初探SpringSecurity

一、导入核心jar包

<dependency>
          <groupId>org.springframework.security</groupId>
          <artifactId>spring-security-core</artifactId>
</dependency>
  
<dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
</dependency>

<dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
 </dependency>
 
   <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-taglibs</artifactId>
 </dependency>

二、在web.xml中添加核心过滤器

<!-- Spring Security 的过滤配置，表明请求需要经过这个类的过滤和判断 -->
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

三、新建权限的配置文件 applicationContext-security.xml

1.头文件如下

<?xml version="1.0" encoding="UTF-8"?>
<!--suppress ALL -->
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xmlns:context="http://www.springframework.org/schema/context"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/context
       http://www.springframework.org/schema/context/spring-context-4.0.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">       
 </beans:beans>   

2.基本概念

权限=认证和授权

认证=校验用户名或者密码的有效性 密码是加密  密码 加密+加盐

授权=为授权通过的用户设置角色或者资源  ROLE_为前缀都是角色   

权限最基本的表  4张表和5张表

 

3.开始配置applicationContext-security.xml

<http pattern="/login.jsp" security="none"/>  #登录页面
<http pattern="/user/doValidateCode" security="none"/> #验证码的方法
<http pattern="/static/**" security="none"/>  #所有的静态资源
#表示哪些资源不需要做拦截

４.规定所有的资源都需要具有USER角色才能访问  ROLE_USER 

<http auto-config="true">    
<intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>
</http>

５.在http标签里面我们可以配置登录的信息

<http auto-config="true">    
<intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>

   <form-login
                login-page="/login.jsp"  #登录的页面
                login-processing-url="/user/doLogin" #登录页面的请求地址
                default-target-url="index.jsp"  #默认的页面
                username-parameter="username"  #登录页面的用户名的参数
                password-parameter="password"  #登录页面的密码的参数
                authentication-success-handler-ref="successHandler" #登录页面成功之后跳转的类
                authentication-failure-url="/login.jsp" #失败之后跳转的页面
        />
    
    #invalidate-session  清除session
    #logout-url    退出的方法
     <logout invalidate-session="true" logout-url="/user/doLogOut"></logout>  
    
       
    #在测试阶段 我们把它关闭 一般在真实下环境 我们要把防止CSRF跨站攻击给打开
    <http:csrf disabled="true"></http:csrf>
    
    #防止iframe攻击 一般把它关闭掉
    <http:headers disabled="true" defaults-disabled="true"></http:headers>
    
    #定义好/user/doLogOut地址 只要请求该地址 就自动跳转到首页 并且清空Session
    <logout invalidate-session="true" logout-url="/user/doLogOut"></logout>
 </http>




  #认证是我们代码的核心 所有的认证都是由userService这个Bean来实现的
<beans:bean id="cryptPasswordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"></beans:bean>
  

<authentication-manager>
    <authentication-provider user-service-ref="userService">
        <password-encoder ref="cryptPasswordEncoder"></password-encoder>
    </authentication-provider>
  </authentication-manager>

配置好的applicationContext-security.xml如下

<?xml version="1.0" encoding="UTF-8"?>
<!--suppress ALL -->
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xmlns:context="http://www.springframework.org/schema/context"
             xmlns:http="http://www.springframework.org/schema/security"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/context
       http://www.springframework.org/schema/context/spring-context-4.0.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">


  <http pattern="/static/**"  security="none"></http>
  <http pattern="/login.jsp"  security="none"></http>


  <http auto-config="true"  >
    <intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>


    <form-login
            login-page="/login.jsp"
            login-processing-url="/user/doLogin"
            username-parameter="username"
            password-parameter="password"
            authentication-success-handler-ref="successHandler"
            default-target-url="index.jsp"
            authentication-failure-url="/login.jsp"
    ></form-login>

<!--    <http:access-denied-handler error-page="/error/403.jsp"></http:access-denied-handler>-->

   <http:csrf disabled="true"></http:csrf>

    <http:headers disabled="true" defaults-disabled="true"></http:headers>

    <logout invalidate-session="true" logout-url="/user/doLogOut"></logout>
 </http>




<beans:bean id="cryptPasswordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"></beans:bean>


  <authentication-manager>
    <authentication-provider user-service-ref="userService">
     <password-encoder ref="cryptPasswordEncoder"></password-encoder>
    </authentication-provider>
  </authentication-manager>
</beans:beans>

四、Spring配置文件applicationContext.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:aop="http://www.springframework.org/schema/aop"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:p="http://www.springframework.org/schema/p"
       xsi:schemaLocation="
                    http://www.springframework.org/schema/beans
                    http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
                    http://www.springframework.org/schema/tx
                    http://www.springframework.org/schema/tx/spring-tx-4.0.xsd
                    http://www.springframework.org/schema/aop
                    http://www.springframework.org/schema/aop/spring-aop-4.0.xsd
                    http://www.springframework.org/schema/context
                    http://www.springframework.org/schema/context/spring-context-4.0.xsd">

