springboot整合SpringSecurity

先写了一个配置类

给这个访问路径，加上角色权限

package com.qf.config;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
//AOP :拦截器
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {


    @Override
    //链式编程
    protected void configure(HttpSecurity http) throws Exception {
        //首页所有人可以访问，功能页只有对应有权限的人才能访问
        http.authorizeRequests().antMatchers("/").permitAll()
                .antMatchers("/level1/**").hasRole("vip1")
                .antMatchers("/level2/**").hasRole("vip2")
                .antMatchers("/level3/**").hasRole("vip3");

    }
}

加了登录验证与角色授予

package com.qf.config;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

//AOP :拦截器
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {


    //授权
    @Override
    //链式编程
    protected void configure(HttpSecurity http) throws Exception {
        //首页所有人可以访问，功能页只有对应有权限的人才能访问
        http.authorizeRequests().antMatchers("/").permitAll()
                .antMatchers("/level1/**").hasRole("vip1")
                .antMatchers("/level2/**").hasRole("vip2")
                .antMatchers("/level3/**").hasRole("vip3");

        //没有权限默认会到登录页面,需要开启登录的页面
        //
        http.formLogin();
    }

    //认证，springboot 2.1.x 可以直接使用~
    //密码编码: PasswordEncoder
    //在spring secutiry 5.0+ 新增了很多的加密方法 ~
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        //这些数据正常应该从数据库中读

        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                .withUser("jmj").password(new BCryptPasswordEncoder().encode("123456")).roles("vip2","vip3")
                .and()
                .withUser("root").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2","vip3")
                .and()
                .withUser("guest").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1");
    }
}

 

 

//
http.formLogin();

//注销

http.logout();

     注销

http.formLogin();

//注销

http.logout().logoutSuccessUrl("/");

 登出后重定向到首页

权限控制管理，让用户登录显示用户信息

    
    
    
    
    
    






    

        

            首页

            
            



                
                

                
                     登录
                
                

                
                

                    
                       用户名：
                        角色: 
                    
                

                
                

                    
                         注销
                    
                

                
            
        
    

    

        
Spring Security Study by 秦疆
    

    

        

        

            

                

                    

                        

                            
Level 1
                            

                            
 Level-1-1
                            
 Level-1-2
                            
 Level-1-3
                        
                    
                
            

            

                

                    

                        

                            
Level 2
                            

                            
 Level-2-1
                            
 Level-2-2
                            
 Level-2-3
                        
                    
                
            

            

                

                    

                        

                            
Level 3
                            

                            
 Level-3-1
                            
 Level-3-2
                            
 Level-3-3
                        
                    
                
            

        
    
    

 springsecurity整合thymeleaf

        
            org.thymeleaf.extras
           thymeleaf-extras-springsecurity5
            3.0.4.RELEASE
        

 根据角色来显示页面

    
    
    
    
    
    






    

        

            首页

            
            



                
                

                
                     登录
                
                

                
                

                    
                       用户名：
                        角色: 
                    
                

                
                

                    
                         注销
                    
                

                
            
        
    

    

        
Spring Security Study by 秦疆
    

    

        

        

            

                

                    

                        

                            
Level 1
                            

                            
 Level-1-1
                            
 Level-1-2
                            
 Level-1-3
                        
                    
                
            

            


                

                    

                        

                            
Level 2
                            

                            
 Level-2-1
                            
 Level-2-2
                            
 Level-2-3
                        
                    
                
            

            

                

                    

                        

                            
Level 3
                            

                            
 Level-3-1
                            
 Level-3-2
                            
 Level-3-3
                        
                    
                
            

        
    
    

 

记住我功能

//开启记住我功能 cookie,默认保存两周
http.rememberMe();

 终极配置：绑定自己的登录页面。他其实把数据提交给安全框架，用name绑定，然后提交的时候把表达绑定给security框架的内置网页，让他进行验证

package com.qf.config;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

//AOP :拦截器
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {


    //授权
    @Override
    //链式编程
    protected void configure(HttpSecurity http) throws Exception {
        System.out.println(http);
        //首页所有人可以访问，功能页只有对应有权限的人才能访问
        http.authorizeRequests().antMatchers("/").permitAll()
                .antMatchers("/level1/**").hasRole("vip1")
                .antMatchers("/level2/**").hasRole("vip2")
                .antMatchers("/level3/**").hasRole("vip3");

        //没有权限默认会到登录页面,需要开启登录的页面
        //定制登录页面  //定制登录页面.defaultSuccessUrl("http://www.baidu.com") 默认登录成功进入的页面  为重定向
        http.formLogin().loginPage("/tologin").usernameParameter("user").passwordParameter("pass").loginProcessingUrl("/login");

        //防止跨站攻击
        http.csrf().disable();//登出失败可能的原因
        //注销

        http.logout().logoutSuccessUrl("/");

        //开启记住我功能 cookie,默认保存两周
        http.rememberMe().rememberMeParameter("remember");
    }

    //认证，springboot 2.1.x 可以直接使用~
    //密码编码: PasswordEncoder
    //在spring secutiry 5.0+ 新增了很多的加密方法 ~
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        //这些数据正常应该从数据库中读
        System.out.println(auth);
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                .withUser("jmj").password(new BCryptPasswordEncoder().encode("123456")).roles("vip2","vip3")
                .and()
                .withUser("root").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2","vip3")
                .and()
                .withUser("guest").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1");
    }
}