SpringSecurity+Mybatis实现用户自助注册登录(含角色)，打造简单安全的注册登录页面。

#项目架构、功能点

架构：

Springboot2.5.+
MySQL数据库8.0+（记录用户信息、角色清单、用户角色对照表）
持久层Mybatis
用户注册页面RegisterPage采用Thymeleaf动态网页
登录页面Login采用SpringSecurity标准表单登录网页

功能点：

实现用户自助注册登录
实现用户自助选择角色
用户信息、角色清单、用户角色对照表采用SpringSecurity标准架构
用户密码采用SpringSecurity首推的BCryptPasswordEncoder加密算法记录
实现登陆后URL访问与角色对应

#用户自助注册及登录流程图

#项目文件结构、数据库设计、Maven依赖、aplication配置

文件结构：

数据库设计：

user表，记录用户信息

role表，记录角色清单

user_role表，用户角色对照表

Maven依赖：

        <!--Spring Security--><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId></dependency><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-web</artifactId></dependency><!--mybatis--><dependency><groupId>org.mybatis.spring.boot</groupId><artifactId>mybatis-spring-boot-starter</artifactId><version>2.2.0</version></dependency><!--Mysql--><dependency><groupId>mysql</groupId><artifactId>mysql-connector-java</artifactId><scope>runtime</scope></dependency><!--Thymeleaf--><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-thymeleaf</artifactId></dependency>

因为使用Mybatis，所以build要添加XML资源目录，否则编译会缺少UserMapper.XML。

        <resources><resource><!-- XML默认是放在resource下面，如果有自定义，需要把resource加上 --><directory>src/main/java</directory><includes><include>**/*.xml</include></includes></resource><resource><directory>src/main/resources</directory></resource></resources>

aplication配置：

#datasource mybatis配置--------------------------------
spring.datasource.url=jdbc:mysql://127.0.0.1:3306/jpa?characterEncoding=UTF-8
spring.datasource.username=root
spring.datasource.password=12345678
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
#datasource mybatis配置--------------------------------
#thymeleaf配置--------------------------------
spring.thymeleaf.cache=true
spring.thymeleaf.checktemplate=true
spring.thymeleaf.check-template-location=true
spring.thymeleaf.encoding=UTF-8
spring.thymeleaf.servlet.content-type=text/html
spring.thymeleaf.suffix=.html
spring.thymeleaf.prefix=classpath:/templates/
#Thymeleaf配置--------------------------------

#用户前端注册页面registerPage.html代码(Thymeleaf模板动态网页)

这里通过用户注册接口registerController去数据库查询角色清单(role表)，将查询结果写入roles集合中，通过Thymeleaf模板进行调用并加入select-option选择列表，供用户注册时选择某一角色。

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head><meta charset="UTF-8"><title>新用户注册</title>
</head>
<body><h2 align="center">新用户注册</h2><hr width="40%" color="gray"/><form action="/doregister" method="post" enctype="application/x-www-form-urlencoded"><table width="40%" bgcolor="gray" align="center"><tr><td align="right">用户名：</td><td><input type="text" name="username" size="25px" maxlength="10" placeholder="请输入用户名最长10位" required/></td></tr><tr><td align="right">密码：</td><td><input type="password" name="password" size="25px" maxlength="20" placeholder="请输入密码最长20位" required></td></tr><tr><td align="right">角色：</td><td><label><select name="role"><option>--请选择角色--</option><option th:each="role:${roles}"th:value="${role.id}"th:text="${role.nameZH}"th:selected="${role==role.id}"></option></select></label></td></tr><tr><td align="right"><input type="submit" value="提交注册"></td><td></td></tr></table></form>
</body>
</html>

#实体类、Mybatis持久层接口、用户服务类、用户注册及登录接口

角色实体类Role：

package com.example.springsecurity.Entity;
import java.io.Serializable;
public class Role implements Serializable {private Integer id;private String name;private String nameZH;public Integer getId() {return id;}public void setId(Integer id) {this.id = id;}public String getName() {return name;}public void setName(String name) {this.name = name;}public String getNameZH() {return nameZH;}public void setNameZH(String nameZH) {this.nameZH = nameZH;}
}

