victory的博客

长安一片月，万户捣衣声

0%

SpringSecurity | 用户认证、授权、注销、权限控制、记住我、首页定制

发表于 更新于 分类于 ， ， ，

SpringSecurity用户认证、授权、注销、权限控制、记住我、首页定制

  • 实现功能：授权不同的用户角色访问不同的模块，如下图所示：

  • 描述

    • 设置三个不同用户角色（victory,root,guest）
    • victory可以访问level2和leve3的内容，root可以访问页面的所有内容，guest只可以访问level1的内容，而且没有权限的模块在该用户登录时不显示。
    • 没有登录时，点击三个模块的内容会跳转到登录页面
    • 记住我功能
    • 首页定制（不使用SpringSecurity默认登录页面，使用自己写的登录页面）

  • 页面

  • 依赖导入

    • 导入thymeleaf依赖
      1
      2
      3
      4
      5
      6
      7
      8
      <dependency>
          <groupId>org.thymeleaf</groupId>
          <artifactId>thymeleaf-spring5</artifactId>
      </dependency>
      <dependency>
          <groupId>org.thymeleaf.extras</groupId>
          <artifactId>thymeleaf-extras-java8time</artifactId>
      </dependency>
    • 导入Web依赖
      1
      2
      3
      4
      <dependency>
          <groupId>org.springframework.boot</groupId>
          <artifactId>spring-boot-starter-web</artifactId>
      </dependency>
    • 导入security依赖
      1
      2
      3
      4
      <dependency>
          <groupId>org.springframework.boot</groupId>
          <artifactId>spring-boot-starter-security</artifactId>
      </dependency>

  • 项目目录

  • 编写RootController映射请求（跳转页面）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
package com.example.controller;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
public class RootController {
    @RequestMapping({"/", "/index"})
    public String index(){
        return "index";
    }

    @RequestMapping("toLogin")
    public String toLogin(){
        return "views/login";
    }

    @RequestMapping("/level1/{id}")
    public String level1(@PathVariable("id") int id){
        return "views/level1/"+id;
    }

    @RequestMapping("/level2/{id}")
    public String level2(@PathVariable("id") int id){
        return "views/level2/"+id;
    }

    @RequestMapping("/level3/{id}")
    public String level3(@PathVariable("id") int id){
        return "views/level3/"+id;
    }
}
  • 编写SecurityConfig配置SpringSecurity
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
package com.example.config;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    //授权
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //首页所有人可以访问，功能页只有对应有权限的人才能访问
        //请求授权的规则
        //链式编程
        http.authorizeHttpRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/level1/**").hasRole("vip1")
                .antMatchers("/level2/**").hasRole("vip2")
                .antMatchers("/level3/**").hasRole("vip3");

        //没有权限默认会跳到登录页面
        http.formLogin();

        //防止网站攻击 get不安全，可以使用post springboot默认开启csrf(注销失败可能的原因)
        http.csrf().disable(); //关闭csrf功能

