（一）如何使用Spring-security来实现登录验证功能（XML配置方式）？

先从使用xml的方式来实现用户的权限登录

（1）需要在maven工程中加上关于spring-secutity的jar包的依赖

//spring-securityd 有关的依赖
    <dependency>
            <groupId>org.springframework.securitygroupId>
            <artifactId>spring-security-webartifactId>
        dependency>

        <dependency>
            <groupId>org.springframework.securitygroupId>
            <artifactId>spring-security-configartifactId>
        dependency>

（2）创建一个spirng-security的配置文件

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

    
    <http pattern="/*.html" security="none">http>
    <http pattern="/css/**" security="none">http>
    <http pattern="/img/**" security="none">http>
    <http pattern="/js/**" security="none">http>
    <http pattern="/plugins/**" security="none">http>

    
    <http use-expressions="false" >
        
        <intercept-url pattern="/**" access="ROLE_ADMIN"/>
        
        <form-login  login-page="/login.html" default-target-url="/admin/index.html" authentication-failure-url="/login.html" always-use-default-target="true"/>
        <csrf disabled="true"/>
        <headers>
            <frame-options policy="SAMEORIGIN"/>
        headers>
        <logout/>
    http>


    
    <authentication-manager>
        <authentication-provider>
            <user-service>
            //这个是你配置的可以登录的用户，authorities的值必须是ROLE_XXX的命名方式
                <user name="admin" password="123456" authorities="ROLE_ADMIN"/>
                <user name="sunwukong" password="dasheng" authorities="ROLE_ADMIN"/>
                <user name="wangwei" password="123456" authorities="ROLE_ADMIN"/>
            user-service>
        authentication-provider>  
    authentication-manager>

beans:beans>

（3）还需要在web.xml文件中进行配置一个springSecurityFilterChain的过滤链

    //这里是把（2）步骤中添加的文件进行引用
     <context-param>
        <param-name>contextConfigLocationparam-name>
        <param-value>classpath:spring/spring-security.xmlparam-value>
     context-param>
     <listener>
        <listener-class>
            org.springframework.web.context.ContextLoaderListener
        listener-class>
     listener>
    
     <filter>  
        <filter-name>springSecurityFilterChainfilter-name>  
        <filter-class>org.springframework.web.filter.DelegatingFilterProxyfilter-class>  
     filter>  
     <filter-mapping>  
        <filter-name>springSecurityFilterChainfilter-name>  
        <url-pattern>/*url-pattern>  
     filter-mapping>