⒈添加starter依赖
1 <dependency> 2 <groupId>org.springframework.boot</groupId> 3 <artifactId>spring-boot-starter-web</artifactId> 4 </dependency> 5 6 <dependency> 7 <groupId>org.springframework.boot</groupId> 8 <artifactId>spring-boot-starter-security</artifactId> 9 </dependency> 10 11 <dependency> 12 <groupId>org.springframework.boot</groupId> 13 <artifactId>spring-boot-starter-thymeleaf</artifactId> 14 </dependency> 15 16 <!--添加Thymeleaf Spring Security依赖--> 17 <dependency> 18 <groupId>org.thymeleaf.extras</groupId> 19 <artifactId>thymeleaf-extras-springsecurity4</artifactId> 20 <version>3.0.4.RELEASE</version> 21 </dependency>
⒉使用配置类定义授权与定义规则
1 package cn.coreqi.config; 2 3 import org.springframework.context.annotation.Configuration; 4 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; 5 import org.springframework.security.config.annotation.web.builders.HttpSecurity; 6 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; 7 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; 8 9 //@Configuration 10 @EnableWebSecurity 11 public class SecurityConfig extends WebSecurityConfigurerAdapter { 12 13 //定义授权规则 14 @Override 15 protected void configure(HttpSecurity http) throws Exception { 16 //定制请求授权规则 17 http.authorizeRequests() 18 .antMatchers("/css/**","/js/**","/fonts/**","index").permitAll() //不拦截，直接访问 19 .antMatchers("/vip1/**").hasRole("VIP1") 20 .antMatchers("/vip2/**").hasRole("VIP2") 21 .antMatchers("/vip3/**").hasRole("VIP3"); 22 //开启登陆功能（自动配置） 23 //如果没有登陆就会来到/login（自动生成）登陆页面 24 //如果登陆失败就会重定向到/login?error 25 //默认post形式的/login代表处理登陆 26 http.formLogin().loginPage("/userLogin").failureUrl("/login-error"); 27 //开启自动配置的注销功能 28 //访问/logout表示用户注销，清空session 29 //注销成功会返回/login?logout页面 30 //logoutSuccessUrl()设置注销成功后跳转的页面地址 31 http.logout().logoutSuccessUrl("/"); 32 //开启记住我功能 33 //登陆成功以后，将cookie发给浏览器保存，以后访问页面带上这个cookie，只要通过检查就可以免登陆 34 //点击注销会删除cookie 35 http.rememberMe(); 36 } 37 38 //定义认证规则 39 @Override 40 protected void configure(AuthenticationManagerBuilder auth) throws Exception { 41 //jdbcAuthentication() 在JDBC中查找用户 42 //inMemoryAuthentication() 在内存中查找用户 43 44 auth.inMemoryAuthentication().withUser("fanqi").password("admin").roles("VIP1","VIP2","VIP3") 45 .and() 46 .withUser("zhangsan").password("123456").roles("VIP1"); 47 } 48 }
⒊编写控制器类（略）
⒋编写相关页面
1 <!DOCTYPE html> 2 <html lang="en" 3 xmlns:th="http://www.thymeleaf.org" 4 xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" 5 xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4"> 6 <head> 7 <meta charset="UTF-8"> 8 <title>登录页面</title> 9 </head> 10 <body> 11 <div sec:authorize="isAuthenticated()"> 12 <p>用户已登录</p> 13 <p>登录的用户名为：<span sec:authentication="name"></span></p> 14 <p>用户角色为：<span sec:authentication="principal.authorities"></span></p> 15 </div> 16 <div sec:authorize="isAnonymous()"> 17 <p>用户未登录</p> 18 </div> 19 </body> 20 </html>