Spring Security笔记

Shiro、Spring Security

快速上手 Spring Security

1、创建 Maven ⼯程，pom.xml

<parent>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-parent</artifactId>
 <version>2.1.5.RELEASE</version>
</parent>
<dependencies>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-web</artifactId>
 </dependency>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-thymeleaf</artifactId>
 </dependency>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-security</artifactId>
 </dependency>
</dependencies>

2、创建 Handler

package com.southwind.controller;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
@Controller
public class HelloHandler {
 @GetMapping("/index")
 public String index(){
 return "index";
 }
}

3、创建 HTML

<!DOCTYPE html>
<html lang="en">
<head>
 <meta charset="UTF-8">
 <title>Title</title>
</head>
<body>
 <h1>Hello World</h1>
</body>
</html>

4、创建 application.yml

spring:
 thymeleaf:
 prefix: classpath:/templates/
 suffix: .htm

5、创建启动类 Application

package com.southwind.controller;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
public class Application {
 public static void main(String[] args) {
 SpringApplication.run(Application.class,args);
 }
}

6、设置自定义密码

spring:
  thymeleaf:
    prefix: classpath:/templates/
    suffix: .html
  security:
    user:
      name: admin
      password: 123123

权限管理

定义两个 HTML 资源：index.html、admin.html，同时定义两个⻆⾊ ADMIN 和 USER，ADMIN 拥有 访问 index.html 和 admin.html 的权限，USER 只有访问 index.html 的权限。

7、创建 SecurityConfig 类

package com.southwind.config;
import org.springframework.context.annotation.Configuration;
import
org.springframework.security.config.annotation.authentication.builders.Authent
icationManagerBuilder;
import
org.springframework.security.config.annotation.web.builders.HttpSecurity;
import
org.springframework.security.config.annotation.web.configuration.EnableWebSecu
rity;
import
org.springframework.security.config.annotation.web.configuration.WebSecurityCo
nfigurerAdapter;
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
 @Override
 protected void configure(AuthenticationManagerBuilder auth) throws
Exception {
 auth.inMemoryAuthentication().passwordEncoder(new MyPasswordEncoder())
 .withUser("user").password(new
MyPasswordEncoder().encode("000")).roles("USER")
 .and()
 .withUser("admin").password(new
MyPasswordEncoder().encode("123")).roles("ADMIN","USER");
 }
 @Override
 protected void configure(HttpSecurity http) throws Exception {
 http.authorizeRequests().antMatchers("/admin").hasRole("ADMIN")
 .antMatchers("/index").access("hasRole('ADMIN') or
hasRole('USER')")
 .anyRequest().authenticated()
 .and()
 .formLogin()
 .loginPage("/login")
 .permitAll()
 .and()
 .logout()
 .permitAll()
 .and()
 .csrf()
 .disable();
                               }
 }

8、修改Handler

package com.southwind.controller;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
@Controller
public class HelloHandler {
 @GetMapping("/index")
 public String index(){
 return "index";
 }
 @GetMapping("/admin")
 public String admin(){
 return "admin";
 }
 @GetMapping("/login")
 public String login(){
 return "login";
 }
}

9、login.html

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<html lang="en">
<head>
 <meta charset="UTF-8">
 <title>Title</title>
</head>
<body>
 <form th:action="@{/login}" method="post">
 ⽤户名：<input type="text" name="username"/><br/>
 密码：<input type="text" name="password"/><br/>
 <input type="submit" value="登录"/>
 </form>
    </body>
    </html>

10、admin.html

<!DOCTYPE html>
<html lang="en">
<head>
 <meta charset="UTF-8">
 <title>Title</title>
</head>
<body>
 <h1>后台管理系统</h1>
 <form action="/logout" method="post">
 <input type="submit" value="退出"/>
 </form>
</body>
</html>
posted @ 2023-02-20 10:44  njly  阅读(27)  评论(0)    收藏  举报