Spring Security進階

Spring Security進階

1.連接數據庫進行數據的驗證

Spring Security進行身份驗證或者權限控制時，用戶名和密碼應該要和數據庫的進行比較才行，用戶的各種信息我們從數據庫中去獲取，不用自己在代碼或者配置文件中寫。

案例

1）創建項目

自己創建一個Maven項目

2）導入依賴

<parent>
    <!--Spring boot-->
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-parent</artifactId>
    <version>2.0.6.RELEASE</version>
  </parent>

  <dependencies>
    <!--Spring boot Web-->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <!--Spring Security-->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <!--mysql驅動-->
    <dependency>
      <groupId>mysql</groupId>
      <artifactId>mysql-connector-java</artifactId>
    </dependency>

    <!--數據庫連接框架JPA-->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
  </dependencies>

3）創建啟動類

@SpringBootApplication
public class SecurityApplication2 {
    public static void main(String[] args) {
        SpringApplication.run(SecurityApplication2.class, args);
    }
}

4）配置文件

在項目的resources文件的目錄下創建一個配置文件：application.properties

#連接數據庫
spring.datasource.driver-class-name=com.mysql.jdbc.Driver
spring.datasource.url=jdbc:mysql://localhost:3306/你的數據庫?useUnicode=true&characterEncoding=utf-8&useSSL=false
spring.datasource.username=用戶名
spring.datasource.password=密碼
#數據庫表的生成
spring.jpa.generate-ddl=true
#顯示執行的sql語句
spring.jpa.show-sql=true
#使用的數據庫
spring.jpa.database=mysql

5）創建類

來創建一個實體層類、dao層接口、service層、控制層

實體類

//這個注解表示這個是實體類，對應數據庫中的表，默認實體名就是類名
@Entity
public class UserInfo {

    //這個屬性的表中的主鍵
    @Id
    //主鍵的生成策略,IDENTITY 主鍵自增長
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    //用戶名
    private String username;
    //密碼
    private String password;
    //角色
    private String roles;

    public Long getId() {
        return id;
    }

    public void setId(Long id) {
        this.id = id;
    }

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public String getRoles() {
        return roles;
    }

    public void setRoles(String roles) {
        this.roles = roles;
    }
}

dao層接口

/*
* 繼承JpaRepository<UserInfo,Long>接口，泛型一個是實體類，一個是主鍵類型
* */
public interface UserInfoDao extends JpaRepository<UserInfo,Long> {
    //根據用戶名查找用戶
    //(溫馨提示：想要查找的話方法名要為 findBy屬性字段  刪除的話 deleteBy屬性字段 ...以此類推這樣才不報錯)
    UserInfo findByUsername(String username);
}

service層

public interface UserInfoService {
    //根據用戶名查找用戶
    UserInfo findByUsername(String username);
}

@Service
public class UserInfoServiceImpl implements UserInfoService {

    @Autowired
    private UserInfoDao userInfoDao;

    //根據用戶名返回用戶
    @Override
    public UserInfo findByUsername(String username) {
        UserInfo user = userInfoDao.findByUsername(username);
        return user;
    }
}

controller層

@RestController
@RequestMapping("/userInfo")
public class UserInfoController {

    @RequestMapping("common")
    //方法執行前驗證用戶是否有該角色
    @PreAuthorize(value = "hasAnyRole('normal','admin')")
    public String commonUserInfo() {
        return "==測試數據庫  有兩個角色==";
    }

    @RequestMapping("admin")
    //方法執行前驗證是否有該角色
    @PreAuthorize(value = "hasAnyRole('admin')")
    public String adminUserInfo() {
        return "==測試數據庫  有一個角色==";
    }
}

這些准備工作都做完之后，我們可以往數據庫中插入一些數據，創建一個類，用來往數據庫中添加數據的。

@Component
public class InitJdbc {

    @Autowired
    private UserInfoDao userInfoDao;

    //Java自帶的注解，程序啟動的時候執行該方法,每啟動一次執行一次,
    //插入成功了，再啟動項目的時候不想再重復插入，可以把@PostConstruct注釋掉
    @PostConstruct
    public void init() {
        //密碼要加密
        PasswordEncoder pe = new BCryptPasswordEncoder();

        //添加一個用戶
        UserInfo userInfo = new UserInfo();
        userInfo.setUsername("wangwu");
        userInfo.setPassword(pe.encode("123456"));
        userInfo.setRoles("normal");
        userInfoDao.save(userInfo);

