spring security

转自：http://ryanflyer.iteye.com/blog/973319
使用篇

1、建立login.jsp页面.内容如下:
Html代码


Html代码
1.<form action="<%=path %>/j_spring_security_check" method="post">
2. USERNAME:<input type="text" name="j_username" value="${sessionScope['SPRING_SECURITY_LAST_USERNAME']}" /><br/>
3. PASSWORD:<input type="password" name="j_password" value="" /><br/>
4. <input type="checkbox" name="_spring_security_remember_me" />两周之内不必登陆<br/>
5. <input type="submit">
6. </form>
7.
8.<form action="<%=path %>/j_spring_security_check" method="post">
9. USERNAME:<input type="text" name="j_username" value="${sessionScope['SPRING_SECURITY_LAST_USERNAME']}" /><br/>
10. PASSWORD:<input type="password" name="j_password" value="" /><br/>
11. <input type="checkbox" name="_spring_security_remember_me" />两周之内不必登陆<br/>
12. <input type="submit">
13. </form>
<form action="<%=path %>/j_spring_security_check" method="post">
USERNAME:<input type="text" name="j_username" value="${sessionScope['SPRING_SECURITY_LAST_USERNAME']}" /><br/>
PASSWORD:<input type="password" name="j_password" value="" /><br/>
<input type="checkbox" name="_spring_security_remember_me" />两周之内不必登陆<br/>
<input type="submit">
</form>

<form action="<%=path %>/j_spring_security_check" method="post">
USERNAME:<input type="text" name="j_username" value="${sessionScope['SPRING_SECURITY_LAST_USERNAME']}" /><br/>
PASSWORD:<input type="password" name="j_password" value="" /><br/>
<input type="checkbox" name="_spring_security_remember_me" />两周之内不必登陆<br/>
<input type="submit">
</form>
j_spring_security_check : 为security验证中心(不知道怎么说合适.暂时这么理解吧..).
j_username: 验证用户名;
j_password: 验证密码;
${sessionScope['SPRING_SECURITY_LAST_USERNAME']}:使用最后一次登录用户名.
_spring_security_remember_me:记住我...

2、xml配置,配置内容如下:
Xml代码

Xml代码
1.<?xml version="1.0" encoding="UTF-8"?>
2.<beans:beans xmlns="http://www.springframework.org/schema/security"
3. xmlns:beans="http://www.springframework.org/schema/beans"
4. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5. xsi:schemaLocation="http://www.springframework.org/schema/beans
6. http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
7. http://www.springframework.org/schema/security
8. http://www.springframework.org/schema/security/spring-security-3.0.xsd">
9.
10. <!-- auto-config = true 则使用from-login. 如果不使用该属性 则默认为http-basic(没有session).
11. access-denied-page:出错后跳转到的错误页面;
12. -->
13. <http auto-config="true" access-denied-page="/common/403.jsp">
14. <!-- intercept-url:拦截器,可以设定哪些路径需要哪些权限来访问. filters=none 不使用过滤,也可以理解为忽略 -->
15. <intercept-url pattern="/index.jsp" access="ROLE_USER" />
16. <intercept-url pattern="/login.jsp" filters="none" />
17. <intercept-url pattern="/common/**" filters="none" />
18. <intercept-url pattern="/script/**" filters="none" />
19. <intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" />
20. <intercept-url pattern="/user.jsp" access="ROLE_USER" />
21.
22. <!-- session-management是针对session的管理. 这里可以不配置. 如有需求可以配置. -->
23. <!-- id登陆唯一. 后登陆的账号会挤掉第一次登陆的账号 error-if-maximum-exceeded="true" 禁止2次登陆;
24. session-fixation-protection="none" 防止伪造sessionid攻击. 用户登录成功后会销毁用户当前的session.
25. 创建新的session,并把用户信息复制到新session中.
26. -->
27. <session-management session-fixation-protection="none">
28. <concurrency-control/>
29. </session-management>
30.
31. <!-- login-page:默认指定的登录页面. authentication-failure-url:出错后跳转页面. default-target-url:成功登陆后跳转页面 -->
32. <form-login login-page="/login.jsp"
33. authentication-failure-url="/common/403.jsp"
34. default-target-url="/admin.jsp" />
35. <!-- logout-success-url:成功注销后跳转到的页面; -->
36. <logout logout-success-url="/login.jsp"/>
37. <http-basic />
38.
39. </http>