關於Spring Security權限控制

本文轉載自查看原文 2019-11-11 18:04 526

maven坐標

<dependencies>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>5.0.1.RELEASE</version>
</dependency>

<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>5.0.1.RELEASE</version>
</dependency>
</dependencies>

web.xml ： Delegating（委托）Filter(過濾器) Proxy(代理) DelegatingFilterProxy委托過濾器代理

作用：攔截用戶的請求，並把請求交給SpringSecurity來處理。

<filter>

<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

springsecurity.xml

<security:http use-expressions="true" auto-config="true">

<security:intercept-url pattern="/**" access="hasRole('ROLE_ADMIN')"/>
</security:http>

<security:authentication-manager>
<security:authentication-provider>

<security:user-service>
<security:user name="admin" password="{noop}admin" authorities="ROME_ADMIN"/>
<security:user name="root" password="{noop}root" authorities="ROME_ROOT"/>
</security:user-service>
</security:authentication-provider>
</security:authentication-manager>

</beans>

<security:http security="none" pattern="要放行的資源路徑"/>

我的XML文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:dubbo="http://code.alibabatech.com/schema/dubbo"
       xmlns:mvc="http://www.springframework.org/schema/mvc"
       xmlns:security="http://www.springframework.org/schema/security"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
                  http://www.springframework.org/schema/beans/spring-beans.xsd
                  http://www.springframework.org/schema/mvc
                  http://www.springframework.org/schema/mvc/spring-mvc.xsd
                  http://code.alibabatech.com/schema/dubbo
                  http://code.alibabatech.com/schema/dubbo/dubbo.xsd
                  http://www.springframework.org/schema/context
                  http://www.springframework.org/schema/context/spring-context.xsd
                     http://www.springframework.org/schema/security
                     http://www.springframework.org/schema/security/spring-security.xsd">

    <!--配置哪些資源匿名可以訪問（不登錄也可以訪問）-->
    <!--<security:http security="none" pattern="/pages/a.html"></security:http>
    <security:http security="none" pattern="/pages/b.html"></security:http>-->
    <!--<security:http security="none" pattern="/pages/**"></security:http>-->
    <security:http security="none" pattern="/login.html"></security:http>
    <security:http security="none" pattern="/css/**"></security:http>
    <security:http security="none" pattern="/img/**"></security:http>
    <security:http security="none" pattern="/js/**"></security:http>
    <security:http security="none" pattern="/plugins/**"></security:http>
    <!--
        auto-config:自動配置，如果設置為true，表示自動應用一些默認配置，比如框架會提供一個默認的登錄頁面
        use-expressions:是否使用spring security提供的表達式來描述權限
    -->
    <security:http auto-config="true" use-expressions="true">
        <security:headers>
            <!--設置在頁面可以通過iframe訪問受保護的頁面，默認為不允許訪問-->
            <security:frame-options policy="SAMEORIGIN"></security:frame-options>
        </security:headers>
        <!--配置攔截規則，/** 表示攔截所有請求-->
        <!--
            pattern:描述攔截規則
            asscess:指定所需的訪問角色或者訪問權限
        -->
        <!--只要認證通過就可以訪問-->
        <security:intercept-url pattern="../pages/**"  access="isAuthenticated()" />

        <!--如果我們要使用自己指定的頁面作為登錄頁面，必須配置登錄表單.頁面提交的登錄表單請求是由框架負責處理-->
        <!--
            login-page:指定登錄頁面訪問URL
        -->
        <security:form-login
                login-page="/login.html"
                username-parameter="username"
                password-parameter="password"
                login-processing-url="/login.do"
                default-target-url="/pages/main.html"
                authentication-failure-url="/login.html"></security:form-login>

        <!--
          csrf：對應CsrfFilter過濾器
          disabled：是否啟用CsrfFilter過濾器，如果使用自定義登錄頁面需要關閉此項，否則登錄操作會被禁用（403）
        -->
        <security:csrf disabled="true"></security:csrf>

        <!--
          logout：退出登錄
          logout-url：退出登錄操作對應的請求路徑
          logout-success-url：退出登錄后的跳轉頁面
        -->
        <security:logout logout-url="/logout.do"
                         logout-success-url="/login.html" invalidate-session="true"/>

    </security:http>

    <!--配置認證管理器-->
    <security:authentication-manager>
        <!--配置認證提供者-->
        <security:authentication-provider user-service-ref="springSecurityUserService">
            <!--
                    配置一個具體的用戶，后期需要從數據庫查詢用戶
            <security:user-service>
                <security:user name="admin" password="{noop}1234" authorities="ROLE_ADMIN"/>
            </security:user-service>
            -->
            <!--指定度密碼進行加密的對象-->
            <security:password-encoder ref="passwordEncoder"></security:password-encoder>
        </security:authentication-provider>
    </security:authentication-manager>

    <!--配置密碼加密對象-->
    <bean id="passwordEncoder"
          class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" />

    <!--開啟注解方式權限控制-->
    <security:global-method-security pre-post-annotations="enabled" />
</beans>

最后一定要在controller中加入權限校驗的注解
 @PreAuthorize("hasAuthority('CHECKITEM_DELETE')")

項目中的數據之類的調用如此,成功的話我們會接收到403錯誤,這樣的話直接可以在前端頁面接收進行判斷

catch((error)=>{
    if(error=="Error: Request failed with status code 403"){
        this.$message.error("權限不足");
    }else{
        this.$message.error("網絡異常，請重試");
    }
(我的前端使用的是Vue)

免責聲明！

本站轉載的文章為個人學習借鑒使用，本站對版權不負任何法律責任。如果侵犯了您的隱私權益，請聯系本站郵箱yoyou2525@163.com刪除。

猜您在找 Spring Security控制權限基於RBAC的權限控制淺析（結合Spring Security）（四）Spring Security 動態url權限控制 spring-security權限控制詳解 Spring Security 動態url權限控制（三） Spring Security（17）——基於方法的權限控制 Spring Security——基於表達式的權限控制 Spring Security實現統一登錄與權限控制 spring boot + jwt + spring security前后端分離實現權限控制在Spring Boot中使用Spring Security實現權限控制