SpringSecurity安全框架

绝地灬酷狼 2022-04-23 03:12 363阅读 0赞

##### 框架简介: #####

Spring Security 是一个能够为基于 Spring 的企业应用系统提供声明式的安全访问控制解决方案的安全框架；它提供了一组可以在 Spring 应用上下文中配置的 Bean，充分利用了 Spring IoC， DI 和 AOP 功能，为应用系统提供声明式的安全访问控制功能，减少了为企业系统安全控制编写大量重复代码的工作。

简单的说，就是我们可以控制用户登陆的权限，通过配置让不同权限的用户登录后所看到页面不同，所能操作的内容也不同，本篇博客介绍security简单的配置和使用。

##### 环境搭建 #####

**目录结构:**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzQ2NDk2NA_size_16_color_FFFFFF_t_70]  
**1.POM文件**

<?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
    
        <groupId>cn.itcast</groupId>
        <artifactId>spring-security-demo</artifactId>
        <version>1.0-SNAPSHOT</version>
        <packaging>war</packaging>
    
    
        <properties>
            <spring.version>4.2.4.RELEASE</spring.version>
        </properties>
    
        <dependencies>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-core</artifactId>
                <version>${spring.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-web</artifactId>
                <version>${spring.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-webmvc</artifactId>
                <version>${spring.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-context-support</artifactId>
                <version>${spring.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-test</artifactId>
                <version>${spring.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-jdbc</artifactId>
                <version>${spring.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-web</artifactId>
                <version>4.1.0.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-config</artifactId>
                <version>4.1.0.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>javax.servlet</groupId>
                <artifactId>servlet-api</artifactId>
                <version>2.5</version>
                <scope>provided</scope>
            </dependency>
        </dependencies>
        <build>
            <plugins>
                
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.2</version>
                    <configuration>
                        <source>1.7</source>
                        <target>1.7</target>
                        <encoding>UTF-8</encoding>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.tomcat.maven</groupId>
                    <artifactId>tomcat7-maven-plugin</artifactId>
                    <configuration>
                        
                        <port>9090</port>
                        
                        <path>/</path>
                    </configuration>
                </plugin>
            </plugins>
        </build>
    </project>

**2.测试用的首页Index.html**

<!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <title>首页</title>
    </head>
    <body>
    <h3>Hello My Cookie !</h3>
    </body>
    </html>

**3. web.xml**

<?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
             version="3.1">
    
        <context-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath:spring-security.xml</param-value>
        </context-param>
        <listener>
            <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
        </listener>
    
        
        <filter>
            <filter-name>springSecurityFilterChain</filter-name>
            <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        </filter>
        <filter-mapping>
            <filter-name>springSecurityFilterChain</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        
        <welcome-file-list>
            <welcome-file>index.html</welcome-file>
        </welcome-file-list>
    </web-app>

**4.security配置文件spring-security.xml**

<?xml version="1.0" encoding="UTF-8"?>
    <beans:beans xmlns="http://www.springframework.org/schema/security"
                 xmlns:beans="http://www.springframework.org/schema/beans"
                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                 xsi:schemaLocation="http://www.springframework.org/schema/beans
                http://www.springframework.org/schema/beans/spring-beans.xsd
                http://www.springframework.org/schema/security
                http://www.springframework.org/schema/security/spring-security.xsd">
    
        
        
        <http use-expressions="false">
            
            
            
            <intercept-url pattern="/**" access="ROLE_USER"/>
            
            <form-login/>
        </http>
    
        
        <authentication-manager>
            <authentication-provider>
                <user-service>
                
                    <user name="admin" password="123456" authorities="ROLE_USER"/>
                </user-service>
            </authentication-provider>
        </authentication-manager>
    </beans:beans>

##### 测试环境： #####

启动服务器,访问 localhost:9090 ，本来我们应该是能够直接进入指定的 index.html 首页，但是安全控制器拦截下了我们，并且跳转到了系统自动生成的login页面  
![在这里插入图片描述][20190123153141842.PNG]  
我们在输入了自定义的账号和密码后才能够正常访问页面，这里Spring Security框架的作用就体现出来了， 他能够帮助我们控制用户的权限，让不同权限的用户访问同一页面的内容不同，从而增加应用的安全性。

实际的开发中，我们会使用自己定义的界面作为跳转的界面，下面简单介绍下如何配置：  
**自定义的登陆页面:**

<!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <title>登陆</title>
    </head>
    <body>
    
    <form action='/login' method='POST'>
        <table>
            <tr>
                <td>用户名:</td>
                <td><input type='text' name='username' value=''></td>
            </tr>
            <tr>
                <td>密码:</td>
                <td><input type='password' name='password'/></td>
            </tr>
            <tr>
                <td colspan='2'><input name="submit" type="submit"
                                       value="登陆"/></td>
            </tr>
        </table>
    </form>
    
    </body>
    </html>

**登陆失败的页面:**

<!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <title>登陆失败</title>
    </head>
    <body>
    
    <h3 style="color : red;">验证失败 !</h3>
    </body>
    </html>

**修改spring-security.xml配置文件:**

**首先，要看配置我们自定义的页面不被拦截：**

<http pattern="/login.html" security="none"></http>
        <http pattern="/login_error.html" security="none"></http>

**设置表单登陆:**

<form-login  login-page="/login.html" authentication-failure-url="/login_error.html"
                         default-target-url="/index.html"/>

关闭 csrf，如果不关登录后不管成功或者失败都会报错误：

CSRF（Cross-site request forgery）：跨站请求伪造，也被称为“One Click Attack”或者 SessionRiding，通常缩写为 CSRF 或者 XSRF，是一种对网站的恶意利用。

当使用html页面时，不关闭就会报错：  
![在这里插入图片描述][20190124095248675.PNG]  
**整体spring-security.xml配置文件：**

<?xml version="1.0" encoding="UTF-8"?>
    <beans:beans xmlns="http://www.springframework.org/schema/security"
                 xmlns:beans="http://www.springframework.org/schema/beans"
                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                 xsi:schemaLocation="http://www.springframework.org/schema/beans
                http://www.springframework.org/schema/beans/spring-beans.xsd
                http://www.springframework.org/schema/security
                http://www.springframework.org/schema/security/spring-security.xsd">
    
        
        <http pattern="/login.html" security="none"></http>
        <http pattern="/login_error.html" security="none"></http>
    
        
        
        <http use-expressions="false">
            
            
            
            <intercept-url pattern="/**" access="ROLE_USER"/>
    
    
            
            
            <form-login  login-page="/login.html" authentication-failure-url="/login_error.html"
                         default-target-url="/index.html"/>
    
            
            <csrf disabled="true"/>
        </http>
    
        
        <authentication-manager>
            <authentication-provider>
                <user-service>
                    <user name="admin" password="123456" authorities="ROLE_USER"/>
                </user-service>
            </authentication-provider>
        </authentication-manager>
    
    </beans:beans>

*谢谢 ！*

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzQ2NDk2NA_size_16_color_FFFFFF_t_70]: /images/20220323/dbec0933cc0b48a5b833cc97859b02b4.png
[20190123153141842.PNG]: /images/20220323/5e51a795998249cb85500bacd381f2b3.png
[20190124095248675.PNG]: /images/20220323/364f4e3edd7e4ac19dc2da987122ef86.png