用户实体类User(包含所具有的角色) ：

该实体类主要用于用户登录，需要使用标准的UserDetails接口。

package com.example.springsecurity.Entity;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
public class User implements UserDetails {private Integer id;private String username;private String password;private Boolean enabled;private Boolean locked;private List<Role> roles;@Overridepublic Collection<? extends GrantedAuthority> getAuthorities(){List<SimpleGrantedAuthority> authorities= new ArrayList<>();for (Role r:roles){authorities.add(new SimpleGrantedAuthority(r.getName()));}return authorities;}@Overridepublic String getPassword(){return password;}@Overridepublic String getUsername(){return username;}@Overridepublic boolean isAccountNonExpired(){return true;}@Overridepublic boolean isAccountNonLocked(){return true;}@Overridepublic boolean isCredentialsNonExpired(){return true;}@Overridepublic boolean isEnabled(){return true;}public Integer getId() {return id;}public void setId(Integer id) {this.id = id;}public void setUsername(String username) {this.username = username;}public void setPassword(String password) {this.password = password;}public Boolean getEnabled() {return enabled;}public void setEnabled(Boolean enabled) {this.enabled = enabled;}public Boolean getLocked() {return locked;}public void setLocked(Boolean locked) {this.locked = locked;}public List<Role> getRoles() {return roles;}public void setRoles(List<Role> roles) {this.roles = roles;}
}

用户注册实体类UserRegister(包含用户需要申请的角色) ：

该实体类主要用于用户注册。

package com.example.springsecurity.Entity;
public class UserRegister {private Integer id;private String username;private String password;private Boolean enabled;private Boolean locked;private Integer role;public Integer getId() {return id;}public void setId(Integer id) {this.id = id;}public String getUsername() {return username;}public void setUsername(String username) {this.username = username;}public String getPassword() {return password;}public void setPassword(String password) {this.password = password;}public Boolean getEnabled() {return enabled;}public void setEnabled(Boolean enabled) {this.enabled = enabled;}public Boolean getLocked() {return locked;}public void setLocked(Boolean locked) {this.locked = locked;}public Integer getRole() {return role;}public void setRole(Integer role) {this.role = role;}
}

Mybatis持久层接口：

主要包含UserMapper.xml和UserMapper interface，包含：

loadUserByUsername方法，通过用户名查询用户

getUserRolesByUid方法，通过用户ID获取用户所有角色

addUserByUsername方法，通过UserRegister实体类注册新用户

getAllRole方法，获取当前系统所有角色

addRole方法，通过用户ID和角色ID，给用户添加角色

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapperPUBLIC "-//mybatis.org//DTD Mapper 3.0//EN""http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.example.springsecurity.Repository.UserMapper"><select id="loadUserByUsername" resultType="com.example.springsecurity.Entity.User">select * from user where username=#{username}</select><select id="getUserRolesByUid" resultType="com.example.springsecurity.Entity.Role">select * from role r,user_role ur where r.id=ur.rid and ur.uid=#{id}</select><insert id="addUserByUsername" parameterType="com.example.springsecurity.Entity.UserRegister">insert into user(username,password,enabled,locked) values(#{username},#{password},#{enabled},#{locked})</insert><select id="getAllRole" resultType="com.example.springsecurity.Entity.Role">select * from role</select><insert id="addRole">insert into user_role(uid,rid) values(#{uid},#{rid})</insert>
</mapper>

package com.example.springsecurity.Repository;
import com.example.springsecurity.Entity.Role;
import com.example.springsecurity.Entity.User;
import com.example.springsecurity.Entity.UserRegister;
import org.apache.ibatis.annotations.Mapper;
import java.util.List;
@Mapper
public interface UserMapper {User loadUserByUsername(String username);List<Role> getUserRolesByUid(Integer id);int addUserByUsername(UserRegister userRegister);List<Role> getAllRole();int addRole(Integer uid,Integer rid);
}

用户服务类UserService：

是上述接口方法的实现类，包含：

loadUserByUsername实现方法，用于查询用户以及所具有的角色

addUserByUsername实现方法，用于实现用户注册以及角色注册

getAllRole实现方法，用户查询所有角色清单

package com.example.springsecurity.Service;
import com.example.springsecurity.Entity.Role;
import com.example.springsecurity.Entity.User;
import com.example.springsecurity.Entity.UserRegister;
import com.example.springsecurity.Repository.UserMapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;
import java.util.List;
@Service
public class UserService implements UserDetailsService {@AutowiredUserMapper userMapper;@Overridepublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException{User user = userMapper.loadUserByUsername(username);if(user == null){throw new UsernameNotFoundException("账户不存在！");}user.setRoles(userMapper.getUserRolesByUid(user.getId()));return user;}public String addUserByUsername(UserRegister userRegister){User newuser = userMapper.loadUserByUsername(userRegister.getUsername());if (newuser != null){return "账户存在，注册失败！";}else {//新用户密码采用BCryptPasswordEncoder(10)格式存入数据库userRegister.setPassword(new BCryptPasswordEncoder(10).encode(userRegister.getPassword()));//设置用户状态可用，没有锁定userRegister.setEnabled(true);userRegister.setLocked(false);//执行用户注册int adduser = userMapper.addUserByUsername(userRegister);//用户成功注册后，添加用户角色if(adduser > 0){User getuser =userMapper.loadUserByUsername(userRegister.getUsername());int addrole = userMapper.addRole(getuser.getId(),userRegister.getRole());if (addrole > 0){return "账户注册成功，角色注册成功！";}else{return "账户注册成功！角色注册失败！";}}else {return "账户注册失败！";}}}public List<Role> getAllRole(){return userMapper.getAllRole();}
}

