SpringSecurity拦截请求和登录实例

拼搏现实的明天。 2022-01-09 11:53 306阅读 0赞

**1. 配置pom.xml**

<?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
        <parent>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-parent</artifactId>
            <version>2.1.6.RELEASE</version>
            <relativePath/> 
        </parent>
        <groupId>com.chenbin</groupId>
        <artifactId>securitydemo</artifactId>
        <version>0.0.1-SNAPSHOT</version>
        <packaging>war</packaging>
        <name>securitydemo</name>
        <description>Demo project for Spring Boot</description>
    
        <properties>
            <java.version>1.8</java.version>
        </properties>
    
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
        </dependencies>
    
        <build>
            <plugins>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                </plugin>
            </plugins>
        </build>
    
    </project>

**2. 新建SpringSecurityConfig类**  
（1）public void configure(WebSecurity web) throws Exception【该方法配置哪些路径可以被访问】，如下：

@Override
        public void configure(WebSecurity web) throws Exception {
            web.ignoring().antMatchers("/js/**","/css/**","/images/**");
        }

（2）protected void configure(HttpSecurity http)【该方法配置Http请求规则】，如下：

@Override
        protected void configure(HttpSecurity http) throws Exception {
            //http请求验证匹配规则（antMatchers）都通过(permitAll)，
            // 其它(anyRequest)都验证(authenticated)，and登出(logout)允许(permitAll)，and表单登录。
            http.authorizeRequests()
                    .antMatchers("/").permitAll()
                    .anyRequest().authenticated()
                    .and()
                    .logout().permitAll()
                    .and()
                    .formLogin();
            http.csrf().disable();
        }

（3）protected void configure(AuthenticationManagerBuilder auth)【该方法指定一个账号，赋予一个角色，该账号可以登录通过】（较简单的登录）：

@Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("admin").password(new BCryptPasswordEncoder().encode("123456")).roles("ADMIN");
        }

完整代码：

package com.chenbin.securitydemo;
    
    
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.builders.WebSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    
    @Configuration
    @EnableWebSecurity
    public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
    
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("admin").password(new BCryptPasswordEncoder().encode("123456")).roles("ADMIN");
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            //http请求验证匹配规则（antMatchers）都通过(permitAll)，
            // 其它(anyRequest)都验证(authenticated)，and登出(logout)允许(permitAll)，and表单登录。
            http.authorizeRequests()
                    .antMatchers("/").permitAll()
                    .anyRequest().authenticated()
                    .and()
                    .logout().permitAll()
                    .and()
                    .formLogin();
            http.csrf().disable();
        }
    
        @Override
        public void configure(WebSecurity web) throws Exception {
            web.ignoring().antMatchers("/js/**","/css/**","/images/**");
        }
    }

**4. 在Application主类中添加Controller,包含"/“和”/hello"路径，以此判断SpringSecurity是否生效。**

package com.chenbin.securitydemo;
    
    import org.springframework.boot.SpringApplication;
    import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
    import org.springframework.boot.autoconfigure.SpringBootApplication;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    import java.util.List;
    
    @SpringBootApplication
    @RestController
    @MapperScan( basePackages = {"com.chenbin.securitydemo.mappertest"})
    public class SecuritydemoApplication {
        public static void main(String[] args) {
            SpringApplication.run(SecuritydemoApplication.class, args);
        }
    
    
        @RequestMapping("/")
        public String index(){
            return "hello spring boot";
        }
    
    
        @RequestMapping("/hello")
        public String hello(){
            return "hello页面，已登录！";
        }
    }

**5. 访问http://localhost:8080可以成功，访问http://localhost:8080/hello需要登录，输入admin,123456可以登录成功，证明配置正确，代码无误。**