        //添加一個用戶
        UserInfo userInfo1 = new UserInfo();
        userInfo1.setUsername("admin");
        userInfo1.setPassword(pe.encode("admin"));
        userInfo1.setRoles("admin");
        userInfoDao.save(userInfo1);

    }
}

現在就可以啟動項目看看數據庫中是否插入成功數據了。

接下來做權限的驗證==========

來寫一個類，實現UserDetailService並實現它的方法

//把類交給spring容器管理
@Component
public class SecurityDetail implements UserDetailsService {

    @Autowired
    private UserInfoDao userInfoDao;

    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {

        UserInfo userInfo = null;

        //UserDetails接口的實現類
        User user = null;
		//判斷用戶名不為空
        if (s != null) {
            //根據用戶名查找用戶
            userInfo = userInfoDao.findByUsername(s);
            //判斷用戶不為空
            if (userInfo != null) {
				//User類的第三個參數是集合，所有創建一個集合，獲取用戶的角色
                List<GrantedAuthority> list = new ArrayList<>();
                //獲取用戶的角色，獲取到的角色開頭一定要以"ROLE_"開頭
                GrantedAuthority authority = new SimpleGrantedAuthority("ROLE_" + userInfo.getRoles());
                list.add(authority);
                //User的構造器要返回三個參數：用戶名、密碼、集合的角色
                user = new User(userInfo.getUsername(), userInfo.getPassword(), list);
            }
        }

        return user;
    }
}

再寫一個配置類，解析密碼的加密方式

@Configuration
@EnableWebSecurity
//開啟方法級別的驗證
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private SecurityDetail securityDetail;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //密碼加密的方式
        auth.userDetailsService(securityDetail).passwordEncoder(new BCryptPasswordEncoder());

    }
}

現在可以進行測試了，啟動項目，訪問控制層的方法，只有方法上標記的角色才能訪問該方法

2.認證和授權

authentication:認證，認證訪問的用戶是不是有效的用戶，他是誰。

authorization:授權，訪問的用戶在系統中能干什么

RBAC:基於角色的訪問控制（Role-Based Access Control），用戶屬於某個角色，而角色擁有某些權限。

權限：能對資源進行操作，比如增刪改查

角色：自定義的，表示權限的聚合，一個角色可以有多個權限。

舉例說明：

設計角色：經理具有數據的修改、刪除、查看等；員工只能查看數據。

一個公司中如果想把一個用戶設置為經理，只需把他設置為經理這個角色，他就能有修改、刪除、查看等操作了，如果公司新來普通員工，只需把他加入到員工這個角色里面就好了。這樣，想讓什么用戶用戶什么權限，只需把他加入到相應的角色里就OK了。

UserDetailService:這是一個接口，里面只有一個方法UserDetails loadUserByUsername(String var1)，是根據用戶名來獲取數據庫中信息的

主要的實現有：

​ InMemoryUserDetailsManager在內存中維護用戶信息的，使用很方便，可是數據不是持久的

​ JdbcUserDetailsManager對數據庫信息進行操作的，底層是基於jdbcTemplate的，可以使用這個類的方法來操作數據庫數據。

UserDetails:提供用戶信息的核心接口

// 權限的集合
Collection<? extends GrantedAuthority> getAuthorities();
//獲取密碼
String getPassword();
//獲取用戶名
String getUsername();
//用戶是否存在
boolean isAccountNonExpired();
//用戶是否鎖定
boolean isAccountNonLocked();
//證書是否過期
boolean isCredentialsNonExpired();
//賬戶是否啟用 
boolean isEnabled();

UserDetails有一個實現類User

//他有兩個構造器，參數和UserDetails的字段屬性一樣
public User(String username, String password, Collection<? extends GrantedAuthority> authorities) {
   this(username, password, true, true, true, true, authorities);
}

public User(String username, String password, boolean enabled, boolean accountNonExpired, boolean credentialsNonExpired, boolean accountNonLocked, Collection<? extends GrantedAuthority> authorities) {
   if (username != null && !"".equals(username) && password != null) {
       this.username = username;
       this.password = password;
       this.enabled = enabled;
       this.accountNonExpired = accountNonExpired;
       this.credentialsNonExpired = credentialsNonExpired;
       this.accountNonLocked = accountNonLocked;
       this.authorities = Collections.unmodifiableSet(sortAuthorities(authorities));
   } else {
       throw new IllegalArgumentException("Cannot pass null or empty values to constructor");
   }
}

2.1設置表

基於RBAC設置三張表，用戶表，角色表，用戶和角色的關聯表 密碼明文分別是 123 456 admin

-- 角色表
SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;

