createEmptyContext();
     context.setAuthentication(authentication);
     securityContextHolderStrategy.setContext(context);
     securityContextRepository.saveContext(context, request, response);
     return authentication ;
 }
 
注意如果启用了formLogin则Controller中的login地址不能是/login, 否则登录会被UsernamePasswordAuthenticationFilter拦截

                

yicj

关注

7
点赞
踩
10

收藏

觉得还不错? 一键收藏
0
评论
SpringSecurity笔记整理

编写登录页面 form方式一 Publish AuthenticationManager@EnableWebSecurity@Bean////方式二 Configure global AuthenticationManagerBuilder@EnableWebSecurity@Autowired。
复制链接

扫一扫