Spring Security在Spring Boot中的讲解与实战（附源码）

た入场券 2023-09-30 16:18 61阅读 0赞

> ### **觉得有帮助请点赞关注收藏~~~** ###

## 一、什么是Spring Security ##

Spring Security是一个专门针对Spring应用系统的安全框架，充分利用了Spring框架的依赖注入和AOP功能，为Spring应用系统提供安全访问控制解决方案。

在Spring Security安全框架中，有两个重要概念。一个是授权(authorization)，另一个是认证(ahtuentication)。授权即确定用户在当前应用系统下所拥有的功能权限。认证即确认用户访问当前系统的身份

## 二、Spring Security的基本使用 ##

1：适配器

Spring Security为Web应用提供了一个适配器类WebSecurityConfigurerAdapter 该类实现了WebSecurityConfigurer<WebSecurity>接口，并提供了两个configure方法用于认证和授权操作

2：用户认证

使用AuthenticationManagerBuilder的inMemoryAuthentication()方法可以添加在内存中的用户，并给用户 指定角色权限

3：请求授权

常用方法如下

![8ce7f5ce4c694ed5b39ab1ce7dc9af3b.png][]

## 三、Spring Boot对Spring Security的支持 ##

在Spring Boot应用中 只需引入spring-boot-starter-security依赖即可使用Spring Security安全框架，这是因为Spring Boot对Spring Security提供了自动配置功能。

接下来通过使用基于Spring Data JPA的Spring Security安全框架来进行实战

### 1：修改pom.xml文件 添加以下内容 ###

<dependency>
    
    <groupId>mysql</groupId>
    
    <artifactId>mysql-connector-java</artifactId>
    
    <version>5.1.45</version>
    
    </dependency>

### 2：配置application.properties文件 ###

server.servlet.context-path=/ch7_1
    ###
    ##数据源信息配置
    ###
    #数据库地址
    spring.datasource.url=jdbc:mysql://localhost:3306/springbootjpa?characterEncoding=utf8
    #数据库用户名
    spring.datasource.username=root
    #数据库密码
    spring.datasource.password=root
    #数据库驱动
    spring.datasource.driver-class-name=com.mysql.jdbc.Driver
    ####
    #JPA持久化配置
    ####
    #指定数据库类型
    spring.jpa.database=MYSQL
    #指定是否在日志中显示SQL语句
    spring.jpa.show-sql=true
    #指定自动创建、更新数据库表等配置，update表示如果数据库中存在持久化类对应的表就不创建，不存在就创建对应的表
    spring.jpa.hibernate.ddl-auto=update
    #让控制器输出的JSON字符串格式更美观
    spring.jackson.serialization.indent-output=true 
    spring.thymeleaf.cache=false
    logging.level.org.springframework.security=trace

### 3：创建用户和权限 持久化的实体类 ###

用户代码如下

package com.ch.ch7_1.entity;
    import java.io.Serializable;
    import java.util.List;
    import javax.persistence.CascadeType;
    import javax.persistence.Entity;
    import javax.persistence.FetchType;
    import javax.persistence.GeneratedValue;
    import javax.persistence.GenerationType;
    import javax.persistence.Id;
    import javax.persistence.JoinColumn;
    import javax.persistence.JoinTable;
    import javax.persistence.ManyToMany;
    import javax.persistence.Table;
    import javax.persistence.Transient;
    import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
    @Entity
    @Table(name = "user")
    @JsonIgnoreProperties(value = { "hibernateLazyInitializer"})
    public class MyUser implements Serializable{
    	private static final long serialVersionUID = 1L;
      	@Id
        @GeneratedValue(strategy = GenerationType.IDENTITY)
        private int id;
        private String username;
        private String password; 
        //这里不能是懒加载lazy，否则在MyUserSecurityService的loadUserByUsername方法中获得不到权限
        @ManyToMany(cascade = {CascadeType.REFRESH}, fetch = FetchType.EAGER)
        @JoinTable(name = "user_authority",joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "authority_id"))
        private List<Authority> authorityList;
        
        //repassword不映射到数据表
        @Transient
        private String repassword;
    	public int getId() {
    		return id;
    	}
    	public void setId(int id) {
    		this.id = id;
    	}
    	public String getUsername() {
    		return username;
    	}
    	public void setUsername(String username) {
    		this.username = username;
    	}
    	public String getPassword() {
    		return password;
    	}
    	public void setPassword(String password) {
    		this.password = password;
    	}
    	public List<Authority> getAuthorityList() {
    		return authorityList;
    	}
    	public void setAuthorityList(List<Authority> authorityList) {
    		this.authorityList = authorityList;
    	}
    	public String getRepassword() {
    		return repassword;
    	}
    	public void setRepassword(String repassword) {
    		this.repassword = repassword;
    	}
    }

权限代码如下

package com.ch.ch7_1.entity;
    import java.io.Serializable;
    import java.util.List;
    import javax.persistence.Column;
    import javax.persistence.Entity;
    import javax.persistence.GeneratedValue;
    import javax.persistence.GenerationType;
    import javax.persistence.Id;
    import javax.persistence.ManyToMany;
    import javax.persistence.Table;
    import com.fasterxml.jackson.annotation.JsonIgnore;
    import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
    @Entity
    @Table(name = "authority")
    @JsonIgnoreProperties(value = { "hibernateLazyInitializer"})
    public class Authority implements Serializable{
    	private static final long serialVersionUID = 1L;
        @Id
        @GeneratedValue(strategy = GenerationType.IDENTITY)
        private int id;
        @Column(nullable = false)
        private String name;
        @ManyToMany(mappedBy = "authorityList")
        @JsonIgnore
        private List<MyUser> userList;
    	public int getId() {
    		return id;
    	}
    	public void setId(int id) {
    		this.id = id;
    	}
    	public String getName() {
    		return name;
    	}
    	public void setName(String name) {
    		this.name = name;
    	}
    	public List<MyUser> getUserList() {
    		return userList;
    	}
    	public void setUserList(List<MyUser> userList) {
    		this.userList = userList;
    	}
    }

