最详细Spring Security学习资料（源码）

package com.tong.myspringsecurity.config; import com.tong.myspringsecurity.handler.MyAccessDeniedHandler; import com.tong.myspringsecurity.handler.MyLoginFailureHandler; import com.tong.myspringsecurity.handler.MyLoginSuccessHandler; import com.tong.myspringsecurity.handler.MyLogoutSuccessHandler; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.WebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository; // Security配置类 @Configuration public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private UserDetailsService userDetailsService; @Autowired private PersistentTokenRepository repository; // 定义认证逻辑 // @Bean // public UserDetailsService userDetailsService(){ // // 1.使用内存数据进行认证 // InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager(); // // // 2.创建两个用户 // UserDetails user1 = User.withUsername("xiaotong").password("123").authorities("admin").build(); // UserDetails user2 = User.withUsername("txc").password("456").authorities("admin").build(); // // // 3.将用户保存到内存中 // manager.createUser(user1); // manager.createUser(user2); // // return manager; // } // Spring Security配置 @Override protected void configure(HttpSecurity http) throws Exception { // 自定义表单登录 http.formLogin() .loginPage("/login.html") // 自定义登录页面 .usernameParameter("username") // 表单中的用户名项 .passwordParameter("password") // 表单中的密码项 .loginProcessingUrl("/login") // 表单提交路径，提交后执行认证逻辑 // .successForwardUrl("/main") // 登录成功后的跳转路径 .successHandler(new MyLoginSuccessHandler()) // 登录成功处理器 // .failureForwardUrl("/fail"); // 登录失败后的跳转路径 .failureHandler(new MyLoginFailureHandler()); // 登录失败处理器 // 权限拦截配置 http.authorizeRequests() .antMatchers("/login.html").permitAll() // 登录页不需要认证 .antMatchers("/fail").permitAll() // 失败页不需要认证 // .antMatchers("/reportform/find").hasAnyAuthority("/reportform/find") // .antMatchers("/salary/find").hasAnyAuthority("/salary/find") // .antMatchers("/staff/find").hasAnyAuthority("/staff/find") .anyRequest().authenticated(); //其余所有请求都需要认证 // 权限拦截配置 // http.authorizeRequests() // .antMatchers("/login.html").permitAll() // 登录页不需要认证 // .anyRequest().access("@myAuthorizationService.hasPermission(request,authentication)"); // 退出登录配置 http.logout() .logoutUrl("/logout") // .logoutSuccessUrl("/login.html") .logoutSuccessHandler(new MyLogoutSuccessHandler()) .clearAuthentication(true) .invalidateHttpSession(true); // 记住我配置 http.rememberMe() .userDetailsService(userDetailsService) // 登录逻辑交给哪个对象 .tokenRepository(repository)// 令牌repository .tokenValiditySeconds(30); // 保存时间。单位：秒 // 异常处理 http.exceptionHandling() .accessDeniedHandler(new MyAccessDeniedHandler()); // 关闭csrf防护 http.csrf().disable(); } @Override public void configure(WebSecurity web) throws Exception { // 静态资源放行 web.ignoring().antMatchers("/css/**"); } // 密码编码器 @Bean public PasswordEncoder passwordEncoder(){ return new BCryptPasswordEncoder(); } }