SpringSecurity配置403权限访问页面

妖狐艹你老母 2022-10-07 13:48 207阅读 0赞

### SpringSecurity配置403权限访问页面 ###

*  1、未配置之前
 *  2、开始配置
 *   *  2.1 新建一个unauth.html
     *  2.2 在继承WebSecurityConfigurerAdapter的配置类中设置
     *  2.3 继承UserDetailsService接口的实现类
 *  3、测试

# 1、未配置之前 #

![在这里插入图片描述][2021061812053576.png]

# 2、开始配置 #

## 2.1 新建一个unauth.html ##

<!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <title>Title</title>
    </head>
    <body>
    <h1>没有访问的权限</h1>
    </body>
    </html>

## 2.2 在继承WebSecurityConfigurerAdapter的配置类中设置 ##

关键代码：

//配置没有权限访问自定义跳转的页面
      http.exceptionHandling()
      .accessDeniedPage("/unauth.html");

配置类完整代码：

package com.atguigu.springsecuritydemo1.config;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.crypto.password.PasswordEncoder;
    
    @Configuration
    public class SecurityConfigTest extends WebSecurityConfigurerAdapter { 
    
        @Autowired
        private UserDetailsService userDetailsService;
    
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
            auth.userDetailsService(userDetailsService).passwordEncoder(password());
        }
    
        @Bean
        PasswordEncoder password(){ 
           return new BCryptPasswordEncoder();
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception { 
            //退出配置
            http.logout().logoutUrl("/logout")
                    .logoutSuccessUrl("/test/hello")
                    .permitAll();
    
            //配置没有权限访问自定义跳转的页面
            http.exceptionHandling().accessDeniedPage("/unauth.html");
            http.formLogin()             //自定义自己编写的登陆页面
                .loginPage("/login.html")    //登录页面设置
                .loginProcessingUrl("/user/login") //登录访问路径
                .defaultSuccessUrl("/success.html").permitAll()    //登录成功之后，跳转路径
                .and().authorizeRequests()
                   //设置哪些路径可以直接访问，不需要认证
                    .antMatchers("/","/test/hello","/user/login").permitAll()
                    //当前登录的用户，只有具有admins权限才可以访问这个路径
                   //1、hasAuthority方法
                   //.antMatchers("/test/index").hasAuthority("admins")
                   //2、hasAnyAuthority方法
                  // .antMatchers("/test/index").hasAnyAuthority("admins,manager")
                  //3、hasRole方法 ROLE_sale
                   .antMatchers("/test/index").hasRole("sale")
                    //4、hasAnyRole方法
    
                .anyRequest().authenticated()
                .and().csrf().disable();    //关闭csrf防护
        }
    }

## 2.3 继承UserDetailsService接口的实现类 ##

package com.atguigu.springsecuritydemo1.service;
    
    import com.atguigu.springsecuritydemo1.entity.Users;
    import com.atguigu.springsecuritydemo1.mapper.UsersMapper;
    import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.authority.AuthorityUtils;
    import org.springframework.security.core.userdetails.User;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.stereotype.Service;
    
    import java.util.List;
    
    @Service("userDetailsService")
    public class MyUserDetailService implements UserDetailsService { 
    
        @Autowired
        private UsersMapper usersMapper;
    
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { 
    
            //调用userMapper中的方法，根据用户名查询数据库
            QueryWrapper<Users> wrapper=new QueryWrapper<>();//条件构造器
            //where username=?
            wrapper.eq("username",username);
            Users users= usersMapper.selectOne(wrapper);
            //判断
            if(users==null){     //数据库没有用户名，认证失败
                throw new UsernameNotFoundException("用户名不存在！");
            }
    
            List<GrantedAuthority> auths= AuthorityUtils.commaSeparatedStringToAuthorityList("admins,ROLE_sale");
            //从查询数据库返回user对象，得到用户名和密码，返回
            return new User(users.getUsername(),new BCryptPasswordEncoder().encode(users.getPassword()),auths);
        }
    
    }

# 3、测试 #

现在我故意将原先的sale改为sale1制造错误  
![在这里插入图片描述][20210618121102777.png]  
启动项目并访问`http://localhost:8111/test/index`  
![在这里插入图片描述][2021061812121212.png]  
输入lucy 123  
![在这里插入图片描述][20210618121634632.png]  
成功实现

[2021061812053576.png]: /images/20221005/e4c4c1c9ee014c8f9539f0d7ca37c181.png
[20210618121102777.png]: /images/20221005/d0699f92277a4bbb869ea5ee65a2a8c7.png
[2021061812121212.png]: /images/20221005/b5ff6d11335c449c9057e9f53935456a.png
[20210618121634632.png]: /images/20221005/c3daca9e467f4a628907319b05555f56.png