    <context:annotation-config />

    <context:component-scan base-package="com">
       <context:exclude-filter type="annotation" expression="org.springframework.stereotype.Controller"/>
       <context:exclude-filter type="annotation" expression="org.springframework.web.bind.annotation.RestController"/>
    </context:component-scan>

    <bean id="annotationPropertyConfigurerRedis"
          class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
        <property name="order" value="1" />
        <property name="ignoreUnresolvablePlaceholders" value="true" />
        <property name="locations">
            <list>
                 <value>classpath:jdbc.properties</value>

            </list>
        </property>
    </bean>


    <bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource"
          init-method="init" destroy-method="close">
        <property name="driverClassName" value="${db.dirverClass}"></property>
        <property name="url" value="${db.url}" />
        <property name="username" value="${db.username}" />
        <property name="password" value="${db.password}" />

        <property name="initialSize" value="1" />
        <property name="minIdle" value="1" />
        <property name="maxActive" value="20" />

        <property name="maxWait" value="60000" />

        <property name="timeBetweenEvictionRunsMillis" value="60000" />

        <property name="minEvictableIdleTimeMillis" value="300000" />

        <property name="validationQuery" value="SELECT 1" />
        <property name="testWhileIdle" value="true" />
        <property name="testOnBorrow" value="false" />
        <property name="testOnReturn" value="false" />

        <property name="poolPreparedStatements" value="true" />
        <property name="maxPoolPreparedStatementPerConnectionSize"
                  value="20" />

        <property name="filters" value="stat" />
    </bean>


    <bean id="sqlSessionFactoryBean" class="org.mybatis.spring.SqlSessionFactoryBean">
        <property name="dataSource" ref="dataSource"></property>
        <property name="configLocation" value="classpath:mybatis-config.xml"></property>

    </bean>

    <bean id="mapperScannerConfigurer" class="org.mybatis.spring.mapper.MapperScannerConfigurer">
        <property name="basePackage" value="com.blb.mapper"></property>
    </bean>


</beans>

五、SpringMVC配置文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:aop="http://www.springframework.org/schema/aop"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:mvc="http://www.springframework.org/schema/mvc"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:http="http://www.springframework.org/schema/security"
       xmlns:p="http://www.springframework.org/schema/p"
       xsi:schemaLocation="
                    http://www.springframework.org/schema/beans
                    http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
                    http://www.springframework.org/schema/tx
                    http://www.springframework.org/schema/tx/spring-tx-4.0.xsd
                     http://www.springframework.org/schema/security
                    http://www.springframework.org/schema/security/spring-security.xsd
                    http://www.springframework.org/schema/mvc
                    http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd
                    http://www.springframework.org/schema/context
                    http://www.springframework.org/schema/context/spring-context-4.0.xsd">

    <context:annotation-config />

    <context:component-scan base-package="com" use-default-filters="true">
        <context:include-filter  type="annotation" expression="org.springframework.stereotype.Controller"/>
        <context:include-filter  type="annotation" expression="org.springframework.web.bind.annotation.RestController"/>
    </context:component-scan>


    <bean
       class="org.springframework.web.servlet.view.InternalResourceViewResolver">
        <property name="prefix" value="/" ></property>
        <property name="suffix" value=".jsp"></property>
    </bean>


    <mvc:annotation-driven/>





    <http:global-method-security secured-annotations="enabled"  pre-post-annotations="enabled"></http:global-method-security>

     <mvc:default-servlet-handler></mvc:default-servlet-handler>




</beans>

六、Mybatis配置文件

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE configuration PUBLIC "-//mybatis.org//DTD Config 3.0//EN" "http://mybatis.org/dtd/mybatis-3-config.dtd">
<configuration>


</configuration>

七、自定义登录成功后返回的对象

User对象自动存放到UsernamePasswordAuthenticationToken

package com.blb.vo;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.User;

import java.util.Collection;

/**
 * @author Administrator
 * @date 2020/6/15
 */
public class LoginUserVO extends User {
    private String welcome;


    public LoginUserVO(String username, String password, Collection<? extends GrantedAuthority> authorities) {
        super(username, password, authorities);
    }

    public LoginUserVO(String username, String password, boolean enabled, boolean accountNonExpired, boolean credentialsNonExpired, boolean accountNonLocked, Collection<? extends GrantedAuthority> authorities) {
        super(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);
    }

    public LoginUserVO(String username, String password, boolean enabled, boolean accountNonExpired, boolean credentialsNonExpired, boolean accountNonLocked, Collection<? extends GrantedAuthority> authorities,String welcome) {
        super(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);
        this.welcome=welcome;
    }

    public String getWelcome() {
        return welcome;
    }

    public void setWelcome(String welcome) {
        this.welcome = welcome;
    }
}

八、编写登录认证、授权的类

该类需要实现UserDetailsService

package com.blb.service;

import com.blb.vo.LoginUserVO;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import java.util.ArrayList;
import java.util.List;

