Spring-Security笔记9 自定义登录成功后的处理程序及修改默认验证地址

form-login配置中的authentication-success-handler-ref可以让手动注入登录成功后的处理程序，需要实现AuthenticationSuccessHandler接口。

登录成功之后的相关业务逻辑都可以写这个handler方法中，而不应该在login.do这种方法里写。

login.do应该仅处理验证登录、权限获取。

登录成功之后，使用handler来进行相关业务初始化操作。

先看配置：

自定义的successHandler

package com.fhzz.core.sercurity.handler;

import java.io.IOException;
import java.util.Date;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Propagation;
import org.springframework.transaction.annotation.Transactional;

import com.fhzz.core.sercurity.dao.SysUsersDao;
import com.fhzz.core.sercurity.entity.SysUsers;
import com.fhzz.core.utils.HTTPUtils;

/**
 * @author YangYi
 * 
 */
@Service
public class CustomLoginSuccessHandler implements AuthenticationSuccessHandler {
	Log logger = LogFactory.getLog(CustomLoginSuccessHandler.class);

	@Value("/toIndex.do")
	private String defaultTargetUrl;
	@Autowired
	private SysUsersDao sysUsersDao;

	@Override
	@Transactional(readOnly = false, propagation = Propagation.REQUIRED, rollbackFor = { Exception.class })
	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
			Authentication authentication) throws IOException, ServletException {
		this.saveLoginInfo(request, authentication);
		logger.info("登录成功,即将forward:" + this.defaultTargetUrl);
		// 登录成功之后将SECURITY放入上下文中
		request.setAttribute("SPRING_SECURITY_CONTEXT", SecurityContextHolder.getContext());
		request.getRequestDispatcher(this.defaultTargetUrl).forward(request, response);
	}

	private void saveLoginInfo(HttpServletRequest request, Authentication authentication) {
		SysUsers user = (SysUsers) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
		String ip = HTTPUtils.getIpAddress(request);
		user.setLastLogin(new Date());
		user.setLoginIp(ip);
		logger.info("登录用户:" + user);
		this.sysUsersDao.saveOrUpdateSysUser(user);
	}

}

这个handler 以记录用户登录信息为例，实现了onAuthenticationSuccess方法

实际上这里可以做任何应该与用户一同初始化的工作