第十三章-SpringBoot 与安全
安全框架
-
- shiro
- Spring Security
认证 Authentication 建立用户，证明
授权 Authorization 访问权限
登录&认证&授权
依赖
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
控制器
package com.example.demo.controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class HelloController {
@GetMapping("/hello")
public String hello() {
return "hello";
}
}
访问http://localhost:8080/hello
没有登录会跳转到 /login
用户名：user
密码：控制台 Using generated security password
自定义用户名密码
application.properties
#自定义用户名和密码
spring.security.user.name=user
spring.security.user.password=1234567
配置认证和授权
package com.example.demo.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
//下面这两行配置表示在内存中配置了两个用户
auth.inMemoryAuthentication()
.withUser("admin").roles("admin").password("$2a$10$7yOhpFTiwfkZaLRaArPJDu.Si4oWwQKmPIcnzPOOgBwstxoEh4gaK")
.and()
.withUser("user").roles("user").password("$2a$10$YjknRoz.3BfTOVQZbcxgN.v5w.yLrOGY8glV.IvqSBUVy29C..vU6");
}
@Bean
PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()//开启登录配置
.antMatchers("/hello").hasRole("admin")//表示访问 /hello 这个接口，需要具备 admin 这个角色
.anyRequest().authenticated()//表示剩余的其他接口，登录之后就能访问
.and()
.formLogin()
//定义登录页面，未登录时，访问一个需要登录之后才能访问的接口，会自动跳转到该页面
.loginPage("/login")
// 登录处理接口
.loginProcessingUrl("/doLogin")
// 定义登录时，用户名的 key，默认为 username
.usernameParameter("username")
// 定义登录时，用户密码的 key，默认为 password
.passwordParameter("password")
//登录成功的处理器
.successHandler(new AuthenticationSuccessHandler() {
@Override
public void onAuthenticationSuccess(HttpServletRequest req, HttpServletResponse resp, Authentication authentication) throws IOException, ServletException {
resp.setContentType("application/json;charset=utf-8");
PrintWriter out = resp.getWriter();
out.write("success");
out.flush();
}
})
.failureHandler(new AuthenticationFailureHandler() {
@Override
public void onAuthenticationFailure(HttpServletRequest req, HttpServletResponse resp, AuthenticationException exception) throws IOException, ServletException {
resp.setContentType("application/json;charset=utf-8");
PrintWriter out = resp.getWriter();
out.write("fail");
out.flush();
}
})
.permitAll()//和表单登录相关的接口统统都直接通过
.and()
.logout()
.logoutUrl("/logout")
.logoutSuccessHandler(new LogoutSuccessHandler() {
@Override
public void onLogoutSuccess(HttpServletRequest req, HttpServletResponse resp, Authentication authentication) throws IOException, ServletException {
resp.setContentType("application/json;charset=utf-8");
PrintWriter out = resp.getWriter();
out.write("logout success");
out.flush();
}
})
.permitAll()
.and()
.httpBasic()
.and()
.csrf().disable();
}
// 忽略拦截
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/vercode");
}
}
Bcrypt 密码验证测试
package com.example.demo;
import org.junit.jupiter.api.Test;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
class SecurityDemoApplicationTests {
@Test
void contextLoads() {
String rawPassword = "123456";
// 加密
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
String password = encoder.encode(rawPassword);
System.out.println(password);
// 比对
String encodePassword = "$2a$10$7yOhpFTiwfkZaLRaArPJDu.Si4oWwQKmPIcnzPOOgBwstxoEh4gaK";
boolean ret = encoder.matches(rawPassword, encodePassword);
System.out.println(ret);
}
}
常用配置
// 定制请求的授权规则
http.authorizeRequests()
.antMatchers("/").permitAll()
.antMatchers("/vip1/**").hasRole("VIP1")
.antMatchers("/vip2/**").hasRole("VIP2")
.antMatchers("/vip3/**").hasRole("VIP3");
// 开启登录功能 /login GET 去登录页，POST 提交登录数据
http.formLogin()
// 自定义登录页
http.formLogin().loginPage("/user-login");
// 自定义登录请求参数
http.formLogin()
.usernameParameter("username")
.passwordParameter("password")
.loginPage("/user-login");
// 开启注销功能
http.logout().logoutSuccessUrl("/")
// 记住我,将用户信息保存在cookie中
http.remenberMe();
