手把手帶你入門(mén) Spring Security的具體流程

<dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-security</artifactId>
</dependency>

@RestController
public class HelloController {
 @GetMapping("/hello")
 public String hello() {
  return "hello";
 }
}

spring.security.user.name=javaboy
spring.security.user.password=123

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
 @Override
 protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  //下面這兩行配置表示在內(nèi)存中配置了兩個(gè)用戶(hù)
  auth.inMemoryAuthentication()
    .withUser("javaboy").roles("admin").password("$2a$10$OR3VSksVAmCzc.7WeaRPR.t0wyCsIj24k0Bne8iKWV1o.V9wsP8Xe")
    .and()
    .withUser("lisi").roles("user").password("$2a$10$p1H8iWa8I4.CA.7Z8bwLjes91ZpY.rYREGHQEInNtAp4NzL6PLKxi");
 }
 @Bean
 PasswordEncoder passwordEncoder() {
  return new BCryptPasswordEncoder();
 }
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
 @Autowired
 VerifyCodeFilter verifyCodeFilter;
 @Override
 protected void configure(HttpSecurity http) throws Exception {
  http.addFilterBefore(verifyCodeFilter, UsernamePasswordAuthenticationFilter.class);
  http
  .authorizeRequests()//開(kāi)啟登錄配置
  .antMatchers("/hello").hasRole("admin")//表示訪問(wèn) /hello 這個(gè)接口，需要具備 admin 這個(gè)角色
  .anyRequest().authenticated()//表示剩余的其他接口，登錄之后就能訪問(wèn)
  .and()
  .formLogin()
  //定義登錄頁(yè)面，未登錄時(shí)，訪問(wèn)一個(gè)需要登錄之后才能訪問(wèn)的接口，會(huì)自動(dòng)跳轉(zhuǎn)到該頁(yè)面
  .loginPage("/login_p")
  //登錄處理接口
  .loginProcessingUrl("/doLogin")
  //定義登錄時(shí)，用戶(hù)名的 key，默認(rèn)為 username
  .usernameParameter("uname")
  //定義登錄時(shí)，用戶(hù)密碼的 key，默認(rèn)為 password
  .passwordParameter("passwd")
  //登錄成功的處理器
  .successHandler(new AuthenticationSuccessHandler() {
   @Override
   public void onAuthenticationSuccess(HttpServletRequest req, HttpServletResponse resp, Authentication authentication) throws IOException, ServletException {
     resp.setContentType("application/json;charset=utf-8");
     PrintWriter out = resp.getWriter();
     out.write("success");
     out.flush();
    }
   })
   .failureHandler(new AuthenticationFailureHandler() {
    @Override
    public void onAuthenticationFailure(HttpServletRequest req, HttpServletResponse resp, AuthenticationException exception) throws IOException, ServletException {
     resp.setContentType("application/json;charset=utf-8");
     PrintWriter out = resp.getWriter();
     out.write("fail");
     out.flush();
    }
   })
   .permitAll()//和表單登錄相關(guān)的接口統(tǒng)統(tǒng)都直接通過(guò)
   .and()
   .logout()
   .logoutUrl("/logout")
   .logoutSuccessHandler(new LogoutSuccessHandler() {
    @Override
    public void onLogoutSuccess(HttpServletRequest req, HttpServletResponse resp, Authentication authentication) throws IOException, ServletException {
     resp.setContentType("application/json;charset=utf-8");
     PrintWriter out = resp.getWriter();
     out.write("logout success");
     out.flush();
    }
   })
   .permitAll()
   .and()
   .httpBasic()
   .and()
   .csrf().disable();
 }
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
 @Override
 public void configure(WebSecurity web) throws Exception {
  web.ignoring().antMatchers("/vercode");
 }
}