Spring Security入门(二) 基于内存存储的表单登录实战

public void doFilter(ServletRequest request, ServletResponse response, FilterChain
chain) {
  // do something before the rest of the application
  chain.doFilter(request, response); // invoke the rest of the application
  // do something after the rest of the application
}

try {
    //过滤请求    
    filterChain.doFilter(request, response); 
} catch (AccessDeniedException | AuthenticationException ex) {
  if (!authenticated || ex instanceof AuthenticationException) {
      //没有认证或者发送认证异常则开始认证
      startAuthentication(); 
  } else {
     //访问被拒
      accessDenied(); 
  }
}

 protected void configure(AuthenticationManagerBuilder auth) throws Exception{......}
     
 public void configure(WebSecurity web) throws Exception {......}   

 protected void configure(HttpSecurity http) throws Exception {......}

<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-security</artifactId>
</dependency>

2020-10-19 23:26:37.390  INFO 12808 --- [           main] .s.s.UserDetailsServiceAutoConfiguration : 

Using generated security password: 089ae129-bb01-472f-9919-4bb529b64153

public static class User {
        private String name = "user";
        private String password = UUID.randomUUID().toString();
        private List<String> roles = new ArrayList();
        private boolean passwordGenerated = true;

        public User() {
        }

        public String getName() {
            return this.name;
        }

        public void setName(String name) {
            this.name = name;
        }

        public String getPassword() {
            return this.password;
        }

        public void setPassword(String password) {
            if (StringUtils.hasLength(password)) {
                this.passwordGenerated = false;
                this.password = password;
            }
        }

        public List<String> getRoles() {
            return this.roles;
        }

        public void setRoles(List<String> roles) {
            this.roles = new ArrayList(roles);
        }

        public boolean isPasswordGenerated() {
            return this.passwordGenerated;
        }
    }

@RestController
@RequestMapping("/index")
public class IndexController {

    @GetMapping("/")
    public String index(){

        return "欢迎学习 Spring Security!";
    }
}

spring.security.user.name=user
spring.security.user.password=user123
spring.security.user.roles=user

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {


    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth     //使用内存存储
                .inMemoryAuthentication()
                //使用BCrypt密码编码器
                .passwordEncoder( passwordEncoder())
                //配置user用户、密码和角色，此处配置的user用户密码会覆盖系统随机生成的uuID密码
                // 密文在控制台使用springboot-cli指令 spring encodepassword user得到
                .withUser("user").password("$2a$10$bVicNl2vVT0H70APYQYmde9bauRRaENu0HN7HpzByJCtLy0FU0ubu")
                .roles("USER")
                .and()
                //配置admin用户、密码和角色
                .withUser("admin")
                //密文获取方式同user用户,原始密码为admin
                .password("$2a$10$DHtuK1bibHqbAwoGgLi4zOiNjULuHQ2qhIs/ziCw/9T2fqF320cJu")
                .roles("ADMIN","USER");
    }



    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()   
            //使用ant风格拦截请求
            //限制index/user路径对应的接口接口只有USER或ADMIN角色用户可以访问
            .antMatchers("/index/user").hasAnyRole("USER","ADMIN")
               //限制index/admin路径对应的接口只有ADMIN角色用户可以访问
                .antMatchers("/index/admin").hasRole("ADMIN")
                .anyRequest().authenticated()
            //登录接口对所有用户开发权限
                .antMatchers("/login").permitAll()
            //使用spring security默认的登录接口
            //自定义不同路径的认证接口时在登录时报302错误且笔者一时没有找到有效的解决办法
                .and().formLogin().loginProcessingUrl("/login").
                usernameParameter("username").passwordParameter("password")
                //配置登录成功处理器
                .successHandler(new AuthenticationSuccessHandler() {
                    @Override
                    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication auth) throws IOException, ServletException {
                        //从Authentication实例中拿到当前用户的认证信息
                        Object principal = auth.getPrincipal();
                        //设置响应体内容为json格式
                        response.setContentType("application/json;charset=utf-8");
                        response.setStatus(200);
                        PrintWriter writer = response.getWriter();
                        Map<String,Object> map = new HashMap<>();
                        map.put("status",200);
                        map.put("msg","login success");
                        map.put("data",principal);
                        ObjectMapper objectMapper = new ObjectMapper();
                        //借助ObjectMappe对象将返回数据写到响应体的打印流中
                        //这样就能渲染到客户端浏览器页面，也利于前后端发分离项目
                        //前端跳转页面可以使用vue实现
                        writer.write(objectMapper.writeValueAsString(map));
                        writer.flush();
                        writer.close();
                    }
                }).failureHandler(new AuthenticationFailureHandler() {
            @Override
            public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException ex) throws IOException, ServletException {
                response.setContentType("application/json ;charset=utf-8");
                PrintWriter writer = response.getWriter();
                response.setStatus(401);
                Map<String,Object> map = new HashMap<>();
                map.put("status",401);
                //根据异常类型判断具体的认证失败信息
                if(ex instanceof LockedException){
                    map.put("msg","账号被锁定，登录失败");
                }else if(ex instanceof BadCredentialsException){
                    map.put("msg","账号或密码输入错误，登录失败");
                }else if(ex instanceof DisabledException){
                    map.put("msg","账户被禁用，登录失败");
                }else if(ex instanceof CredentialsExpiredException){
                    map.put("msg","密码过期，登录失败");
                }else{
                    map.put("msg","登录失败");
                }
                ObjectMapper objectMapper = new ObjectMapper();
                writer.write(objectMapper.writeValueAsString(map));
                writer.flush();
                writer.close();
            }
        })      //表单登录对所有用户放开权限
                .permitAll()
                 .and();
    }
    
    //配置BCrypt密码编码器
    @Bean
    public BCryptPasswordEncoder passwordEncoder(){
        return  new BCryptPasswordEncoder();
    }

}

    @GetMapping("/")
    @GetMapping("/user")
    public String user(){

        return "普通用户或管理员用户能看到我!";
    }

    @GetMapping("/admin")
    public String admin(){

        return "只有管理员用户能看到我!";
    }

{"msg":"login success","data":{"password":null,"username":"admin","authorities":[{"authority":"ROLE_ADMIN"},{"authority":"ROLE_USER"}],"accountNonExpired":true,"accountNonLocked":true,"credentialsNonExpired":true,"enabled":true},"status":200}

Whitelabel Error Page
This application has no explicit mapping for /error, so you are seeing this as a fallback.

Sun Oct 25 20:57:47 GMT+08:00 2020
There was an unexpected error (type=Forbidden, status=403).
Forbidden