security初体验（一）

转x33g5p2x  于2022-03-02 转载在 其他  
字(11.6k)|赞(0)|评价(0)|浏览(273)

1.pom.xml

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  4.     <modelVersion>4.0.0</modelVersion>
  5.     <parent>
  6.         <groupId>org.springframework.boot</groupId>
  7.         <artifactId>spring-boot-starter-parent</artifactId>
  8.         <version>2.6.4</version>
  9.         <relativePath/> <!-- lookup parent from repository -->
  10.     </parent>
  11.     <groupId>com.yl</groupId>
  12.     <artifactId>security</artifactId>
  13.     <version>0.0.1-SNAPSHOT</version>
  14.     <name>security</name>
  15.     <description>Demo project for Spring Boot</description>
  16.     <properties>
  17.         <java.version>11</java.version>
  18.     </properties>
  19.     <dependencies>
  20.         <dependency>
  21.             <groupId>org.springframework.boot</groupId>
  22.             <artifactId>spring-boot-starter-security</artifactId>
  23.         </dependency>
  24.         <dependency>
  25.             <groupId>org.springframework.boot</groupId>
  26.             <artifactId>spring-boot-starter-web</artifactId>
  27.         </dependency>
  29.         <dependency>
  30.             <groupId>org.springframework.boot</groupId>
  31.             <artifactId>spring-boot-starter-test</artifactId>
  32.             <scope>test</scope>
  33.         </dependency>
  34.         <dependency>
  35.             <groupId>org.springframework.security</groupId>
  36.             <artifactId>spring-security-test</artifactId>
  37.             <scope>test</scope>
  38.         </dependency>
  39.     </dependencies>
  41.     <build>
  42.         <plugins>
  43.             <plugin>
  44.                 <groupId>org.springframework.boot</groupId>
  45.                 <artifactId>spring-boot-maven-plugin</artifactId>
  46.             </plugin>
  47.         </plugins>
  48.     </build>
  50. </project>

2.security.config

  1. package com.yl.security.config;
  3. import com.yl.security.handler.LogOutSuccessHandler;
  4. import com.yl.security.handler.LoginFailHandler;
  5. import com.yl.security.handler.LoginSuccessHandler;
  6. import org.springframework.beans.factory.annotation.Autowired;
  7. import org.springframework.context.annotation.Bean;
  8. import org.springframework.context.annotation.Configuration;
  9. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  10. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  11. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  12. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  13. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  14. import org.springframework.security.crypto.password.NoOpPasswordEncoder;
  15. import org.springframework.security.crypto.password.PasswordEncoder;
  17. @Configuration
  18. @EnableGlobalMethodSecurity(prePostEnabled = true,securedEnabled = true) //开启全局方法安全功能
  19. public class SecurityConfig extends WebSecurityConfigurerAdapter {
  20.     @Autowired
  21.     LoginSuccessHandler loginSuccessHandler;
  22.     @Autowired
  23.     LoginFailHandler loginFailHandler;
  24.     @Autowired
  25.     LogOutSuccessHandler logOutSuccessHandler;
  27.     //使用不加密的编码方式
  28. //    @Bean
  29. //    PasswordEncoder passwordEncoder() {
  30. //        return NoOpPasswordEncoder.getInstance();
  31. //    }
  33.     @Bean
  34.     PasswordEncoder passwordEncoder() {
  35.         return new BCryptPasswordEncoder();
  36.     }
  38.     // 基于内存的用户名和密码认证
  39.     @Override
  40.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  41.        auth.inMemoryAuthentication()
  42.                // 密码设置为123
  43.                .withUser("root").password("$2a$10$O8G0X/sUPAA76MV7U3BwY.3Uo8/QMBcqK678Rwkoz.fowbce.CLtO").roles("user")
  44.                .and().withUser("admin").password("$2a$10$O8G0X/sUPAA76MV7U3BwY.3Uo8/QMBcqK678Rwkoz.fowbce.CLtO").roles("admin");
  45.     }
  47.     //匹配拦截路径，处理器等
  48.     @Override
  49.     protected void configure(HttpSecurity http) throws Exception {
  50.         http.authorizeRequests()
  51.                 .antMatchers("/admin/**").hasRole("admin") //静态配置哪些角色访问才能访问指定路径
  52. //                .antMatchers("/user/**").hasAnyRole("admin","user")
  53.                 .antMatchers("/user/**").access("hasAnyRole('user','admin')")
  54.                 .anyRequest().authenticated() //其他所有请求登录成功后才能访问
  55.                 .and()
  56.                 .formLogin()
  57.                 .loginProcessingUrl("/doLogin") //登录处理usrl,注意：登录请求为post请求
  58.                 .loginPage("/login") // 登录的页面
  59.                 .usernameParameter("username") //登录的用户名参数名
  60.                 .passwordParameter("password") //登录的密码参数名
  61.                 .successHandler(loginSuccessHandler) //登录成功后的处理器
  62.                 .failureHandler(loginFailHandler) //登录失败后的处理器
  63.                 .permitAll() // 登录接口允许所有人访问
  64.                 .and()
  65.                 .logout()
  66.                 .logoutUrl("/logOut") // 登出接口
  67.                 .logoutSuccessHandler(logOutSuccessHandler) //登出成功处理器
  68.                 .and()
  69.                 .csrf().disable(); //关闭csrf保护
  70.     }
  71. }

