spring security

spring security

依赖

    org.springframework.boot
    spring-boot-starter-security

用户认证和授权

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //所有人都能访问首页,有对应权限的人才能访问功能页
        //请求授权的规则
        http.authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/level1/**").hasRole("vip1")
                .antMatchers("/level2/**").hasRole("vip2")
                .antMatchers("/level3/**").hasRole("vip3");

        //没有权限,默认回到登陆页面
        http.formLogin();
        //开启注销,回到指定页面
        http.logout().logoutSuccessUrl("/");
        //开启记住用户
        http.rememberMe().rememberMeParameter("remember");
    }

    //认证
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                .withUser("abc").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1", "vip2")
                .and()
                .withUser("root").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1", "vip2", "vip3");
    }
}

使用数据库认证

@Autowired
private DataSource dataSource;

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    // ensure the passwords are encoded properly
    UserBuilder users = User.withDefaultPasswordEncoder();
    auth
        .jdbcAuthentication()
            .dataSource(dataSource)
            .withDefaultSchema()
            .withUser(users.username("user").password("password").roles("USER"))
            .withUser(users.username("admin").password("password").roles("USER","ADMIN"));
}

注销与权限控制

依赖

    org.thymeleaf.extras
    thymeleaf-extras-springsecurity5
    3.0.4.RELEASE

首页

    
    

        
             登录
        
    

    
    

        
            用户名: 
            权限: 
        
    
    

        
             注销
        
    

按权限展示

sec:authorize="hasRole('vip1')"

记住账户和首页定制

登录页

 记住我