package com.itheima.config; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import com.itheima.service.UserDetailsServiceImpl; import javax.sql.DataSource; @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private DataSource dataSource; @Autowired private UserDetailsServiceImpl userDetailsService; @Override protected void configure(HttpSecurity http) throws Exception { // 自定义用户授权管理 http.authorizeRequests().antMatchers("/").permitAll() // 需要对static文件夹下静态资源进行统一放行 .antMatchers("/login/**").permitAll().antMatchers("/detail/common/**").hasRole("common") .antMatchers("/detail/vip/**").hasRole("vip").anyRequest().authenticated(); // 自定义用户登录控制 http.formLogin().loginPage("/userLogin").permitAll().usernameParameter("name").passwordParameter("pwd") .defaultSuccessUrl("/").failureUrl("/userLogin?error"); // 自定义用户退出控制 http.logout().logoutUrl("/mylogout").logoutSuccessUrl("/"); } @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { // 密码需要设置编码器 BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(); // 1、使用内存用户信息，作为测试使用 // auth.inMemoryAuthentication().passwordEncoder(encoder).withUser("shitou").password(encoder.encode("123456")) // .roles("common").and().withUser("李四").password(encoder.encode("123456")).roles("vip"); // // 2、使用JDBC进行身份认证 // String userSQL = "select username,password,valid from t_customer " + "where username = ?"; // // String authoritySQL = "select c.username,a.authority from t_customer c,t_authority a," // + "t_customer_authority ca where ca.customer_id=c.id " + "and ca.authority_id=a.id and c.username =?"; // // auth.jdbcAuthentication().passwordEncoder(encoder).dataSource(dataSource).usersByUsernameQuery(userSQL) // .authoritiesByUsernameQuery(authoritySQL); // 3、使用UserDetailsService进行身份认证 auth.userDetailsService(userDetailsService).passwordEncoder(encoder); } }
<!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity5"> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>影视直播厅</title> </head> <body> <h1 align="center">欢迎进入电影网站首页</h1> <form th:action="@{/mylogout}" method="post"> <input th:type="submit" th:value="注销" /> </form> <hr> <h3>普通电影</h3> <ul> <li><a th:href="@{/detail/common/1}">我不是药神</a></li> <li><a th:href="@{/detail/common/2}">夏洛特烦恼</a></li> </ul> <h3>VIP专享</h3> <ul> <li><a th:href="@{/detail/vip/1}">速度与激情</a></li> <li><a th:href="@{/detail/vip/2}">猩球崛起</a></li> </ul> </body> </html>