3.登录成功处理器

  1. package com.yl.security.handler;
  3. import com.fasterxml.jackson.databind.ObjectMapper;
  4. import org.springframework.security.core.Authentication;
  5. import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
  6. import org.springframework.stereotype.Component;
  8. import javax.servlet.ServletException;
  9. import javax.servlet.http.HttpServletRequest;
  10. import javax.servlet.http.HttpServletResponse;
  11. import java.io.IOException;
  12. import java.io.PrintWriter;
  13. import java.util.HashMap;
  14. import java.util.Map;
  16. //登录成功处理器
  17. @Component
  18. public class LoginSuccessHandler implements AuthenticationSuccessHandler {
  19.     @Override
  20.     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
  21.         response.setContentType("application/json;charset=utf-8");
  22.         PrintWriter writer = response.getWriter();
  23.         Map<String,Object> map = new HashMap<>();
  24.         map.put("status",200);
  25.         map.put("msg",authentication.getPrincipal());
  26.         writer.write(new ObjectMapper().writeValueAsString(map));
  27.         writer.flush();
  28.         writer.close();
  29.     }
  30. }

4.登录失败处理器

  1. package com.yl.security.handler;
  3. import com.fasterxml.jackson.databind.ObjectMapper;
  4. import org.springframework.security.authentication.*;
  5. import org.springframework.security.core.AuthenticationException;
  6. import org.springframework.security.web.authentication.AuthenticationFailureHandler;
  7. import org.springframework.stereotype.Component;
  9. import javax.servlet.ServletException;
  10. import javax.servlet.http.HttpServletRequest;
  11. import javax.servlet.http.HttpServletResponse;
  12. import java.io.IOException;
  13. import java.io.PrintWriter;
  14. import java.util.HashMap;
  15. import java.util.Map;
  17. //登录失败处理器
  18. @Component
  19. public class LoginFailHandler implements AuthenticationFailureHandler {
  21.     @Override
  22.     public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
  23.         response.setContentType("application/json;charset=utf-8");
  24.         PrintWriter writer = response.getWriter();
  25.         Map<String,Object> map = new HashMap<>();
  26.         map.put("code",401);
  27.         if (exception instanceof LockedException) {
  28.             map.put("msg","账户被锁定");
  29.         } else if (exception instanceof BadCredentialsException) {
  30.             map.put("msg","用户名或密码错误");
  31.         } else if (exception instanceof DisabledException) {
  32.             map.put("msg","账户被禁用");
  33.         } else if (exception instanceof AccountExpiredException) {
  34.             map.put("msg","账户过期");
  35.         } else if (exception instanceof CredentialsExpiredException) {
  36.             map.put("msg","密码过期");
  37.         } else {
  38.             map.put("msg","登录异常");
  39.         }
  40.         writer.write(new ObjectMapper().writeValueAsString(map));
  41.         writer.flush();
  42.         writer.close();
  43.     }
  44. }

5.登出成功处理器

  1. package com.yl.security.handler;
  3. import com.fasterxml.jackson.databind.ObjectMapper;
  4. import org.springframework.security.core.Authentication;
  5. import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
  6. import org.springframework.stereotype.Component;
  8. import javax.servlet.ServletException;
  9. import javax.servlet.http.HttpServletRequest;
  10. import javax.servlet.http.HttpServletResponse;
  11. import java.io.IOException;
  12. import java.io.PrintWriter;
  13. import java.util.HashMap;
  14. import java.util.Map;
  16. @Component
  17. public class LogOutSuccessHandler implements LogoutSuccessHandler {
  18.     @Override
  19.     public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
  20.         response.setContentType("application/json;charset=utf-8");
  21.         PrintWriter writer = response.getWriter();
  22.         Map<String,Object> map = new HashMap<>();
  23.         map.put("status",200);
  24.         map.put("msg","注销成功");
  25.         writer.write(new ObjectMapper().writeValueAsString(map));
  26.         writer.flush();
  27.         writer.close();
  28.     }
  29. }

