### SpringBoot：整合SpringSecurity ###

*  一、项目结构
 *  二、pom
 *  三、编写SecurityConfig继承WebSecurityConfigurerAdapter
 *  四、首页

# 一、项目结构 #

![项目结构][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1_size_16_color_FFFFFF_t_70]

# 二、pom #

``````````
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.4.1</version>
        <relativePath/> 
    </parent>
    <groupId>site.kexing</groupId>
    <artifactId>springboot-security</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>springboot-security</name>
    <description>Demo project for Spring Boot</description>

<dependency>
            <groupId>org.thymeleaf.extras</groupId>
            <artifactId>thymeleaf-extras-springsecurity5</artifactId>
            <version>3.0.4.RELEASE</version>
        </dependency>
        
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

<dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

<build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>
``````````

# 三、编写SecurityConfig继承WebSecurityConfigurerAdapter #

``````````
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    
//    授权
    @Override
    protected void configure(HttpSecurity http) throws Exception {
    
        //请求授权规则
        http.authorizeRequests()
                //首页所有人可以访问
                //vip每种等级对应不同的角色
                .antMatchers("/").permitAll()
                .antMatchers("/vip1/**").hasRole("vip1")
                .antMatchers("/vip2/**").hasRole("vip2")
                .antMatchers("/vip3/**").hasRole("vip3");

//没有权限默认到登录页面
        http.formLogin().loginPage("/tologin").usernameParameter("username").passwordParameter("pwd").loginProcessingUrl("/login");
        //开启注销功能,注销成功跳到首页
        http.csrf().disable();
        http.logout().logoutSuccessUrl("/");
        //记住我
        http.rememberMe().rememberMeParameter("remember");
    }

//    认证
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    
        //这里从内存中读取用户
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                .withUser("kexing").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1")
                .and()
                .withUser("root").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2","vip3");
    }
}
``````````

这里总共设置了三种角色对应不同的访问权限，首页允许所有人访问，这里更改了`springsecurity`自带的登录页面：
`http.formLogin`()：没有权限默认到登录页面
`loginPage`（）：用户未登录时，访问任何资源都转跳到该路径，即登录页面
`loginProcessingUrl`（）：登录表单`form`中`action`的地址，也就是处理认证请求的路径
`usernameParameter`（）：登录表单`form`中用户名输入框`input`的`name`名，不修改的话默认是`username`
`passwordParameter`（）：登录表单`form`中用户名输入框`input`的`name`名，不修改的话默认是`password`

**springsecurity中需要对传输的明文密码加密，这里选用的BCrypt加密方法，重新对password进行编码**
**因为没有连数据库，所以这里我模拟的是从内存中认证用户**

# 四、首页 #

首页中当用户未登录时，显示登陆按钮；当用户登录时，显示用户名，权限，注销按钮
**因为不同用户拥有不同的角色，也就是不同的权限，所以首页需要展示给用户的则是该用户拥有的权限对应的版块，也就是实现动态菜单**

**引入sec命名空间**：`xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity5"`

``````````
<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org"
                xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity5">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
    <title>首页</title>
    
    <link href="https://cdn.bootcss.com/semantic-ui/2.4.1/semantic.min.css" rel="stylesheet">
    <link th:href="@{/qinjiang/css/qinstyle.css}" rel="stylesheet">
</head>
<body>

<div class="ui container">

<div class="right menu">

<div sec:authorize="!isAuthenticated()">
                    <a class="item" th:href="@{/tologin}">
                        <i class="address card icon"></i> 登录
                    </a>
                </div>

<div sec:authorize="isAuthenticated()">
                    <a class="item">
                       用户名：<span sec:authentication="name"></span>
                          权限：<span sec:authentication="principal.authorities"></span>
                    </a>
                    <a class="item" th:href="@{/logout}">
                        <i class="address card icon"></i> 注销
                    </a>
                </div>
            </div>
        </div>
    </div>

<div class="ui segment" style="text-align: center">
        <h3>Spring Security Study by kexing</h3>
    </div>

</div>
    </div>
    
</div>

</body>
</html>
``````````

`sec:authorize="isAuthenticated()"` 用于判断该用户是否被认证，也就是是否登录
`sec:authorize="hasRole('vip1')"` 只允许对应角色访问

**因为前面的`config`类中已经对用户进行了角色认证，用户`kexing`的权限只能访问vip1，用户`root`的权限可以访问vip1，vip2，vip3所有权限**

**未登录时：**
![未登录][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1_size_16_color_FFFFFF_t_70 1]
**登录用户一 kexing**
![登录用户一 kexing][kexing]
**登录成功，kexing只有vip1权限，只能访问vip1**
![登录成功][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1_size_16_color_FFFFFF_t_70 2]
**注销kexing后使用root登录**
![root登录][root]
**记住我**
![记住我][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1_size_16_color_FFFFFF_t_70_pic_center]
会生成一个cookie，默认的过期时间是14天
![cookie][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20201227144733273.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20201227152633649.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1,size_16,color_FFFFFF,t_70
[kexing]: https://img-blog.csdnimg.cn/20201227152752740.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20201227152846150.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1,size_16,color_FFFFFF,t_70
[root]: https://img-blog.csdnimg.cn/20201227153017811.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1_size_16_color_FFFFFF_t_70_pic_center]: https://img-blog.csdnimg.cn/20201227153240842.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1,size_16,color_FFFFFF,t_70#pic_center
[cookie]: https://img-blog.csdnimg.cn/20201227153410925.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1,size_16,color_FFFFFF,t_70

SpringBoot：整合SpringSecurity实现登录认证、授权、记住我、以及权限控制

总共已有 0 条评论