        //注销，跳到首页
        http.logout().logoutSuccessUrl("/");
    }

    //认证
    //密码编码：PasswordEncoder
    //在Spring Security 5.0+新增了很多加密方法
    //报错 500 密码没有加密
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //这些数据正常应该从数据库中读
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                .withUser("victory").password(new BCryptPasswordEncoder().encode("123")).roles("vip2", "vip3")
                .and()
                .withUser("root").password(new BCryptPasswordEncoder().encode("123")).roles("vip1", "vip2", "vip3")
                .and()
                .withUser("guest").password(new BCryptPasswordEncoder().encode("123")).roles("vip1");
    }
}
  • 权限控制（没有权限的模块在该用户登录时不显示）
    • 导入依赖
      1
      2
      3
      4
      5
      <dependency>
        <groupId>org.thymeleaf.extras</groupId>
        <artifactId>thymeleaf-extras-springsecurity4</artifactId>
        <version>3.0.4.RELEASE</version>
      </dependency>
    • 在页面中导入命名空间
      1
      <html lang="en" xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
    • 在页面中使用thymeleaf-security语法进行权限控制
      1
      2
      3
      4
      5
      6
      7
      8
      9
      10
      11
      12
      13
      14
      15
      16
      17
      18
      19
      20
      21
      22
      23
      24
      25
      26
      27
      28
      29
      30
      31
      32
      33
      34
      35
      36
      37
      38
      39
      40
      41
      42
      43
      44
      45
      46
      47
      48
      49
      50
      51
      52
      53
      54
      55
      56
      57
      58
      59
      60
      61
      62
      63
      64
      65
      66
      67
      68
      69
      70
      71
      72
      73
      74
      75
      76
      77
      78
      79
      80
      81
      82
      83
      84
      85
      86
      87
      88
      89
      90
      91
      92
      93
      94
      95
      96
      97
      98
      99
      <!DOCTYPE html>
      <html lang="en" xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
      <head>
      <meta charset="UTF-8">
      <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
      <title>首页</title>
      <!--semantic-ui-->
      <link href="https://cdn.bootcss.com/semantic-ui/2.4.1/semantic.min.css" rel="stylesheet">
      <link th:href="@{/qinjiang/css/qinstyle.css}" rel="stylesheet">
      </head>
      <body>

      <!--主容器-->
      <div class="ui container">

      <div class="ui segment" id="index-header-nav" th:fragment="nav-menu">
          <div class="ui secondary menu">
              <a class="item"  th:href="@{/index}">首页</a>

              <!--登录注销-->
              <div class="right menu">
                  <!--如果未登录-->
                  <div sec:authorize="!isAuthenticated()">
                      <a class="item" th:href="@{/toLogin}">
                          <i class="address card icon"></i> 登录
                      </a>
                  </div>

                  <!--如果登录：用户名和注销-->
                  <div sec:authorize="isAuthenticated()">
                      <a class="item">
                          用户名：<span sec:authentication="name"></span>
                          <!--角色：<span sec:authentication="principal.getUsername()"></span>-->
                      </a>
                      <a class="item" th:href="@{/logout}">
                          <i class="sign-out icon"></i> 注销
                      </a>
                  </div>
              </div>
          </div>
      </div>

      <div class="ui segment" style="text-align: center">
          <h3>Spring Security Study by 秦疆</h3>
      </div>

      <div>
          <br>
          <div class="ui three column stackable grid">
              <!--根据用户的角色动态的实现-->
              <div class="column" sec:authorize="hasRole('vip1')">
                  <div class="ui raised segment">
                      <div class="ui">
                          <div class="content">
                              <h5 class="content">Level 1</h5>
                              <hr>
                              <div><a th:href="@{/level1/1}"><i class="bullhorn icon"></i> Level-1-1</a></div>
                              <div><a th:href="@{/level1/2}"><i class="bullhorn icon"></i> Level-1-2</a></div>
                              <div><a th:href="@{/level1/3}"><i class="bullhorn icon"></i> Level-1-3</a></div>
                          </div>
                      </div>
                  </div>
              </div>

              <div class="column" sec:authorize="hasRole('vip2')">
                  <div class="ui raised segment">
                      <div class="ui">
                          <div class="content">
                              <h5 class="content">Level 2</h5>
                              <hr>
                              <div><a th:href="@{/level2/1}"><i class="bullhorn icon"></i> Level-2-1</a></div>
                              <div><a th:href="@{/level2/2}"><i class="bullhorn icon"></i> Level-2-2</a></div>
                              <div><a th:href="@{/level2/3}"><i class="bullhorn icon"></i> Level-2-3</a></div>
                          </div>
                      </div>
                  </div>
              </div>