-- ----------------------------
-- Table structure for sys_role
-- ----------------------------
DROP TABLE IF EXISTS `sys_role`;
CREATE TABLE `sys_role`  (
  `id` int(11) NOT NULL,
  `rolename` varchar(100) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '角色名稱',
  `rolememo` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '角色描述',
  PRIMARY KEY (`id`) USING BTREE
) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;

-- ----------------------------
-- Records of sys_role
-- ----------------------------
INSERT INTO `sys_role` VALUES (1, 'USER', '普通用戶');
INSERT INTO `sys_role` VALUES (2, 'READ', '只讀');
INSERT INTO `sys_role` VALUES (3, 'ADMIN', '管理員');

SET FOREIGN_KEY_CHECKS = 1;


-- 用戶表

SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;

-- ----------------------------
-- Table structure for sys_user
-- ----------------------------
DROP TABLE IF EXISTS `sys_user`;
CREATE TABLE `sys_user`  (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `username` varchar(100) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
  `password` varchar(100) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
  `realname` varchar(200) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '真實名字',
  `isenable` int(11) NULL DEFAULT NULL COMMENT '是否開啟認證',
  `islock` int(11) NULL DEFAULT NULL COMMENT '是否鎖定',
  `isexpire` int(11) NULL DEFAULT NULL,
  `incredentials` int(255) NULL DEFAULT NULL COMMENT '是否過期',
  `createtime` date NULL DEFAULT NULL,
  `logintime` date NULL DEFAULT NULL,
  PRIMARY KEY (`id`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 9 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;

-- ----------------------------
-- Records of sys_user 密碼明文分別是  123   456   admin
-- ----------------------------
INSERT INTO `sys_user` VALUES (6, 'zs', '$2a$10$EGMo2XSdh49cDgXa0OzXYu36HfNssUf7zUDaNIz83AgWveA3GORYq', '張三', 1, 1, 1, 1, '2021-09-02', '2021-09-02');
INSERT INTO `sys_user` VALUES (7, 'lisi', '$2a$10$r9iLBYZzIIt/gyOngvPnZOBZaP4EW58etU1tLPoEh7hlYpydIaM6u', '李四', 1, 1, 1, 1, '2021-09-02', '2021-09-02');
INSERT INTO `sys_user` VALUES (8, 'admin', '$2a$10$P.I3zf7bEAmLmlSwaDOdMOdrxEyTT1QvbqfKC5YGQ7zHk5zUR/dCG', '管理員', 1, 1, 1, 1, '2021-09-02', '2021-09-02');

SET FOREIGN_KEY_CHECKS = 1;

--關聯表
SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;

-- ----------------------------
-- Table structure for sys_user_role
-- ----------------------------
DROP TABLE IF EXISTS `sys_user_role`;
CREATE TABLE `sys_user_role`  (
  `userid` int(11) NOT NULL,
  `roleid` int(11) NULL DEFAULT NULL
) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;

-- ----------------------------
-- Records of sys_user_role
-- ----------------------------
INSERT INTO `sys_user_role` VALUES (6, 1);
INSERT INTO `sys_user_role` VALUES (7, 2);
INSERT INTO `sys_user_role` VALUES (8, 1);
INSERT INTO `sys_user_role` VALUES (8, 3);

SET FOREIGN_KEY_CHECKS = 1;

2.2創建項目

2.3 導入依賴

把上一個項目的依賴導入進來，再加多一個spring整合mybatis的包

 <dependency>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>2.1.0</version>
        </dependency>

2.4創建相關類

2.4.1實體類

創建User和Role的實體類，要繼承UserDetails

public class SysUser implements UserDetails {

    private Integer id;
    private String username;
    private String password;
    private String realName;
    private boolean isEnable;
    private boolean isExpired;
    private boolean isLock;
    private boolean isCredentials;

    private List<GrantedAuthority> grantedAuthorities;

    private Date createTime;
    private Date loginTime;

    public SysUser() {
    }

    public SysUser(String username, String password, String realName,
                   boolean isEnable, boolean isExpired, boolean isLock,
                   boolean isCredentials, List<GrantedAuthority> grantedAuthorities,
                   Date createTime, Date loginTime) {
        this.username = username;
        this.password = password;
        this.realName = realName;
        this.isEnable = isEnable;
        this.isExpired = isExpired;
        this.isLock = isLock;
        this.isCredentials = isCredentials;
        this.grantedAuthorities = grantedAuthorities;
        this.createTime = createTime;
        this.loginTime = loginTime;
    }

