Spring Security笔记(1)

Spring Security是Spring的一个功能模块，用来验证用户、授权资源访问

Spring Security演示项目搭建

1. pom文件

   pom使用springboot的parent作为依赖，并依赖spring-boot-starter-web和spring-boot-starter-security

   <?xml version="1.0" encoding="UTF-8"?>
   <project xmlns="http://maven.apache.org/POM/4.0.0"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
       <modelVersion>4.0.0</modelVersion>
   
       <groupId>org.example</groupId>
       <artifactId>springsecurity-demo</artifactId>
       <version>1.0-SNAPSHOT</version>
   
       <parent>
           <groupId>org.springframework.boot</groupId>
           <artifactId>spring-boot-starter-parent</artifactId>
           <version>2.3.3.RELEASE</version>
       </parent>
   
       <dependencies>
           <dependency>
               <groupId>org.springframework.boot</groupId>
               <artifactId>spring-boot-starter-web</artifactId>
           </dependency>
           <dependency>
               <groupId>org.springframework.boot</groupId>
               <artifactId>spring-boot-starter-security</artifactId>
           </dependency>
           <dependency>
               <groupId>org.springframework.boot</groupId>
               <artifactId>spring-boot-starter-test</artifactId>
               <scope>test</scope>
               <exclusions>
                   <exclusion>
                       <groupId>org.junit.vintage</groupId>
                       <artifactId>junit-vintage-engine</artifactId>
                   </exclusion>
               </exclusions>
           </dependency>
       </dependencies>
   
       <build>
           <plugins>
               <plugin>
                   <groupId>org.springframework.boot</groupId>
                   <artifactId>spring-boot-maven-plugin</artifactId>
                   <version>2.3.3.RELEASE</version>
               </plugin>
           </plugins>
       </build>
   
   
   </project>

1. security的配置类

   package com.roman.security.demo.config;
   
   import org.springframework.context.annotation.Configuration;
   import org.springframework.security.config.annotation.web.builders.HttpSecurity;
   import org.springframework.security.config.annotation.web.builders.WebSecurity;
   import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
   import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
   
   @Configuration
   @EnableWebSecurity
   public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
       @Override
       public void configure(WebSecurity web) throws Exception {
           web.ignoring().antMatchers("/js/**", "/css/**", "/images/**");
       }
   
       @Override
       protected void configure(HttpSecurity http) throws Exception {
           http.authorizeRequests()
                   .antMatchers("/").permitAll()
                   .anyRequest().authenticated()
                   .and()
                   .logout().permitAll()
                   .and().formLogin();
           http.cors().disable();
       }
   }

   logout是可以进行登出操作

   常见的应用场景

   能登录即可

   @Bean
       public UserDetailsService users() {
           UserDetails user = User.builder()
                   .username("user")
                   .password("{bcrypt}$2a$10$GRLdNijSQMUvl/au9ofL.eDwmoohzzS7.rmNSJZ.0FxO/BTk76klW")
                   .roles("USER")
                   .build();
           UserDetails admin = User.builder()
                   .username("admin")
                   .password("{bcrypt}$2a$10$GRLdNijSQMUvl/au9ofL.eDwmoohzzS7.rmNSJZ.0FxO/BTk76klW")
                   .roles("USER", "ADMIN")
                   .build();
           return new InMemoryUserDetailsManager(user, admin);
       }

   基于内存的验证

   有指定的角色和权限

   package com.roman.security.demo.controllers;
   
   import org.springframework.security.access.prepost.PreAuthorize;
   import org.springframework.web.bind.annotation.RequestMapping;
   import org.springframework.web.bind.annotation.RestController;
   
   @RestController
   public class IndexController {
       @RequestMapping("/")
       public String index() {
           return "index";
       }
   
       @RequestMapping("/hello")
       public String hello() {
           return "hellow";
       }
   
       @PreAuthorize("hasRole('ROLE_ADMIN')")
       @RequestMapping("/admin")
       public String admin() {
           return "admin";
       }
   }

   指定/admin能由谁来访问:角色是admin的用户可以访问，生效的条件是要在配置类上加@EnableGlobalMethodSecurity(prePostEnabled = true)