              <div class="column" sec:authorize="hasRole('vip3')">
                  <div class="ui raised segment">
                      <div class="ui">
                          <div class="content">
                              <h5 class="content">Level 3</h5>
                              <hr>
                              <div><a th:href="@{/level3/1}"><i class="bullhorn icon"></i> Level-3-1</a></div>
                              <div><a th:href="@{/level3/2}"><i class="bullhorn icon"></i> Level-3-2</a></div>
                              <div><a th:href="@{/level3/3}"><i class="bullhorn icon"></i> Level-3-3</a></div>
                          </div>
                      </div>
                  </div>
              </div>

          </div>
      </div>
      </div>
      <script th:src="@{/qinjiang/js/jquery-3.1.1.min.js}"></script>
      <script th:src="@{/qinjiang/js/semantic.min.js}"></script>
      </body>
      </html>
    • thymeleaf security整合可能出现的错误
      • thymeleaf security不生效，可以将SpringBoot版本降低到2.0.7.RELEASE
      • 登录后出现WhiteLabel Error Page，Html文件中关于thymeleaf-security的代码有错误
  • 记住我、首页定制
    • 首页定制、记住我
      在configure(HttpSecurity http)方法中添加以下代码即可定制首页
      1
      2
      3
      4
      //formLogin() 默认到登录页面（SpringSecurity自带登录页面）
      //usernameParameter("user") 与自定义登录页面用户名文本框的name属性对应
      //passwordParameter("pwd") 与自定义登录页面密码文本框的name属性对应
      http.formLogin().loginPage("/toLogin").usernameParameter("user").passwordParameter("pwd").loginProcessingUrl("/login");
      在configure(HttpSecurity http)方法中添加以下代码即可实现记住我功能
      1
      2
      //开启记住我功能 cookie,默认保存两周
      http.rememberMe().rememberMeParameter("remember");
    • 页面
      1
      2
      3
      4
      5
      6
      7
      8
      9
      10
      11
      12
      13
      14
      15
      16
      17
      18
      19
      20
      21
      22
      23
      24
      25
      26
      27
      28
      29
      30
      31
      32
      33
      34
      35
      36
      37
      38
      39
      40
      41
      42
      43
      44
      45
      46
      47
      48
      49
      50
      51
      52
      53
      54
      55
      56
      57
      58
      59
      60
      61
      62
      63
      64
      65
      66
      <!DOCTYPE html>
      <html lang="en" xmlns:th="http://www.thymeleaf.org">
      <head>
      <meta charset="UTF-8">
      <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
      <title>登录</title>
      <!--semantic-ui-->
      <link href="https://cdn.bootcss.com/semantic-ui/2.4.1/semantic.min.css" rel="stylesheet">
      </head>
      <body>

      <!--主容器-->
      <div class="ui container">

          <div class="ui segment">

              <div style="text-align: center">
                  <h1 class="header">登录</h1>
              </div>

              <div class="ui placeholder segment">
                  <div class="ui column very relaxed stackable grid">
                      <div class="column">
                          <div class="ui form">
                              <form th:action="@{/login}" method="post">
                                  <div class="field">
                                      <label>Username</label>
                                      <div class="ui left icon input">
                                          <input type="text" placeholder="Username" name="user">
                                          <i class="user icon"></i>
                                      </div>
                                  </div>
                                  <div class="field">
                                      <label>Password</label>
                                      <div class="ui left icon input">
                                          <input type="password" name="pwd">
                                          <i class="lock icon"></i>
                                      </div>
                                  </div>
                                  <div class="field">
                                      <input type="checkbox" name="remember">记住我
                                  </div>
                                  <input type="submit" class="ui blue submit button"/>
                              </form>
                          </div>
                      </div>
                  </div>
              </div>

              <div style="text-align: center">
                  <div class="ui label">
                      </i>注册
                  </div>
                  <br><br>
                  <small>blog.kuangstudy.com</small>
              </div>
              <div class="ui segment" style="text-align: center">
                  <h3>Spring Security Study by 秦疆</h3>
              </div>
          </div>
      </div>

      <script th:src="@{/qinjiang/js/jquery-3.1.1.min.js}"></script>
      <script th:src="@{/qinjiang/js/semantic.min.js}"></script>
      </body>
      </html>