spring boot 整合security

1、基于内存认证

2、基于数据库认证

1、基于内存认证

1）、配置pom文件

<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-web</artifactId>
</dependency><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-test</artifactId><scope>test</scope>
</dependency>
<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId>
</dependency>

2)、自定义WebSecurityConfigurerAdapter

@Configuration
public class WebImSecurityConfig extends WebSecurityConfigurerAdapter {@Beanpublic PasswordEncoder passwordEncoder() {return NoOpPasswordEncoder.getInstance();}//配置基于内存认证@Overrideprotected void configure(AuthenticationManagerBuilder auth) throws Exception {auth.inMemoryAuthentication().withUser("admin").password("123").roles("ADMIN","USER").and().withUser("zhao").password("123").roles("USER");}//配置HttpSecurity@Overrideprotected void configure(HttpSecurity http) throws Exception {http.authorizeRequests().antMatchers("/admin/**").hasRole("ADMIN").antMatchers("/user/**").access("hasAnyRole('ADMIN','USER')").antMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')").anyRequest().authenticated().and().formLogin().loginProcessingUrl("/login").usernameParameter("name").passwordParameter("passwd").successHandler(new AuthenticationSuccessHandler() {//登录成功@Overridepublic void onAuthenticationSuccess(HttpServletRequest req, HttpServletResponse resp, Authentication authentication) throws IOException, ServletException {Object principal = authentication.getPrincipal();resp.setContentType("application/json;charset=utf-8");PrintWriter out = resp.getWriter();resp.setStatus(200);Map<String,Object> map = new HashMap<>();map.put("status",200);map.put("msg",principal);ObjectMapper om = new ObjectMapper();out.write(om.writeValueAsString(map));out.flush();out.close();}}).failureHandler(new AuthenticationFailureHandler() {//登录失败@Overridepublic void onAuthenticationFailure(HttpServletRequest req, HttpServletResponse resp, AuthenticationException e) throws IOException, ServletException {resp.setContentType("application/json;charset=utf-8");PrintWriter out = resp.getWriter();resp.setStatus(401);Map<String,Object> map = new HashMap<>();map.put("status",401);if(e instanceof LockedException) {map.put("msg","账户被锁定，登录失败！");}else if (e instanceof BadCredentialsException) {map.put("msg","账户密码输入错误，登录失败！");}else if (e instanceof BadCredentialsException) {map.put("msg","账户密码输入错误，登录失败！");}else if (e instanceof DisabledException) {map.put("msg","账户被禁用，登录失败！");}else if (e instanceof AccountExpiredException) {map.put("msg","账户已过期，登录失败！");}else if (e instanceof CredentialsExpiredException) {map.put("msg","密码已过期，登录失败！");}else {map.put("msg","登录失败");}ObjectMapper om = new ObjectMapper();out.write(om.writeValueAsString(map));out.flush();out.close();}}).and().logout().logoutUrl("/logout").clearAuthentication(true).invalidateHttpSession(true).addLogoutHandler(new LogoutHandler() {//退出@Overridepublic void logout(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) {}}).logoutSuccessHandler(new LogoutSuccessHandler() {//退出成功@Overridepublic void onLogoutSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {httpServletResponse.sendRedirect("/login_page");}}).permitAll().and().csrf().disable();}
}

3）、密码加密

@Bean
public PasswordEncoder passwordEncoder() {return new BCryptPasswordEncoder();
}

4)、方法安全使用 @EnableGlobalMethodSecurity

prePostEnabled = true 会解锁@PreAuthorize 和@PostAuthorize两个注解

以上是基于内存认证的spring security，下节我们继续讲spring security 怎么基于数据库认证！

spring boot 整合security相关推荐

Spring Boot整合Security系列步骤及问题排查（十一）—— 集成QQ登录
工具类准备: Repository: Connection: ConnectionFactory(ServiceProvider.ApiAdapter): ServiceProvider(OAuth2 ...
Spring Boot整合Security+Swagger2踩坑记录,Swagger2无法访问首页
问题: 访问不了Swagger的页面有可能出现的原因: 1.Security将访问拦截掉了 2.给拦截器拦截了 3.Swagger返回的结果,被自己定义的拦截器or其他方式给篡改了数据,导致无法正常 ...
解决Spring Boot 整合Security后，所有接口提示Unauthorized、返回401
解决办法在启动类前的@SpringBootApplication注解中加入exclude属性SecurityAutoConfiguration和ManagementWebSecurityAutoCo ...
spring boot整合security时候处理静态资源拦截问题
添加上箭头注意写法和对应项目中的实际路径包名/css/**的意思可以跨包访问css下的所有文件与包
spring boot整合spring security笔记
最近自己做了一个小项目,正在进行springboot和spring Security的整合,有一丢丢的感悟,在这里分享一下: 首先,spring boot整合spring security最好是使用T ...
Spring boot 整合Spring Security Jwt
记录学习Spring boot 整合Spring Security Jwt 学习参考 – 慢慢的干货 https://shimo.im/docs/OnZDwoxFFL8bnP1c/read 首先创建S ...
认证与授权流程与spring boot整合 spring security（1）
一 spring security 1.1 spring security的作用 Spring Security所解决的问题就是安全访问控制,而安全访问控制功能其实就是对所有进入系统的请求进行拦截 ...
Spring Boot(十四)：spring boot整合shiro-登录认证和权限管理
Spring Boot(十四):spring boot整合shiro-登录认证和权限管理使用Spring Boot集成Apache Shiro.安全应该是互联网公司的一道生命线,几乎任何的公司都会涉 ...
spring boot整合cxf发布和调用webservice
一.前言说起web service最近几年restful大行其道,大有取代传统soap web service的趋势,但是一些特有或相对老旧的系统依然使用了传统的soap web service,例 ...

spring boot 整合security

spring boot 整合security相关推荐

最新文章

热门文章