/**
 * @author Administrator
 * @date 2020/6/15
 */
@Service
public class UserService implements UserDetailsService {

    //认证
    //授权 角色 资源
    //都放在一个方法里面去
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        if(username.equals("zhangsan"))
        {

            List list=new ArrayList<>();
            SimpleGrantedAuthority simpleGrantedAuthority=new SimpleGrantedAuthority("ROLE_USER");
            //SimpleGrantedAuthority simpleGrantedAuthority=new SimpleGrantedAuthority("ROLE_ADMIN");
            SimpleGrantedAuthority simpleGrantedAuthority2=new SimpleGrantedAuthority("USER_DROP");
            list.add(simpleGrantedAuthority);
            list.add(simpleGrantedAuthority2);
            //用户可能不可用
            //用户可能被锁定
            //用户可能被禁用


           // return  new User(username,"123456",list);
          return new LoginUserVO(username,"$2a$10$VFZXFyQShsKv/aAZxtnXlOKBg2Yczw.0CI5fwnc4QsiGWk8ryKahy",true,true,true,true,list);
        }
        return null;
    }
}

九、编写认证成功后的类

package com.blb.handler;

import com.blb.vo.LoginUserVO;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.stereotype.Component;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * @author Administrator
 * @date 2020/6/15
 */
@Component
public class SuccessHandler implements AuthenticationSuccessHandler{
    @Override
    public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {

        LoginUserVO userVO=(LoginUserVO) authentication.getPrincipal();
        userVO.setWelcome("大家听明白没有");

        httpServletRequest.setAttribute("menu","我是一个寂寞的菜单");
        httpServletRequest.getRequestDispatcher("/index.jsp").forward(httpServletRequest,httpServletResponse);

}
}

十、准备好一个常量来判断登录后返回的信息

package com.blb.Contant;

import org.springframework.security.authentication.InternalAuthenticationServiceException;
import org.springframework.security.core.userdetails.UserDetailsService;

/**
 * @author Administrator
 * @date 2020/6/15
 */
public class AuthContant {

    public static final String InternalAuthenticationServiceException ="org.springframework.security.authentication.InternalAuthenticationServiceException: UserDetailsService returned null, which is an interface contract violation";
}

十一、在jsp页面判断

<c:if test="${sessionScope.SPRING_SECURITY_LAST_EXCEPTION eq AuthContant.InternalAuthenticationServiceException}">
      用户名不存在
</c:if>

常见的错误异常如下

用户名不存在:InternalAuthenticationServiceException;
密码错误:BadCredentialException;
帐户被锁:LockedException;
帐户未启动:DisabledException;
密码过期:CredentialExpiredException;等等!

十二、jsp页面处理权限问题(选择性显示与隐藏页面的功能)

引入头文件

<%@taglib prefix="secuity" uri="http://www.springframework.org/security/tags" %>

判断是否有USER_ADD的权限

 <security:authorize access="hasAuthority('USER_ADD')">
        <button class="layui-btn" lay-event="isAll">全选</button>
 </security:authorize>

判断是否ROLE_USER的角色

授权的时候要加上前缀

判断的时候不需要加前缀

<security:authorize access="hasRole('USER')">
   <button class="layui-btn" lay-event="save">新增</button>
</security:authorize>

十三、编写带有权限的Controller方法

package com.blb.controller;

import org.springframework.security.access.annotation.Secured;
import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

/**
 * @author Administrator
 * @date 2020/6/15
 */
@Controller
@RequestMapping("admin")
public class UserController {

   @RequestMapping("add")
   @PreAuthorize("hasAuthority('USER_ADD')")
   public String  add()
   {
       System.out.println("我是添加页面");
       return "user/add";
   }

}

@PreAuthorize("hasAuthority('USER_ADD')")使用该注解的前提是下图的配置必须在springmvc的配置文件中

 <http:global-method-security secured-annotations="enabled"  pre-post-annotations="enabled"></http:global-method-security>

该注解其它的用法：

@PreAuthorize("hasRole('ROLE_ADMIN')")  必须有XXX角色才能访问
@PreAuthorize("hasRole('ROLE_USER') or hasRole('ROLE_ADMIN')")
@PreAuthorize("#id<10")  #id 表示方法的参数就是id
@PreAuthorize("principal.username.equals(#username)")

如果不想使用默认的注解方法，其它例如JSR250

https://www.cnblogs.com/fenglan/p/5913481.html

添加jar包

<dependency>
    <groupId>javax.annotation</groupId>
    <artifactId>jsr250-api</artifactId>
    <version>1.0</version>
</dependency>

@RolesAllowed({"ROLE_USER", "ROLE_ADMIN"}) 必须要有XXX的角色
@PermitAll() 所有人都可以访问该方法
@DenyAll() 谁都不能访问该方法
@Secured("ROLE_ADMIN")  必须要有XXX角色才能访问

十四、在页面上，我们可以使用security:authentication 该标签就表示token，来获取token中的信息

<security:authentication property="principal.username"></security:authentication>