Spring-Security 6.x版本入门讲解

最新推荐文章于 2025-10-12 21:00:58 发布

原创

最新推荐文章于 2025-10-12 21:00:58 发布 · 1.7k 阅读

6 ·

CC 4.0 BY-SA版权

文章标签：

#spring #java #后端

本文详细介绍了如何在SpringSecurity中配置认证和授权，包括使用@EnableWebSecurity，自定义UsernamePasswordAuthenticationFilter和JwtAuthorizationFilter，以及JWT在权限验证中的应用。

Spring-Security

配置代码

package magnus.configuration;

import com.fasterxml.jackson.databind.ObjectMapper;
import jakarta.ws.rs.core.MediaType;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.annotation.web.configurers.LogoutConfigurer;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

@Configuration
@EnableWebSecurity
public class MagnusSecurityConfiguration {
   
   

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity,
                                                   ObjectMapper objectMapper) throws Exception {
   
   
        // 定义安全请求拦截规则
        httpSecurity.authorizeHttpRequests(request -> request.anyRequest().authenticated());
        // 给SpringSecurity注入 /login登录页面及用户密码表单处理的登录请求
        httpSecurity.formLogin(Customizer.withDefaults());
        // 登出请求注册
        httpSecurity.logout(LogoutConfigurer::permitAll);
//        httpSecurity.addFilterBefore(magnusUsernamePasswordFilter(objectMapper),
//                                     UsernamePasswordAuthenticationFilter.class);
        // 关闭csrf
        httpSecurity.csrf(AbstractHttpConfigurer::disable);
        return httpSecurity.build();
    }

    @Bean
    public UsernamePasswordAuthenticationFilter magnusUsernamePasswordFilter(ObjectMapper objectMapper) {
   
   
        // 配置自定义的UsernamePasswordAuthenticationFilter
        MagnusUsernamePasswordFilter magnusUsernamePasswordFilter = new MagnusUsernamePasswordFilter();
        magnusUsernamePasswordFilter.setAuthenticationManager(providerManager());
        magnusUsernamePasswordFilter.setObjectMapper(objectMapper);
        magnusUsernamePasswordFilter.initialize();
        return magnusUsernamePasswordFilter;
    }

    @Bean
    public UserDetailsService userDetailsService() {
   
   
        UserDetails build = User.withUsername("username").password("{noop}password").roles("user").build();
        return new InMemoryUserDetailsManager(build);
    }

    @Bean
    public AuthenticationManager providerManager() {
   
   
        List<AuthenticationProvider> providers = new ArrayList<>();
        // 自定义Provider,此处可以定义多数据源。
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setUserDetailsService(userDetailsSe