    //角色的集合
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return grantedAuthorities;
    }

    //密碼
    @Override
    public String getPassword() {
        return password;
    }

    //用戶名
    @Override
    public String getUsername() {
        return username;
    }

    //賬號是否存在
    @Override
    public boolean isAccountNonExpired() {
        return isExpired;
    }

    //賬號是否鎖定
    @Override
    public boolean isAccountNonLocked() {
        return isLock;
    }

    //是否過期
    @Override
    public boolean isCredentialsNonExpired() {
        return isCredentials;
    }

    //是否啟用
    @Override
    public boolean isEnabled() {
        return isEnable;
    }



    public void setId(Integer id) {
        this.id = id;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public void setRealName(String realName) {
        this.realName = realName;
    }

    public void setEnable(boolean enable) {
        isEnable = enable;
    }

    public void setExpired(boolean expired) {
        isExpired = expired;
    }

    public void setLock(boolean lock) {
        isLock = lock;
    }

    public void setCredentials(boolean credentials) {
        isCredentials = credentials;
    }

    public void setGrantedAuthorities(List<GrantedAuthority> grantedAuthorities) {
        this.grantedAuthorities = grantedAuthorities;
    }

    public void setCreateTime(Date createTime) {
        this.createTime = createTime;
    }

    public void setLoginTime(Date loginTime) {
        this.loginTime = loginTime;
    }

    public Integer getId() {
        return id;
    }

    public String getRealName() {
        return realName;
    }

    public Date getCreateTime() {
        return createTime;
    }

    public Date getLoginTime() {
        return loginTime;
    }

    @Override
    public String toString() {
        return "SysUser{" +
                "id=" + id +
                ", username='" + username + '\'' +
                ", password='" + password + '\'' +
                ", realName='" + realName + '\'' +
                ", isEnable=" + isEnable +
                ", isExpired=" + isExpired +
                ", isLock=" + isLock +
                ", isCredentials=" + isCredentials +
                ", grantedAuthorities=" + grantedAuthorities +
                ", createTime=" + createTime +
                ", loginTime=" + loginTime +
                '}';
    }
}

public class SysRole {

    private Integer id;
    private String role;
    private String rolememo;

    public Integer getId() {
        return id;
    }

    public void setId(Integer id) {
        this.id = id;
    }

    public String getRole() {
        return role;
    }

    public void setRole(String role) {
        this.role = role;
    }

    public String getRolememo() {
        return rolememo;
    }

    public void setRolememo(String rolememo) {
        this.rolememo = rolememo;
    }

    @Override
    public String toString() {
        return "SysRole{" +
                "id=" + id +
                ", role='" + role + '\'' +
                ", rolememo='" + rolememo + '\'' +
                '}';
    }
}

2.4.2dao層和對應的xml文件

@Repository
public interface SysRoleMapper {

    //根據用戶id查看角色
    List<SysRole> selectByUserId(Integer userId);
}


@Repository
public interface SysUserMapper {

    //插入用戶
    int insertSysUser(SysUser sysUser);

    //根據用戶名查詢用戶
    SysUser selectByUsername(String username);
}

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper
        PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">

<mapper namespace="com.huang.security.mapper.SysRoleMapper">

    <resultMap id="roleMapper" type="com.huang.security.entity.SysRole">
        <id column="id" property="id"/>
        <result column="rolename" property="role"/>
        <result column="rolememo" property="rolememo"/>
    </resultMap>

    <select id="selectByUserId" resultMap="roleMapper" >
        SELECT sr.id,sr.rolename,sr.rolememo FROM sys_role AS sr
        INNER JOIN sys_user_role AS sur ON sr.id = sur.roleid
        WHERE sur.userid = #{userid}
    </select>
</mapper>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper
        PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">

<mapper namespace="com.huang.security.mapper.SysUserMapper">

    <resultMap id="userMapper" type="com.huang.security.entity.SysUser">
        <id column="id" property="id"/>
        <result column="username" property="username"/>
        <result column="password" property="password"/>
        <result column="realname" property="realName"/>
        <result column="isenable" property="isEnable"/>
        <result column="islock" property="isLock"/>
        <result column="isexpire" property="isExpired"/>
        <result column="incredentials" property="isCredentials"/>
        <result column="createtime" property="createTime"/>
        <result column="logintime" property="loginTime"/>

