springMvc的安全登录验证

本是古典何须时尚 2022-04-12 11:17 276阅读 0赞

## 原文：https://blog.csdn.net/qq\_38662236/article/details/84101352 ##

## 1. 引入springMvc权限框架security ##

### 1-1 配置web.xml ###

> 1. 在监听器上引入权限局框架的配置文件security.xml  <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <context-param> <param-name>contextConfigLocation</param-name> <param-value>classpath:applicationContext.xml,classpath:security.xml</param-value> </context-param> 注意 ：<param-value>标签可以配置多个配置文件，一般用逗号隔开 2. 配置过滤器  <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/\*</url-pattern> </filter-mapping> 注意：filter权限框架执行链要放在解决乱码的CharacterEncodingFilter过滤器下面，否则会出现中文乱码

###    **1-2 配置security框架的xml文件security.xml** ###

> <?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">  <security:http pattern="/login.jsp" security="none"></security:http> <security:http pattern="/failer.jsp" security="none"></security:http> <security:http pattern="/css/\*\*" security="none"></security:http> <security:http pattern="/img/\*\*" security="none"></security:http> <security:http pattern="/plugins/\*\*" security="none"></security:http> <security:http pattern="/pages/\*\*" security="none"></security:http>  <security:http auto-config="true" use-expressions="true">  <security:remember-me user-service-ref="userService" key="rememberUser"></security:remember-me>  <security:intercept-url pattern="/\*\*" access="hasAnyRole('ROLE\_USER','ROLE\_ORDER','ROLE\_ADMIN','ROLE\_PRODUCT')"></security:intercept-url>  <security:form-login login-page="/login.jsp" login-processing-url="/login" default-target-url="/index.jsp" authentication-failure-url="/failer.jsp"></security:form-login>  <security:logout logout-url="/logout" logout-success-url="/login.jsp" invalidate-session="true"></security:logout>  <security:access-denied-handler error-page="/403.jsp"></security:access-denied-handler>  <security:csrf disabled="true"></security:csrf> </security:http>  <security:authentication-manager> <security:authentication-provider user-service-ref="userService">  <security:password-encoder ref="pwdEncoder"></security:password-encoder> </security:authentication-provider> </security:authentication-manager> <security:global-method-security secured-annotations="enabled"></security:global-method-security>  <bean id="pwdEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"></bean> </beans>

### **2. 权限验证类UserService的编写** ###

> @Service("userService") @Transactional public class userServiceImpl implements UserService ,UserDetailsService \{ @Autowired private UserDao userDao; @Autowired BCryptPasswordEncoder pwdEncoder; @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException \{ // 通过用户名得到数据库用户对象 SysUser sysUser = userDao.findUserByName(username); // 创建用户的权限集合 List<GrantedAuthority> authorities = new ArrayList<>(); // 查询到用户的角色验证登录 List<Role> userRoles = sysUser.getRoles(); // 循环添加用户的角色信息 if (userRoles.size()>0 && userRoles != null) \{ for (Role userRole : userRoles) \{ // 初始化赋值给用户角色 authorities.add(new SimpleGrantedAuthority(userRole.getRoleName())); \} \} // 使用数据库用户组装框架需要的user对象用于验证 User user = new User(sysUser.getUsername(), sysUser.getPassword(), authorities); return user; // 返回值user带有用户名username，密码password和角色即权限authorties，返回的user是UserDetails 对象，由框架获取操纵 \} /\*\* 添加一个用户，密码使用BCryptPasswordEncoder 加密，由于在security.xml配置了加密方式，所以登录框架帮你解密，不用管 login.jsp登录的form表单提交到在security.xml已经配置好了的"$\{pageContext.request.contextPath\}/login" \*/ @Override public void addUser(SysUser user) \{ //将原始密码获取 String pwd = user.getPassword(); //将明文加密 user.setPassword( pwdEncoder.encode(pwd)); userDao.addUser(user); \}  
>

## 3.权限的控制 ##

### 3-1.页面权限的控制 ###

> 1.引入标签库 <%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %> 2.表达式验证 <security:authorize access="hasRole('ROLE\_ADMIN')"> // 要被权限框架控制的代码 </security:authorize> 例如： <security:authorize access="hasAnyRole('ROLE\_ADMIN')">  <li id="system-setting4"> <a href="$\{pageContext.request.contextPath\}/pages/syslog-list.jsp"> <i class="fa fa-circle-o"></i> 访问日志 </a></li> </security:authorize> 3.security.xml文件中开启表达式支持 // use-expressions="true" 就是开启表达式支持，完整的上面的security有 <security:http auto-config="true" use-expressions="true"> <security:intercept-url pattern="/\*\*" access="hasAnyRole('ROLE\_USER','ROLE\_ORDER','ROLE\_ADMIN','ROLE\_PRODUCT')"> </security:intercept-url>  
>

### 3-2 .后台代码权限控制 ###

> 在页面配置的权限管理后虽然对没有权限的访问者予以限制，但是仍然可以通过在浏览器地址栏上访问路径，所以使用后台权限控制尤为主要 通过三种注解实现权限的拦截： 1.jsr250的方式实现拦截 jsr是java的一个规范 jsr250是对规范的实现 目的是拦截验证权限 引入依赖 <dependency> <groupId>javax.annotation</groupId> <artifactId>jsr250-api</artifactId> <version>1.0</version> </dependency> 在配置文件中开启注解支持 为了拦截controller方法配置springMvc中 约束文件和命名空间 xmlns:security="http://www.springframework.org/schema/security" http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd <security:global-method-security jsr250-annotations="enabled"/> 在需要拦截的类或者方法上通过表达式拦截认证 @RolesAllowed("ROLE\_ADMIN") 2.secured 注解拦截 <security:global-method-security secured-annotations="enabled"/> @Secured("ROLE\_ADMIN") 3.表达式的注解拦截 <security:global-method-security pre-post-annotations="enabled"/> @PreAuthorize("hasRole('ROLE\_ADMIN')") 注意： 1、三种方式都必须在springMvc.xml配置文件中开启注解支持  <aop:aspectj-autoproxy proxy-target-class="true"/> 2、推荐使用第二种，次之第三种，不推荐第一种方式，太麻烦了  
>

## ##

###      ###