【Java】权限控制与安全认证(2)

最新推荐文章于 2024-12-28 01:09:36 发布

原创最新推荐文章于 2024-12-28 01:09:36 发布 · 838 阅读

26 ·

CC 4.0 BY-SA版权

文章标签：

#java #安全 #开发语言

程序员专栏收录该内容

29 篇文章

订阅专栏

import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
// 自定义表单登录
http.formLogin()
.loginPage(“/backstage/admin_login”) // 自定义登录页面
.usernameParameter(“username”) // 指定登录表单中用于输入用户名的表单字段名
.passwordParameter(“password”) // 指定登录表单中用于输入密码的表单字段名
.loginProcessingUrl(“/backstage/admin/login”) // 表单提交的URL路径
.successForwardUrl(“/backstage/index”) // 登录成功后的跳转页面
.failureForwardUrl(“/backstage/admin_fail”); // 登录失败后的跳转页面

    // 权限拦截配置
    http.authorizeRequests()
            .antMatchers("/backstage/admin/login").permitAll() // 登录表单提交不需要认证
            .antMatchers("/backstage/admin\_fail").permitAll() // 登录失败页面不需要认证
            .antMatchers("/backstage/admin\_login").permitAll() // 登录页面不需要认证
            .antMatchers("/\*\*/\*.css", "/\*\*/\*.js").permitAll() // 静态资源放行
            .antMatchers("/backstage/\*\*").authenticated();

    // 退出登录
    http.logout()
            .logoutUrl("/backstage/admin/logout") // 退出登录路径
            .logoutSuccessUrl("/backstage/admin\_login") // 退出登录成功后跳转的页面
            .clearAuthentication(true) // 退出成功后清楚认证信息
            .invalidateHttpSession(true); // 退出成功后清除session

    // 异常处理
    http.exceptionHandling()
            .accessDeniedHandler(new MyAccessDeniedHandler()); // 权限不足处理器

    // 关闭csrf防护
    http.csrf().disable();

    // 开启跨域访问
    http.cors();

    super.configure(http);
}

@Bean
public BCryptPasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

}


###### MyUserDetailService

package com.nuc.travel.security;

import com.nuc.travel.pojo.Admin;
import com.nuc.travel.pojo.Permission;
import com.nuc.travel.service.AdminService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import java.util.ArrayList;
import java.util.List;

// 自定义认证授权逻辑
@Service
public class MyUserDetailService implements UserDetailsService {
@Autowired
private AdminService adminService;

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    // 1、认证
    Admin admin = adminService.findByAdminName(username);
    if (admin == null) {
        throw new UsernameNotFoundException("用户不存在");
    }
    if (!admin.isStatus()) {
        throw new UsernameNotFoundException("用户不可用");
    }

    // 2、授权
    List<Permission> permissions = adminService.findAllPermission(username);
    List<GrantedAuthority> grantedAuthorities = new ArrayList();
    for (Permission permission : permissions) {
        grantedAuthorities.add(new SimpleGrantedAuthority(permission.getPermissionDesc()));
    }


    // 3、封装成UserDetails对象
    UserDetails userDetails = User.withUsername(admin.getUsername())
            .password(admin.getPassword())
            .authorities(grantedAuthorities)
            .build();
    return userDetails;
}

}


###### MyAccessDeniedHandler

package com.nuc.travel.security;

import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

// 自定义权限不足处理器
public class MyAccessDeniedHandler implements AccessDeniedHandler {