芯が強い人になるESTJ-A

# 安全框架[SpringSecurity]登陆，授权，认证，前端连调

2021-08-03 IT開発 Tags: 无标签 阅读: 283

SpringSecurity

AOP编程。

有框架，代码不对，横切进入编程。

记住几个类
WebSecurityConfigurerAdapter：自定义安全策略
AuthenticationManagerBuilder:自定义认证策略
@EnableWebSecurity开启WebSecurity模式

Spring security两个目标是认证+授权。
认证：Authentication
授权：Authorizaiton

@Enablexxx开启某个功能

导入包

    <dependencies>
        <!-- 安全模块spring-security-web -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <!-- 引入thymeleaf和springSecurity整合包-->
        <!-- https://mvnrepository.com/artifact/org.thymeleaf.extras/thymeleaf-extras-springsecurity4 -->
        <dependency>
            <groupId>org.thymeleaf.extras</groupId>
            <artifactId>thymeleaf-extras-springsecurity4</artifactId>
            <version>3.0.4.RELEASE</version>
        </dependency>

        <!-- 引入thymeleaf模板引擎-->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <!-- hthymeleaf-extras-springsecurity4 -->
        <dependency>
            <groupId>org.thymeleaf.extras</groupId>
            <artifactId>thymeleaf-extras-springsecurity4</artifactId>
            <version>3.0.4.RELEASE</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

官方固定架子，别倒错包

package com.xuwen.config;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

/**
 * author:xuwen
 * Created on 2021/8/3
 */
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
    }
}

config>securityConfig


package com.xuwen.config;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

/**
 * author:xuwen
 * Created on 2021/8/3
 */
//AOP编程好处，横切
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    //链式编程
    //授权访问页面！！
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //首页，访问权限，所有人
        //请求授权的规则
        http.authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/level1/**").hasRole("vip1")
                .antMatchers("/level2/**").hasRole("vip2")
                .antMatchers("/level3/**").hasRole("vip3");

        //没有权限，默认去登陆页面->开启
        ///login
        http.formLogin().loginPage("/toLogin");
        http.csrf().disable();//关闭放置跨站攻击，登出失败的原因，忘记关闭

        //注销->开启
        http.logout().logoutSuccessUrl("/index");

        //开启记住我功能->本质cookie实现,默认2周
        //自定义接受前端传来的参数
        http.rememberMe().rememberMeParameter("rememberme");

    }

    //认证-->springboot 2.1.x可以直接使用
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //数据，正常应该从数据库中读取，目前测试使用，取自内存
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder() {
        })
                .withUser("kuangshen").password(new BCryptPasswordEncoder().encode("123456")).roles("vip2","vip3")
                .and()
                .withUser("root").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2","vip3");
    }
}

追加命名空间

<!DOCTYPE html>
<html lang="en" xmlns:sec="http://www.thymeleaf.org/extras/spring-security" xmlns:th="http://www.thymeleaf.org">
<head>

thymeleaf根据权限判断，显示的板块信息

<div class="ui container">

   <div class="ui segment" id="index-header-nav" th:fragment="nav-menu">
       <div class="ui secondary menu">
           <a class="item"  th:href="@{/index}">首页</a>

           <!--登录注销-->
           <div class="right menu">
               <!--如果未登录-->
               <div sec:authorize="!isAuthenticated()">
                   <a class="item" th:href="@{/toLogin}">
                       <i class="address card icon"></i> 登录
                   </a>
               </div>
               <!--如果已登陆,显示用户名+注销按钮-->

               <!--注销-->
               <div sec:authorize="isAuthenticated()">
                   <a class="item">
                       用户名：<span sec:authentication="name"></span>
                   </a>
               </div>
               <div sec:authorize="isAuthenticated()">
                   <a class="item" th:href="@{/logout}">
                       <i class="sign-out icon"></i>注销
                   </a>
               </div>

标签，权限判断

            <!--动态菜单，根据权限判断！！！-->
            <div class="column" sec:authorize="hasRole('vip2')">
                <div class="ui raised segment">
                    <div class="ui">
                        <div class="content">
                            <h5 class="content">Level 2</h5>
                            <hr>
                            <div><a th:href="@{/level2/1}"><i class="bullhorn icon"></i> Level-2-1</a></div>
                            <div><a th:href="@{/level2/2}"><i class="bullhorn icon"></i> Level-2-2</a></div>
                            <div><a th:href="@{/level2/3}"><i class="bullhorn icon"></i> Level-2-3</a></div>
                        </div>
                    </div>
                </div>
            </div>

开启记住我的功能，cookie

        //开启记住我功能->本质cookie实现,默认2周
        //自定义接受前端传来的参数
        http.rememberMe().rememberMeParameter("rememberme");

shiro