SpringSecurity简单集成

1、引入SpringSecurity依赖

     <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId></dependency>

2、编写配置类

package com.yoohoo.framework.config;import com.yoohoo.framework.security.filter.JwtAuthenticationTokenFilter;
import com.yoohoo.framework.security.handle.AuthenticationEntryPointImpl;
import com.yoohoo.framework.security.handle.LogoutSuccessHandlerImpl;
import com.yoohoo.framework.security.service.UserDetailsServiceImpl;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.logout.LogoutFilter;
import org.springframework.web.filter.CorsFilter;import javax.annotation.Resource;/*** spring security 配置*/
@EnableGlobalMethodSecurity(prePostEnabled = true,securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {//过滤器配置@Autowiredprivate CorsFilter corsFilter;//认证入口@Autowiredprivate AuthenticationEntryPointImpl authenticationEntryPoint;/*退出处理*/@Autowiredprivate LogoutSuccessHandlerImpl logoutSuccessHandler;//token认证处理@Autowiredprivate JwtAuthenticationTokenFilter authenticationTokenFilter;//自定义用户验证@Autowiredprivate UserDetailsServiceImpl userDetailsService;/***注入 AuthenticationManage* @return* @throws Exception*/@Bean@Overridepublic AuthenticationManager authenticationManagerBean() throws Exception{return super.authenticationManagerBean();}@Overrideprotected void configure(HttpSecurity http) throws Exception {/*使用token认证  不使用session  禁用CSRF*/http.csrf().disable()/*认证异常处理*/.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint).and()/*不会创建HttpSession*/.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()/*请求白名单*/.authorizeRequests().antMatchers("/login","/captchaImage").permitAll().antMatchers(HttpMethod.GET,"/","/*.html","/**/*.html","/**/*.css","/**/*.js","/profile/**").permitAll().antMatchers("/swagger-ui/**").anonymous().antMatchers("/swagger-ui.html").anonymous().antMatchers("/swagger-resources/**").anonymous().antMatchers("/webjars/**").anonymous().antMatchers("/*/api-docs").anonymous().antMatchers("/druid/**").anonymous()/*出去以上请求 全部需要鉴权*/.anyRequest().authenticated().and()/*安全劫持*/.headers().frameOptions().disable();/*退出成功处理*/http.logout().logoutSuccessUrl("/logout").logoutSuccessHandler(logoutSuccessHandler);/* 认证之前检验token */http.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);http.addFilterBefore(corsFilter,JwtAuthenticationTokenFilter.class);http.addFilterBefore(corsFilter, LogoutFilter.class);}/*** 强散列哈希加密* @return*/@Beanpublic BCryptPasswordEncoder bCryptPasswordEncoder(){/*自定义密码匹配规则*/return new CustomPasswordEncoder();
//        return new BCryptPasswordEncoder(); //强散列哈希}/*** 自定义用户验证* @param auth* @throws Exception*/@Overrideprotected void configure(AuthenticationManagerBuilder auth) throws Exception {/*自定义验证  两种方式都可*/
//        auth.authenticationProvider(myAuthenticationProvider);   myAuthenticationProvider 需要实现 AuthenticationProviderauth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());}class CustomPasswordEncoder extends BCryptPasswordEncoder implements PasswordEncoder  {@Overridepublic String encode(CharSequence rawPassword) {//自定义逻辑return rawPassword.toString();}@Overridepublic boolean matches(CharSequence rawPassword, String encodedPassword) {//自定义逻辑return true;}}}

4、UserDetailsServiceImpl 类

package com.yoohoo.framework.security.service;import com.yoohoo.common.utils.Constants;
import com.yoohoo.system.base.domain.ServiceException;
import com.yoohoo.system.modules.system.domain.SysUser;
import com.yoohoo.system.modules.system.domain.vo.LoginUser;
import com.yoohoo.system.modules.system.service.impl.SysUserServiceImpl;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;/*** 用户验证处理*/
@Service
public class UserDetailsServiceImpl implements UserDetailsService {private static final Logger log = LoggerFactory.getLogger(UserDetailsServiceImpl.class);@Autowiredprivate SysUserServiceImpl sysUserService;//    @Autowired
//    private PermissionService permissionService;@Overridepublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {/*authenticate 执行认证时 会进入此方法  携带 username */SysUser user = sysUserService.selectUserByUserName(username);//数据库验证userreturn createLoginUser(user);}private UserDetails createLoginUser(SysUser user) {return new LoginUser(user.getUserId(), user.getDeptId(), user, null);}

5、

 public String login(String username, String password, String code, String uuid) {/*密码匹配验证*/Authentication authenticate = null;try{//此步会进入 UserDetailsServiceImpl 重写authenticate = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password));}catch (Exception e){/*处理验证不通过的异常信息  并抛出*/}LoginUser loginUser = (LoginUser) authenticate.getPrincipal();return tokenService.createToken(loginUser);}

SpringSecurity简单集成相关推荐

超简单集成HMS ML Kit二代身份证识别，一键实名认证
前言就在近期华为HMS ML Kit 发布了1.0.3.30版本,ML Kit在原有通用OCR功能的基础上,又新增了银行卡识别(BCR)和二代身份证识别(ICR).今天小编就给大家介绍一下其中的IC ...
超简单集成HMS ML套件二代身份证识别，一键实名认证
前言就在近期华为HMS ML Kit发布了1.0.3.30版本,ML Kit在原有通用OCR功能的基础上,又添加了银行卡识别(BCR)和二代身份识别(ICR).今天小编就给ML kit除了提供语言相 ...
环信3即时通信——web端sdk简单集成（一）(文本消息)
环信3即时通信--web端sdk简单集成实现简单的登录/文字发送/获取好友列表/接收文字消息,(本文章只为简单未使用vuex,消息记录保存在本地localstorage里面) 一.安装sdk npm ...
超简单集成ML kit 实现听写单词播报
背景相信我们大家在刚开始学习一门语言的时候都有过听写,现在的小学生学语文的时候一项重要的课后作业就是听写课文中的生词,很多家长们都有这方面的经历.不过一方面这种读单词的动作相对简单,另一方面家长 ...
SpringSecurity 简单使用
SpringSecurity 简单使用在 Web 开发中安全是不可忽视的问题(软件安全技术!),现在从 SpringSecurity 和 Shiro 两个框架来学习一下安全框架在 Web 应用中的使 ...
LTS简介以及与SpringBoot的简单集成
LTS简介以及与SpringBoot的简单集成一什么是LTS 关于定时任务,虽然Spring提供了基于注解@EnableScheduling @Scheduled的实现方式.其实现是通过线程池Sc ...
基于EasyNVR摄像机网页无插件直播服务二次开发实现H5播放页面的简单集成方案...
我们通常在构架一套视频SaaS应用的过程中,将平台设计为3层:视频硬件层(视频源).视频能力平台(vPaaS).视频应用平台(vSaaS),视频硬件包括各种IPC.NVR.编码器等视频生成设备,vPa ...
Shiro和SpringBoot简单集成
Shiro是一种简单的安全框架,可以用来处理系统的登录和权限问题. 本篇记录一下Spring Boot和Shiro集成,并使用Jwt Token进行无状态登录的简单例子. 参考Demo地址,此Demo ...
SpringSecurity简单应用（二）
这里我首先对我上一篇博文的第三个实例做一下讲解,下面是applicationContext-security.xml内容如下: <?xml version="1.0" enc ...

SpringSecurity简单集成

SpringSecurity简单集成相关推荐

最新文章

热门文章