springboot（4）：整合spring security

原创

八点博客 2022-09-09 10:11:47 ©著作权

©著作权归作者所有：来自51CTO博客作者八点博客的原创作品，请联系作者获取转载授权，否则将追究法律责任

1、引入依赖（只列举部分）

 <dependency>
     <groupId>org.thymeleaf.extras</groupId>
     <artifactId>thymeleaf-extras-springsecurity5</artifactId>
</dependency>

<dependency>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-test</artifactId>
   <scope>test</scope>
</dependency>

2、RouteController.java中写入

package com.example.demo5;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
public class RouteController {
    @RequestMapping({"/","/index"})
    public String index(){
        return "index";
    }

    @RequestMapping("toLogin")
    public String toLogin(){
        return "views/login";
    }

    @RequestMapping("/level1/{id}")
    public String level1(@PathVariable("id") int id){
        return "views/level1/" + id;
    }

    @RequestMapping("/level2/{id}")
    public String level2(@PathVariable("id") int id){
        return "views/level2/" + id;
    }

    @RequestMapping("/level3/{id}")
    public String level3(@PathVariable("id") int id){
        return "views/level3/" + id;
    }
}

3、Config.java配置文件

package com.example.demo5;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@EnableWebSecurity

public class Security extends WebSecurityConfigurerAdapter {
    //授权
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception{
        //super.configure(httpSecurity);
        httpSecurity.authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/level1/**").hasRole("vip1")
                .antMatchers("/level2/**").hasRole("vip2")
                .antMatchers("/level3/**").hasRole("vip3");

        httpSecurity.formLogin().loginPage("/toLogin");

        httpSecurity.csrf().disable();
        httpSecurity.logout().logoutSuccessUrl("/");

        httpSecurity.rememberMe();
    }
    //认证
    @Override
    protected void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception{
        authenticationManagerBuilder.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                .withUser("v1").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1")
                .and()
                .withUser("v2").password(new BCryptPasswordEncoder().encode("123456")).roles("vip2")
                .and()
                .withUser("v3").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1", "vip2", "vip3");

    }
}

4、前端页面显示

<!DOCTYPE html>
<html lang="en"
      xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4"
>
<body>
  
                <!--未登录-->
                <div sec:authorize="!isAuthenticated()">
                    <a class="item" th:href="@{/toLogin}">
                        <i class="address card icon"></i> 登录
                    </a>
                </div>
                <!--已登录-->
                <div sec:authorize="isAuthenticated()">

                    <a class="item">
                        用户名：<span sec:authentication="name"></span>
                        角色：<span sec:authentication="principal.authorities"></span>
                    </a>

                    <a class="item" th:href="@{/logout}">
                        <i class="address card icon"></i> 注销
                    </a>
                </div>
               

            <div sec:authorize="hasRole('vip1')">
                  vip1能看到的内容    
            </div>

            <div class="column" sec:authorize="hasRole('vip1')">
                 vip2能看到的内容    
            </div>

          
</body>
</html>