### 4：创建数据访问层接口 ###

package com.ch.ch7_1.repository;
    import org.springframework.data.jpa.repository.JpaRepository;
    import com.ch.ch7_1.entity.MyUser;
    public interface MyUserRepository extends JpaRepository<MyUser, Integer>{
    	//根据用户名查询用户，方法名命名符合Spring Data JPA规范
    	MyUser findByUsername(String username);
    }

### 5：创建业务层 ###

接口代码如下

package com.ch.ch7_1.service;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import org.springframework.ui.Model;
    import com.ch.ch7_1.entity.MyUser;
    public interface UserService {
    	public String register(MyUser userDomain);
    	public String loginSuccess(Model model);
    	public String main(Model model);
    	public String deniedAccess(Model model);
    	public String logout(HttpServletRequest request, HttpServletResponse response);
    }

实现类代码如下

package com.ch.ch7_1.service;
    import java.util.ArrayList;
    import java.util.List;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
    import org.springframework.stereotype.Service;
    import org.springframework.ui.Model;
    import com.ch.ch7_1.entity.Authority;
    import com.ch.ch7_1.entity.MyUser;
    import com.ch.ch7_1.repository.MyUserRepository;
    @Service
    public class UserServiceImpl implements UserService{
    	@Autowired
    	private MyUserRepository myUserRepository;
    	/**
    	 * 实现注册
    	 */
    	@Override
    	public String register(MyUser userDomain) {
    		String username = userDomain.getUsername();
    		List<Authority> authorityList = new ArrayList<Authority>();
    		//管理员权限
    		if("admin".equals(username)) {
    			Authority a1 = new Authority();
    			Authority a2 = new Authority();
    			a1.setId(1);
    			a1.setName("ROLE_ADMIN");
    			a2.setId(2);
    			a2.setName("ROLE_DBA");
    			authorityList.add(a1);
    			authorityList.add(a2);
    		}else {//用户权限
    			Authority a1 = new Authority();
    			a1.setId(3);
    			a1.setName("ROLE_USER");
    			authorityList.add(a1);
    		}
    		userDomain.setAuthorityList(authorityList);
    		//加密密码
    		String secret  = new BCryptPasswordEncoder().encode(userDomain.getPassword());
    		userDomain.setPassword(secret);
    		MyUser mu = myUserRepository.save(userDomain);
    		if(mu != null)//注册成功
    			return "/login";
    		return "/register";//注册失败
    	}
    	/**
    	 * 用户登录成功
    	 */
    	@Override
    	public String loginSuccess(Model model) {
    		model.addAttribute("user", getUname());
    		model.addAttribute("role", getAuthorities());
    		return "/user/loginSuccess";
    	}
    	/**
    	 * 管理员登录成功
    	 */
    	@Override
    	public String main(Model model) {
    		model.addAttribute("user", getUname());
    		model.addAttribute("role", getAuthorities());
    		return "/admin/main";
    	}
    	/**
    	 * 注销用户
    	 */
    	@Override
    	public String logout(HttpServletRequest request, HttpServletResponse response) {
    		//获得用户认证信息
    		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    		if(authentication != null) {
    			//注销
    			new SecurityContextLogoutHandler().logout(request, response, authentication);
    		}
    		return "redirect:/login?logout";
    	}
    	/**
    	 * 没有权限拒绝访问
    	 */
    	@Override
    	public String deniedAccess(Model model) {
    		model.addAttribute("user", getUname());
    		model.addAttribute("role", getAuthorities());
    		return "deniedAccess";
    	}
    	/**
    	 * 获得当前用户名称
    	 */
    	private String getUname() {
    		return SecurityContextHolder.getContext().getAuthentication().getName();
    	}
    	/**
    	 * 获得当前用户权限
    	 */
    	private String getAuthorities() {
    		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    		List<String> roles = new ArrayList<String>();
    		for (GrantedAuthority ga : authentication.getAuthorities()) {
    			roles.add(ga.getAuthority());
    		}
    		return roles.toString();
    	}
    }

> **此处代码太多 需要源码请点赞关注收藏后评论区留言或私信博主**

### 6：创建控制器类 ###

### 7：创建应用的安全控制相关实现 ###

### 8：创建用于测试的视图页面 ###

页面效果如下

登录首页

![0cce224a6c99459a8e6a1dc82721a5e3.png][]

拒绝访问页面

![f85cfb944b6442aaa063f998e88e6e52.png][]

用户登录界面

![0554bba8d67d4aba87a7d10db5091fd9.png][]

用户注册界面

![fb5d0e7c268946b9a1049b8878088e89.png][]

[8ce7f5ce4c694ed5b39ab1ce7dc9af3b.png]: https://img-blog.csdnimg.cn/8ce7f5ce4c694ed5b39ab1ce7dc9af3b.png
[0cce224a6c99459a8e6a1dc82721a5e3.png]: https://img-blog.csdnimg.cn/0cce224a6c99459a8e6a1dc82721a5e3.png
[f85cfb944b6442aaa063f998e88e6e52.png]: https://img-blog.csdnimg.cn/f85cfb944b6442aaa063f998e88e6e52.png
[0554bba8d67d4aba87a7d10db5091fd9.png]: https://img-blog.csdnimg.cn/0554bba8d67d4aba87a7d10db5091fd9.png
[fb5d0e7c268946b9a1049b8878088e89.png]: https://img-blog.csdnimg.cn/fb5d0e7c268946b9a1049b8878088e89.png