簡介
Spring Security 是一款強大可定制的用於認證和授權的框架，為Spring項目提供安全保護。
在springBoot項目中添加springSecurity依賴
<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency>
@TableName("xxx")
@Data
public class BzAdmin implements UserDetails {
private int id;
private String username;
private String password;
@TableLogic(value = "0",delval = "1")
private int status = 0;
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return null;
}
@Override
public boolean isAccountNonExpired() {
return true;
}
@Override
public boolean isAccountNonLocked() {
return true;
}
@Override
public boolean isCredentialsNonExpired() {
return true;
}
@Override
public boolean isEnabled() {
return true;
}
}
2.修改數據庫的數據 密碼添加前綴noop代表不加密校驗
3.寫業務類
@Service public class BzAdminService extends ServiceImpl<BzAdminMapper,BzAdmin> implements UserDetailsService { @Override public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException { BzAdmin username = getOne(new QueryWrapper<BzAdmin>() .eq("username", s)); if (username==null){ throw new UsernameNotFoundException("用戶不存在"); } return username; } }
@EnableWebSecurity @Configuration public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private BzAdminService bzAdminService; @Override protected void configure(AuthenticationManagerBuilder auth)throws Exception{ //聲明使用bzAdminService auth.userDetailsService(bzAdminService); } @Override protected void configure(HttpSecurity http) throws Exception { /** * authorizition 授權 * 在shiro和SpringSecurity中 所有以Author開頭的單詞都和授權業務有關系 * * authorizeRequests 配置攔截規則 * antMatchers 配置路徑 * permitAll 不攔截 */ http.authorizeRequests() // 配置不攔截 .antMatchers("/admin/**","/img/**","/css/**","/js/**","/ztree/**","/login.jsp","/login","/layui/**") .permitAll() // 攔截所有 配置一般不會使用/** 而是獨立配置 // anyRequest 代表所有路徑 .anyRequest() .authenticated(); /** * 自定義登錄頁面 * * formLogin() 代表表單登錄 * loginPage 自定義登錄頁面 * loginProcessingUrl 定義登錄方法的地址 /login就是SpringSecurity中的認證方法 * successForwardUrl 登錄成功后的地址 * failureForwardUrl 登錄失敗后的地址 */ http.formLogin() .loginPage("/login.jsp") .successForwardUrl("/main.jsp") .failureForwardUrl("/login.jsp") .loginProcessingUrl("/login") .and() .csrf() .disable() ; // html iframe標簽引用二級頁面 會被默認攔截 // 可以配置不攔截 http.headers().frameOptions().disable(); } }
5.Html
<html> <head> </head> <body class="layui-layout-login"> <form class="layui-form" action="/login" method="post"> <input name="username" id="username"> <input name="password" id="password" > <button type="submit" </button> </form> </body> </html>