登录接口：

登录接口包含：

registerController用户注册接口

doRegisterController执行用户注册接口及返回注册结果

HelloController登录接口

package com.example.springsecurity.Controller;
import com.example.springsecurity.Service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.servlet.ModelAndView;
@Controller
public class registerController {@AutowiredUserService userService;@GetMapping("/register")//registerController用户注册接口,将所有角色信息数据库取值并绑定roles赋给前端registerPage.htmlpublic ModelAndView resgister(){ModelAndView mv = new ModelAndView();mv.addObject("roles",userService.getAllRole());mv.setViewName("registerPage");return mv;}
}

package com.example.springsecurity.Controller;
import com.example.springsecurity.Entity.UserRegister;
import com.example.springsecurity.Service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class doRegisterController {@AutowiredUserService userService;@PostMapping("/doregister")//doRegisterController执行用户注册接口及返回注册结果public String doregister(UserRegister userRegister){return userService.addUserByUsername(userRegister);}
}

package com.example.springsecurity.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
//HelloController登录接口，URL访问权限控制，分别对应不同的角色方能访问
public class HelloController {@GetMapping("/admin/hello")public String admin(){return "hello admin";}@GetMapping("/user/hello")public String user(){return "hello user";}@GetMapping("/db/hello")public String dba(){return "hello dba";}@GetMapping("/hello")public String hello(){return "hello";}
}

#Spring Security核心配置类WebSecurityLoginConfig

①注入用户服务类用于登录验证。

②配置用户登录密码需要BCryptPasswordEncoder(10)密文认证。

③对可访问资源URL限定固定的角色方能访问。

④用户注册接口和执行用户注册接口允许访问。

⑤成功登陆后跳转hello接口。

package com.example.springsecurity.Config;
import com.example.springsecurity.Service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.Authentication;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
@Configuration
public class WebSecurityLoginConfig extends WebSecurityConfigurerAdapter {//注入用户服务@AutowiredUserService userService;//配置用户登录密码需要BCryptPasswordEncoder密文认证@BeanPasswordEncoder passwordEncoder(){return new BCryptPasswordEncoder(10);}//基于数据库的用户账号密码、角色、过期、锁定等认证@Overrideprotected void configure(AuthenticationManagerBuilder auth) throws Exception{auth.userDetailsService(userService);}@Overrideprotected void configure(HttpSecurity httpSecurity) throws Exception {httpSecurity.authorizeRequests()//对可访问URL资源进行角色控制.antMatchers("/admin/**").hasRole("admin").antMatchers("/user/**").access("hasAnyRole('admin','user')").antMatchers("/db/**").access("hasRole('dba') and hasRole('admin')")//用户注册接口和执行用户注册接口允许访问.antMatchers("/register","/doregister").permitAll()//用户访问其他URL资源都必须认证后访问，即登陆后访问.anyRequest().authenticated()//开启表单登录，即登录界面，登录URL为/login，登录参数用户名username密码password//Ajax或移动端通过POST请求登录，接口为/login，permitAll表示登录不需要认证即可访问.and().formLogin().loginProcessingUrl("/login").permitAll()//成功登录后跳转到hello页面.successHandler(new AuthenticationSuccessHandler() {@Overridepublic void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {response.setContentType("application/json;charset=utf-8");response.sendRedirect("/hello");}}).and().csrf().disable();}
}

#启动数据库和项目，开始验证测试

第一步测试注册：

输入用户注册接口http://localhost:8080/register，自动跳转到registerPage.html，并将所有角色信息从数据库取出赋值给前端。

提交注册，跳转到http://localhost:8080/doregister接口，返回注册结果。

数据库中user表已经新增ceshi用户。

用户角色表user_role中新增数据：ceshi用户(uid:15)对应用户角色(rid:3)。

第二步测试登录：

我们输入登录网址http://localhost:8080/login或者任意输入后缀地址，均可以访问登录接口。

用ceshi用户登陆后，具有用户角色，可以访问/user/hello接口或者hello接口，当然系统会自动跳转到hello接口页面。

当我们访问管理员接口/admin/hello接口，系统会因为缺少权限而拒绝访问Forbidden。

#总结

SpringSecurity可以非常轻松的实现用户登录验证、注册、跳转、URL接口访问控制等。

Thymeleaf可以将后端数据赋值给前端，便于前端使用，非常适合做登录网页前端设计。

Mybatis持久层非常灵活，可以实现用户自助注册、角色赋值、用户查询、角色查询等各种方法并于数据库交互，实现存储加密。

通过以上技术，我们就可以轻松打造简单安全的注册登录页面了，而不去纠结于各项安全设置和各种接口的设计。