使用Spring+SpringSecurity+SpringMVC的web框架小demo

package org.qin.ying.lian.system.service; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.springframework.security.authentication.AuthenticationServiceException; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; import org.springframework.security.core.AuthenticationException; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; public class MyUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter{ // public static final String VALIDATE_CODE = "validateCode"; public static final String USERNAME = "username"; public static final String PASSWORD = "password"; // @Autowired // private UserDao userDao; @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException { if (!request.getMethod().equals("POST")) { throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod()); } //检测验证码 // checkValidateCode(request); String username = obtainUsername(request); String password = obtainPassword(request); //验证用户账号与密码是否对应 username = username.trim(); // User users = userDao.findByName(username); // // if(users == null) { // //// throw new AuthenticationServiceException("用户名或者密码错误！"); // // throw new BadCredentialsException("用户不存在"); // } //UsernamePasswordAuthenticationToken实现 Authentication UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password); // Place the last username attempted into HttpSession for views // 允许子类设置详细属性 setDetails(request, authRequest); // 运行UserDetailsService的loadUserByUsername 再次封装Authentication return this.getAuthenticationManager().authenticate(authRequest); } // protected void checkValidateCode(HttpServletRequest request) { // HttpSession session = request.getSession(); // // String sessionValidateCode = obtainSessionValidateCode(session); // //让上一次的验证码失效 // session.setAttribute(VALIDATE_CODE, null); // String validateCodeParameter = obtainValidateCodeParameter(request); // if (StringUtils.isEmpty(validateCodeParameter) || !sessionValidateCode.equalsIgnoreCase(validateCodeParameter)) { // throw new AuthenticationServiceException("验证码错误！"); // } // } // // private String obtainValidateCodeParameter(HttpServletRequest request) { // Object obj = request.getParameter(VALIDATE_CODE); // return null == obj ? "" : obj.toString(); // } // // protected String obtainSessionValidateCode(HttpSession session) { // Object obj = session.getAttribute(VALIDATE_CODE); // return null == obj ? "" : obj.toString(); // } @Override protected String obtainUsername(HttpServletRequest request) { Object obj = request.getParameter(USERNAME); return null == obj ? "" : obj.toString(); } @Override protected String obtainPassword(HttpServletRequest request) { Object obj = request.getParameter(PASSWORD); return null == obj ? "" : obj.toString(); } }