品优购商家登录与安全控制

解决该问题的方案

springsecurity（它是一个企业级的安全框架，并且通过声明式方式实现—配置文件[代替重复的代码工作]）

步骤：

1、编辑web.xml文件：加载springsecurity容器、配置过滤器
2、编写springsecurity核心配置文件：

• 对哪些资源放行或者拦截（静态资源，包括html,css,js,img,plugins,注册和登录页面）
• 配置认证管理器
• 从数据库中查询 — 自定义认证管理器
  3、自定义认证管理器（校验该用户+授权） — 实现接口 UserDetailsService

具体代码

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns="http://java.sun.com/xml/ns/javaee"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
         version="2.5">


  <servlet>
    <servlet-name>shop</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <!-- 指定加载的配置文件 ，通过参数contextConfigLocation加载 -->
    <init-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>classpath:spring/springmvc.xml</param-value>
    </init-param>
    <!--框架随着web容器启动而初始化-->
    <load-on-startup>1</load-on-startup>
  </servlet>

  <servlet-mapping>
    <servlet-name>shop</servlet-name>
    <url-pattern>*.do</url-pattern>
  </servlet-mapping>
  <!-- 解决post乱码 -->
  <filter>
    <filter-name>CharacterEncodingFilter</filter-name>
    <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
    <init-param>
      <param-name>encoding</param-name>
      <param-value>utf-8</param-value>
    </init-param>
    <init-param>
      <param-name>forceEncoding</param-name>
      <param-value>true</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>CharacterEncodingFilter</filter-name>
    <!--下面的代码并不是被注释掉了，只是被这个‘/*’给影响了-->
    /*
  

  
  
    contextConfigLocation
    classpath:spring/spring-security.xml
  
  
    org.springframework.web.context.ContextLoaderListener
  

  
    springSecurityFilterChain
    org.springframework.web.filter.DelegatingFilterProxy
  
  
    springSecurityFilterChain
    /*
  

spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans
        xmlns="http://www.springframework.org/schema/security"
        xmlns:beans="http://www.springframework.org/schema/beans"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xmlns:dubbo="http://code.alibabatech.com/schema/dubbo"
        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
						http://code.alibabatech.com/schema/dubbo http://code.alibabatech.com/schema/dubbo/dubbo.xsd
						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

    <http pattern="/*.html" security="none"/>
    <http pattern="/css/**" security="none"/>
    <http pattern="/img/**" security="none"/>
    <http pattern="/js/**" security="none"/>
    <http pattern="/plugins/**" security="none"/>
    <http pattern="/seller/add.do" security="none"/>

    <!-- use-expressions:设置是否启动SpEL表达式，默认值是true。 -->
    <http use-expressions="false">
        <!--
            配置SpringSecurity的拦截路径（拦截规则）
            * pattern:配置拦截规则。   /* 代表的是根路径下的所有资源（不包含子路径） /**代表的是根路径下所有的资源（包含子路径）
            * access:设置角色  角色命名 ROLE_角色名称  如：  ROLE_USER
        -->
        

        
        

        
        

        
        
            
        

        
        
    

    
    
        
        
            
        
    


    
    
    
    
    
    
    

    
    
        
        
    
    

springSecurity自定义认证类

因为这个实现类是只有在这才会使用，所以就写到web-shop了

package cn.itcast.core.service;

import cn.itcast.core.pojo.seller.Seller;
import cn.itcast.core.service.seller.SellerService;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import java.util.HashSet;
import java.util.Set;

/**
 *springSecurity自定义认证类
 */
public class UserDetailServiceImpl implements UserDetailsService {
     

    private SellerService sellerService;

    public void setSellerService(SellerService sellerService) {
     
        this.sellerService = sellerService;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
     
        Seller seller = sellerService.findOne(username);
        if (seller!=null&&"1".equals(seller.getStatus())){
       // 认证通过
            Set<GrantedAuthority> authorities = new HashSet<>();
            SimpleGrantedAuthority role_seller = new SimpleGrantedAuthority("ROLE_SELLER");
            authorities.add(role_seller);
            // 授权
            User user = new User(username,seller.getPassword(),authorities);
        return user;
        }
        return null;
    }
}