    </resultMap>

    <insert id="insertSysUser" parameterType="com.huang.security.entity.SysUser">
        insert into sys_user(username,password,realname,isenable,islock,incredentials,createtime,logintime)
         values(#{username},#{password},#{realName},#{isEnable},#{isLock},#{isCredentials},
                #{createTime},#{loginTime})
    </insert>

    <select id="selectByUsername" resultMap="userMapper" >
        select id,username,password,realname,isenable,islock,isexpire,incredentials,createtime,logintime
        from sys_user where username = #{username}
    </select>
</mapper>

2.5service層

service層要實現UserDetailService接口，去獲取數據庫中的信息做返回

@Service
public class UserWnoRoleService implements UserDetailsService {

    @Autowired
    private SysUserMapper userMapper;

    @Autowired
    private SysRoleMapper roleMapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //根據用戶名獲取用戶
        SysUser user = userMapper.selectByUsername(username);

        System.out.println("==== Service =====");
        String roleName = "";
        List<GrantedAuthority> list = new ArrayList<>();

            System.out.println("User" + user);
        if (!StringUtils.isEmpty(user)) {
            //根據用戶id獲取對應角色
            List<SysRole> roles = roleMapper.selectByUserId(user.getId());

            for (SysRole role : roles) {
                //一個用戶可能有多個角色，用集合保存，放到用戶的集合里
                roleName = role.getRole();
                GrantedAuthority authority = new SimpleGrantedAuthority("ROLE_" + roleName);
                list.add(authority);
                user.setGrantedAuthorities(list);
            }

            //返回的這個user是包含角色的
            return user;
        }
        //可以返回自定義user，是因為實體類實現了UserDetails這個接口
        return user;
    }
}

2.6配置文件

spring.datasource.driver-class-name=com.mysql.jdbc.Driver
spring.datasource.url=jdbc:mysql://localhost:3306/庫名?useUnicode=true&characterEncoding=utf-8&useSSL=false
spring.datasource.username=用戶名
spring.datasource.password=密碼

mybatis.mapper-locations=classpath:/mapper/*Mapper.xml
# 包起別名
mybatis.type-aliases-package=com.huang.security.entity
mybatis.configuration.log-impl=org.apache.ibatis.logging.stdout.StdOutImpl

2.7相關的配置類

@Configuration
//@EnableWebSecurity //如果是導入的jar包是spring-boot-starter-security可以不用寫
public class MySecurityConfig extends WebSecurityConfigurerAdapter {


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        System.out.println("======  MySecurityConfig   configure==============");

        //匹配"/index","/login.html","/login"  不用驗證（permit 許可）,和登錄相關的要放行
        http.authorizeRequests().antMatchers("/index","/login.html","/login").permitAll()
                //匹配只有相關角色才能訪問的路徑
                .antMatchers("/access/user/**").hasRole("USER")
                .antMatchers("/access/read/**").hasRole("READ")
                .antMatchers("/access/admin/**").hasRole("ADMIN")
                //所有都需要驗證
                .anyRequest().authenticated()
                //執行結束
                .and()
                //表單的方式登錄
                .formLogin()
                //登錄的自定義視圖頁面
                .loginPage("/login.html")
                //登錄訪問的地址，表單中action的值
                .loginProcessingUrl("/login")
                .and()
                //跨域安全的設置，禁用
                .csrf().disable();
    }

    @Qualifier("userWnoRoleService")
    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //super.configure(auth);
        // userDetailsService使用的是service層的 UserWnoRoleService，它實現了 UserDetailsService
        auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder());
    }
}

2.8html頁面

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>

    身份驗證 <br>
    <a href="/access/user">zs</a> <br>
    <a href="/access/read">lisi</a> <br>
    <a href="/access/admin">admin</a> <br>
    <a href="/logout">退出</a>
</body>
</html>






<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
    <p>自定義登錄頁</p>
    <form action="/login" method="post">
        用戶名:<input type="text" name="username" value=""><br/>
        密&nbsp;&nbsp;&nbsp;碼:<input type="password" name="password" value=""><br/>
        <input type="submit" value="登錄">
    </form>
</body>
</html>

2.9controller層測試

@Controller
public class InitController {

    @GetMapping("index")
    public String toIndex() {
        return "forward:/index.html";
    }
}

@RestController
@RequestMapping("/access")
public class UserWnoRoleController {

    @GetMapping("user")
    public String sayUser() {
        return "zs 是 user 角色";
    }

    @GetMapping("read")
    public String sayRead() {
        return "lisi 是 read 角色";
    }

    @GetMapping("admin")
    public String sayAdmin() {
        return "admin 是 user admin 角色";
    }
}

個人筆記