6.全局方法安全功能

  1. package com.yl.security.service;
  3. import org.springframework.security.access.annotation.Secured;
  4. import org.springframework.security.access.prepost.PreAuthorize;
  5. import org.springframework.stereotype.Service;
  7. @Service
  8. public class MethodService {
  10.     @PreAuthorize("hasRole('admin')")
  11.     public String admin() {
  12.         return "hello admin";
  13.     }
  15.     @Secured("ROLE_user")
  16.     public String user() {
  17.         return "hello user";
  18.     }
  20.     @PreAuthorize("hasAnyRole('admin','user')")
  21.     public String hello() {
  22.         return "hello hello";
  23.     }
  24. }

7.controller

  1. package com.yl.security.controller;
  3. import com.yl.security.service.MethodService;
  4. import org.springframework.beans.factory.annotation.Autowired;
  5. import org.springframework.web.bind.annotation.GetMapping;
  6. import org.springframework.web.bind.annotation.RestController;
  8. @RestController
  9. public class HelloController {
  11.     @Autowired
  12.     MethodService methodService;
  14.     @GetMapping("/hello")
  15.     public String hello() {
  16.         return "hello security";
  17.     }
  19.     @GetMapping("/admin/hello")
  20.     public String admin() {
  21.         return "hello admin";
  22.     }
  24.     @GetMapping("/user/hello")
  25.     public String user() {
  26.         return "hello user";
  27.     }
  29.     @GetMapping("/login")
  30.     public String login() {
  31.         return "please login";
  32.     }
  34.     @GetMapping("/hello1")
  35.     public String hello1() {
  36.         return methodService.admin();
  37.     }
  39.     @GetMapping("/hello2")
  40.     public String hello2() {
  41.         return methodService.user();
  42.     }
  44.     @GetMapping("/hello3")
  45.     public String hello3() {
  46.         return methodService.hello();
  47.     }
  49. }

8.测试

1.任何请求都要登录

2.登录成功后，会返回相关信息

3.能访问/user/hello

4.但是没权限访问/admin/hello

5.全局方法安全的测试
1）root用户能访问/hello2

2)但是root用户不能访问/hello1

9.配置多个httpsecurityconfig,使用内部类

  1. package com.yl.security.config;
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.context.annotation.Bean;
  5. import org.springframework.context.annotation.Configuration;
  6. import org.springframework.core.annotation.Order;
  7. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  8. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  9. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  10. import org.springframework.security.crypto.password.NoOpPasswordEncoder;
  11. import org.springframework.security.crypto.password.PasswordEncoder;
  13. // 多个httpSecurity的配置，使用静态内部类
  14. @Configuration
  15. public class MultiHttpSecurityConfig {
  16.     @Bean
  17.     PasswordEncoder passwordEncoder() {
  18.         return NoOpPasswordEncoder.getInstance();
  19.     }
  21.     @Autowired
  22.     // 配置静态的用户名和密码
  23.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  24.         auth.inMemoryAuthentication()
  25.                 .withUser("root").password("111").roles("user")
  26.                 .and().withUser("admin").password("222").roles("admin");
  27.     }
  29.     @Configuration
  30.     @Order(1) // 设置优先级，数字越小，优先级越高
  31.     public static class AdminSecurityConfig extends WebSecurityConfigurerAdapter {
  32.         @Override
  33.         protected void configure(HttpSecurity http) throws Exception {
  34.             http.antMatcher("/admin/**").authorizeRequests().anyRequest().hasAnyRole("admin");
  35.         }
  36.     }
  38.     @Configuration
  39.     public static class OtherSecurityConfig extends WebSecurityConfigurerAdapter {
  40.         @Override
  41.         protected void configure(HttpSecurity http) throws Exception {
  42.             http.authorizeRequests().anyRequest().authenticated()
  43.                     .and()
  44.                     .formLogin()
  45.                     .loginProcessingUrl("/doLogin")
  46.                     .permitAll()
  47.                     .and()
  48.                     .csrf().disable();
  49.         }
  50.     }
  51. }

版权说明 : 本文为转载文章, 版权归原作者所有 版权申明

原文链接 : https://blog.csdn.net/weixin_41359273/article/details/123224441

内容来源于网络，如有侵权，请联系作者删除！

Javaspring

相关文章

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新文章

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com