SpringSecurity簡單入門
2022-05-31 18:00:54
1.簡介
Spring Security是一個能夠為基於Spring的企業應用系統提供宣告式的安全存取控制解決方案的安全框架。它提供了一組可以在Spring應用上下文中設定的Bean，充分利用了Spring IoC，DI（控制反轉Inversion of Control ,DI:Dependency Injection 依賴注入）和AOP（面向切面程式設計）功能，為應用系統提供宣告式的安全存取控制功能，減少了為企業系統安全控制編寫大量重複程式碼的工作。
2.入門案例(基於SpringBoot)
①建立一個SpringBoot專案,我習慣先建立maven然後匯入相關jar包
②匯入相關依賴
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.6.4</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<groupId>com.qbb.springsecurity</groupId>
<artifactId>security01</artifactId>
<version>0.0.1-SNAPSHOT</version>
<name>security01</name>
<description>Demo project for Spring Boot</description>
<properties>
<java.version>1.8</java.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<configuration>
<excludes>
<exclude>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
</exclude>
</excludes>
</configuration>
</plugin>
</plugins>
</build>
</project>
③修改SpringBoot核心組態檔application.yml
server:
port: 9001
④編寫主啟動類
package com.qbb.springsecurity.security01;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
public class Security01Application {
public static void main(String[] args) {
SpringApplication.run(Security01Application.class, args);
}
}
⑤編寫controller層
package com.qbb.springsecurity.security01.controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
/**
* @author QiuQiu&LL (部落格:https://www.cnblogs.com/qbbit)
* @version 1.0
* @date 2022-02-26 11:39
* @Description:
*/
@RestController
@RequestMapping("/test")
public class TestController {
@GetMapping("/hello")
public String hello() {
return "hello security!!!";
}
}
測試
預設的username:admin,密碼是IDEA控制檯輸出的password:Using generated security password: af1d28f2-1fde-4a68-a52e-85b7d3055a6d
3.SpringSecurity基本原理
SpringSecurity本質是一個過濾器鏈,因為我用的是SpringBoot開發,所以SpringBoot已經做了很多的自動設定 https://docs.spring.io/spring-security/site/docs/5.3.4.RELEASE/reference/html5/
4.SpringSecurity Web許可權方案
①基於組態檔的方式
spring:
security:
user:
password: qiuqiu
name: qiuqiu
②基於設定類的方式
package com.qbb.springsecurity.security01.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
/**
* @author QiuQiu&LL (部落格:https://www.cnblogs.com/qbbit)
* @version 1.0
* @date 2022-02-28 18:05
* @Description:
*/
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
BCryptPasswordEncoder bCryptPasswordEncoder = new BCryptPasswordEncoder();
String password = bCryptPasswordEncoder.encode("123");
auth.inMemoryAuthentication().withUser("qiuqiu").password(password).roles("admin");
}
@Bean
public PasswordEncoder getPasswordEncoder() {
return new BCryptPasswordEncoder();
}
}
③自定義實現類
package com.qbb.springsecurity.security01.config;
import com.qbb.springsecurity.security01.service.MyUserDetailService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
/**
* @author QiuQiu&LL (部落格:https://www.cnblogs.com/qbbit)
* @version 1.0
* @date 2022-02-28 18:05
* @Description:
*/
@Configuration
public class SecurityConfigTest extends WebSecurityConfigurerAdapter {
@Qualifier("myUserDetailService")
@Autowired
MyUserDetailService myUserDetailService;
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(myUserDetailService).passwordEncoder(getPasswordEncoder());
}
@Bean
public PasswordEncoder getPasswordEncoder() {
return new BCryptPasswordEncoder();
}
}
package com.qbb.springsecurity.security01.service;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;
import java.util.List;
/**
* @author QiuQiu&LL (部落格:https://www.cnblogs.com/qbbit)
* @version 1.0
* @date 2022-02-28 18:26
* @Description:
*/
@Service("myUserDetailService")
public class MyUserDetailService implements UserDetailsService {
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
List<GrantedAuthority> auths = AuthorityUtils.commaSeparatedStringToAuthorityList("role");
return new User("mary", new BCryptPasswordEncoder().encode("123"), auths);
}
}
工作中大部分使用第三種使用方式