springMvc的安全登录验证

最新推荐文章于 2020-01-06 16:50:31 发布

menglixiazhiweizhi

最新推荐文章于 2020-01-06 16:50:31 发布

阅读量451

点赞数

分类专栏： java基础文章标签： springmvc

java基础专栏收录该内容

17 篇文章

订阅专栏

本文详细介绍了如何在Spring MVC项目中引入并配置Spring Security框架，实现用户权限管理和控制。包括配置web.xml和security.xml，自定义权限验证类，以及如何在页面和后端代码中实施权限控制。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

原文：https://blog.youkuaiyun.com/qq_38662236/article/details/84101352

1. 引入springMvc权限框架security

1-1 配置web.xml

1. 在监听器上引入权限局框架的配置文件security.xml  <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <context-param> <param-name>contextConfigLocation</param-name> <param-value>classpath:applicationContext.xml,classpath:security.xml</param-value> </context-param> 注意：<param-value>标签可以配置多个配置文件，一般用逗号隔开 2. 配置过滤器  <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> 注意：filter权限框架执行链要放在解决乱码的CharacterEncodingFilter过滤器下面，否则会出现中文乱码

1-2 配置security框架的xml文件security.xml

<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">  <security:http pattern="/login.jsp" security="none"></security:http> <security:http pattern="/failer.jsp" security="none"></security:http> <security:http pattern="/css/**" security="none"></security:http> <security:http pattern="/img/**" security="none"></security:http> <security:http pattern="/plugins/**" security="none"></security:http> <security:http pattern="/pages/**" security="none"></security:http>  <security:http auto-config="true" use-expressions="true">  <security:remember-me user-service-ref="userService" key="rememberUser"></security:remember-me>  <security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ORDER','ROLE_ADMIN','ROLE_PRODUCT')"></security:intercept-url>  <security:form-login login-page="/login.jsp" login-processing-url="/login" default-target-url="/index.jsp" authentication-failure-url="/failer.jsp"></security:form-login>  <security:logout logout-url="/logout" logout-success-url="/login.jsp" invalidate-session="true"></security:logout>  <security:access-denied-handler error-page="/403.jsp"></security:access-denied-handler>  <security:csrf disabled="true"></security:csrf> </security:http>  <security:authentication-manager> <security:authentication-provider user-service-ref="userService">  <security:password-encoder ref="pwdEncoder"></security:password-encoder> </security:authentication-provider> </security:authentication-manager> <security:global-method-security secured-annotations="enabled"></security:global-method-security>  <bean id="pwdEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"></bean> </beans>

2. 权限验证类UserService的编写

@Service("userService") @Transactional public class userServiceImpl implements UserService ,UserDetailsService { @Autowired private UserDao userDao; @Autowired BCryptPasswordEncoder pwdEncoder; @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { // 通过用户名得到数据库用户对象 SysUser sysUser = userDao.findUserByName(username); // 创建用户的权限集合 List<GrantedAuthority> authorities = new ArrayList<>(); // 查询到用户的角色验证登录 List<Role> userRoles = sysUser.getRoles(); // 循环添加用户的角色信息 if (userRoles.size()>0 && userRoles != null) { for (Role userRole : userRoles) { // 初始化赋值给用户角色 authorities.add(new SimpleGrantedAuthority(userRole.getRoleName())); } } // 使用数据库用户组装框架需要的user对象用于验证 User user = new User(sysUser.getUsername(), sysUser.getPassword(), authorities); return user; // 返回值user带有用户名username，密码password和角色即权限authorties，返回的user是UserDetails 对象，由框架获取操纵 } /** 添加一个用户，密码使用BCryptPasswordEncoder 加密，由于在security.xml配置了加密方式，所以登录框架帮你解密，不用管 login.jsp登录的form表单提交到在security.xml已经配置好了的"${pageContext.request.contextPath}/login" */ @Override public void addUser(SysUser user) { //将原始密码获取 String pwd = user.getPassword(); //将明文加密 user.setPassword( pwdEncoder.encode(pwd)); userDao.addUser(user); }

3.权限的控制

3-1.页面权限的控制

1.引入标签库 <%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %> 2.表达式验证 <security:authorize access="hasRole('ROLE_ADMIN')"> // 要被权限框架控制的代码 </security:authorize> 例如： <security:authorize access="hasAnyRole('ROLE_ADMIN')">  <li id="system-setting4"> <a href="${pageContext.request.contextPath}/pages/syslog-list.jsp"> <i class="fa fa-circle-o"></i> 访问日志 </a></li> </security:authorize> 3.security.xml文件中开启表达式支持 // use-expressions="true" 就是开启表达式支持，完整的上面的security有 <security:http auto-config="true" use-expressions="true"> <security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ORDER','ROLE_ADMIN','ROLE_PRODUCT')"> </security:intercept-url>

3-2 .后台代码权限控制

在页面配置的权限管理后虽然对没有权限的访问者予以限制，但是仍然可以通过在浏览器地址栏上访问路径，所以使用后台权限控制尤为主要通过三种注解实现权限的拦截： 1.jsr250的方式实现拦截 jsr是java的一个规范 jsr250是对规范的实现目的是拦截验证权限引入依赖 <dependency> <groupId>javax.annotation</groupId> <artifactId>jsr250-api</artifactId> <version>1.0</version> </dependency> 在配置文件中开启注解支持为了拦截controller方法配置springMvc中约束文件和命名空间 xmlns:security="http://www.springframework.org/schema/security" http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd <security:global-method-security jsr250-annotations="enabled"/> 在需要拦截的类或者方法上通过表达式拦截认证 @RolesAllowed("ROLE_ADMIN") 2.secured 注解拦截 <security:global-method-security secured-annotations="enabled"/> @Secured("ROLE_ADMIN") 3.表达式的注解拦截 <security:global-method-security pre-post-annotations="enabled"/> @PreAuthorize("hasRole('ROLE_ADMIN')") 注意： 1、三种方式都必须在springMvc.xml配置文件中开启注解支持  <aop:aspectj-autoproxy proxy-target-class="true"/> 2、推荐使用第二种，次之第三种，不推荐第一种方式，太麻烦了