SpringBoot+SpringSecurity基本使用及个性化登录配置详解

  ...
    
      org.springframework.boot
      spring-boot-starter-security
    
  ...

@RestController
@RequestMapping("/user")
public class UserController {
  @GetMapping
  public String getUsers() {    
    return "Hello Spring Security";
  }
}

# security 使能
security.basic.enabled = false

@Configuration
public class BrowerSecurityConfig extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.formLogin()          // 定义当需要用户登录时候，转到的登录页面。
        .and()
        .authorizeRequests()    // 定义哪些URL需要被保护、哪些不需要被保护
        .anyRequest()        // 任何请求,登录后可以访问
        .authenticated();
  }
}

@Component
public class MyUserDetailsService implements UserDetailsService {

  private Logger logger = LoggerFactory.getLogger(getClass());

  @Override
  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    logger.info("用户的用户名: {}", username);
    // TODO 根据用户名，查找到对应的密码，与权限

    // 封装用户信息，并返回。参数分别是：用户名，密码，用户权限
    User user = new User(userame, "123456",
              AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));
    return user;
 }
}

public interface UserDetails extends Serializable {
  // 封装了权限信息
  Collection<? extends GrantedAuthority> getAuthorities();
  // 密码信息
  String getPassword();
  // 登录用户名
  String getUsername();
  // 帐户是否过期
  boolean isAccountNonExpired();
  // 帐户是否被冻结
  boolean isAccountNonLocked();
  // 帐户密码是否过期，一般有的密码要求性高的系统会使用到，比较每隔一段时间就要求用户重置密码
  boolean isCredentialsNonExpired();
  // 帐号是否可用
  boolean isEnabled();
}

public interface PasswordEncoder {
  // 对密码进行加密
  String encode(CharSequence var1);
  // 对密码进行判断匹配
  boolean matches(CharSequence var1, String var2);
}

// BrowerSecurityConfig 
@Bean
public PasswordEncoder passwordEncoder() {
   return new BCryptPasswordEncoder();
 }

@Component
public class MyUserDetailsService implements UserDetailsService {


  private Logger logger = LoggerFactory.getLogger(getClass());

  @Autowired
  private PasswordEncoder passwordEncoder;

  @Override
  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    logger.info("用户的用户名: {}", username);

    String password = passwordEncoder.encode("123456");
    logger.info("password: {}", password);

    // 参数分别是：用户名，密码，用户权限
    User user = new User(username, password, AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));
    return user;
  }
}

  
  


  
自定义登录页面
  

    

      

        
用户名：
        

      
      

        
密码：
        

      
      

        
登录
      
    
  

// BrowerSecurityConfig.java
@Override
protected void configure(HttpSecurity http) throws Exception {
  http.formLogin()          // 定义当需要用户登录时候，转到的登录页面。
      .loginPage("/login.html")      // 设置登录页面
      .loginProcessingUrl("/user/login") // 自定义的登录接口
      .and()
      .authorizeRequests()    // 定义哪些URL需要被保护、哪些不需要被保护
      .antMatchers("/login.html").permitAll()   // 设置所有人都可以访问登录页面
      .anyRequest()        // 任何请求,登录后可以访问
      .authenticated()
      .and()
      .csrf().disable();     // 关闭csrf防护
}

@RestController
public class BrowserSecurityController {

  private Logger logger = LoggerFactory.getLogger(getClass());

  // 原请求信息的缓存及恢复
  private RequestCache requestCache = new HttpSessionRequestCache();

  // 用于重定向
  private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

  /**
   * 当需要身份认证的时候，跳转过来
   * @param request
   * @param response
   * @return
   */
  @RequestMapping("/authentication/require")
  @ResponseStatus(code = HttpStatus.UNAUTHORIZED)
  public BaseResponse requireAuthenication(HttpServletRequest request, HttpServletResponse response) throws IOException {
    SavedRequest savedRequest = requestCache.getRequest(request, response);

    if (savedRequest != null) {
      String targetUrl = savedRequest.getRedirectUrl();
      logger.info("引发跳转的请求是:" + targetUrl);
      if (StringUtils.endsWithIgnoreCase(targetUrl, ".html")) {
        redirectStrategy.sendRedirect(request, response, "/login.html");
      }
    }

    return new BaseResponse("访问的服务需要身份认证，请引导用户到登录页");
  }
}

@Component("myAuthenctiationSuccessHandler")
public class MyAuthenctiationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {

  private Logger logger = LoggerFactory.getLogger(getClass());

  @Autowired
  private ObjectMapper objectMapper;

  @Override
  public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                    Authentication authentication) throws IOException, ServletException {

    logger.info("登录成功");

    response.setContentType("application/json;charset=UTF-8");
    response.getWriter().write(objectMapper.writeValueAsString(authentication));
  }
}

@Component("myAuthenctiationFailureHandler")
public class MyAuthenctiationFailureHandler extends SimpleUrlAuthenticationFailureHandler {

  private Logger logger = LoggerFactory.getLogger(getClass());

  @Autowired
  private ObjectMapper objectMapper;

  @Override
  public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
                    AuthenticationException exception) throws IOException, ServletException {

    logger.info("登录失败");

    response.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());
    response.setContentType("application/json;charset=UTF-8");
    response.getWriter().write(objectMapper.writeValueAsString(new BaseResponse(exception.getMessage())));
  }
}

.successHandler(myAuthenticationSuccessHandler) // 自定义登录成功处理 
.failureHandler(myAuthenticationFailureHandler) // 自定义登录失败处理