springmvc控制权限的

首先第一步在pom文件中添加jar包

  <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-taglibs</artifactId>
        <version>5.0.1.RELEASE</version>
    </dependency>

第二步在jsp页面中导入

	//  jsp页面进行导入
<%@taglib prefix="security" uri="http://www.springframework.org/security/tags" %>

第三步在页面进行使用jsp页面

//  可以通过此方法来获取房前正在操作的用户信息
	<security:authentication property="principal.username"></security:authentication></p>

<%--				设置可以访问的权限     其余的权限不可以访问呢--%>
					<security:authorize access="hasAnyRole('ROLE_ADMIN')">
					<li id="system-setting"><a
						href="${pageContext.request.contextPath}/productController/find.do">
							<i class="fa fa-circle-o"></i> 产品管理
					</a></li>
					</security:authorize>

在xml文件中的配置

    <?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
    	   xmlns:security="http://www.springframework.org/schema/security"
    	   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	   xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">
    
    	<!-- 配置不拦截的资源 -->
    	<security:http pattern="/login.jsp" security="none"/>
    	<security:http pattern="/failer.jsp" security="none"/>
    	<security:http pattern="/css/**" security="none"/>
    	<security:http pattern="/img/**" security="none"/>
    	<security:http pattern="/plugins/**" security="none"/>
    
    <!--   开启方法权限注解  -->
    <security:global-method-security secured-annotations="enabled"></security:global-method-security>
    	<!--
            配置具体的规则
            auto-config="true"	不用自己编写登录的页面，框架提供默认登录页面
            use-expressions="false"	是否使用SPEL表达式（没学习过）
        -->
    	<security:http auto-config="true" use-expressions="false">
    		<!-- 配置具体的拦截的规则 pattern="请求路径的规则" access="访问系统的人，必须有ROLE_USER的角色" -->
    		<security:intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN"/>
    
    		<!-- 定义跳转的具体的页面 -->
    		<security:form-login
    				login-page="/login.jsp"
    				login-processing-url="/login.do"
    				default-target-url="/index.jsp"
    				authentication-failure-url="/failer.jsp"
    				authentication-success-forward-url="/pages/main.jsp"
    		/>
    
    		<!-- 关闭跨域请求 -->
    		<security:csrf disabled="true"/>
    		<!-- 退出 -->
    		<security:logout invalidate-session="true" logout-url="/logout.do" logout-success-url="/login.jsp" />
    
    	</security:http>
    
    	<!-- 切换成数据库中的用户名和密码 -->
    	<security:authentication-manager>
    		<security:authentication-provider user-service-ref="userServiceImpl">
    			<!-- 配置加密的方式    -->
    <!--            <security:password-encoder ref="passwordEncoder"/>-->
    		</security:authentication-provider>
    	</security:authentication-manager>
    
    	<!-- 配置加密类 -->
    	<bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
    <!--     打开权限的注解-->
    	<bean id="defaultWebSecurityExpressionHandler" class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler">
    	</bean>
</beans>

上面提到了密码的加密这边把密码加密说一下

密码加密要在Serivce接口层继承UserDetailsService接口

    @Autowired
    UserInfoDao userInfoDao;

    @Autowired
    BCryptPasswordEncoder bCryptPasswordEncoder;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        UserInfo userInfo = userInfoDao.findByName(username);
        //加载角色信息
        List<SimpleGrantedAuthority> list=new ArrayList<>();
        //简写方式
        for (Role role: userInfo.getRoles()){
            //给予用户权限
            SimpleGrantedAuthority sga=new SimpleGrantedAuthority(role.getRoleName());
            list.add(sga);
        }
//        {noop}使用明文操作              如果将xml中的配置加密的方式打开以后记得要将{noop} 去掉
        User user=new User(userInfo.getUsername(),"{noop}"+userInfo.getPassword(),list);
        return user;
    }

对添加的密码进行加密操作

   @Override
    public void insert(UserInfo userInfo) {
        //对密码进行加密
        userInfo.setPassword(bCryptPasswordEncoder.encode(userInfo.getPassword()));
        userInfoDao.insert(userInfo);
    }