SpringBoot集成Spring security 2024.10(Spring Security 6.3.3)

package com.example.springbootmybatis.config; import com.example.springbootmybatis.user.pojo.UserVo; import com.example.springbootmybatis.user.service.UserService; import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.core.Authentication; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.AuthenticationSuccessHandler; import java.io.IOException; /** * @ClassName：SecurityConfig * @Author: xuli * @Date: 2024/10/21 19:59 * @Description: security配置类 */ @EnableWebSecurity @Configuration public class SecurityConfig { @Autowired private UserService userService; /** * 定义过滤器拦截 * @param http * @return * @throws Exception */ @Bean public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception{ http.authorizeHttpRequests(auth->auth .requestMatchers("/").permitAll() // 公开访问 .requestMatchers("/user/**").hasAnyAuthority("user_admin")//资源需具有的权限 .requestMatchers("/teaType/**").hasAnyAuthority("guest","user_admin") .anyRequest().authenticated())//每个请求都要认证 .formLogin((form)-> form.loginPage("/login")//登录页面 // .successForwardUrl("/main")//登录成功跳转页面，如无效也可使用AuthenticationSuccessHandler .successHandler(authenticationSuccessHandler()) .failureUrl("/login?error=true")//登录失败重定向登录页面，并提示错误信息 .permitAll() ).logout(logout->logout.logoutUrl("/loginOut"));//推出登录; http.exceptionHandling(handling->handling.accessDeniedHandler(new MyAccessDeniedHandler()));//权限不足返回页面 return http.build(); } private AuthenticationSuccessHandler authenticationSuccessHandler(){ return new AuthenticationSuccessHandler() { @Override public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException { response.sendRedirect("/main"); } }; } /** * 获取用户信息 * @param passwordEncoder * @return */ @Bean public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder){ return new UserDetailsService() { @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { UserDetails user=null; if(!username.isBlank()){ UserVo userVo= userService.getUserByName(username); if (userVo!=null){ user= User.builder() .username(userVo.getUserName()) .password(passwordEncoder.encode(userVo.getPassword())) .authorities(userVo.getAuth()) .build(); } } return user; } }; } /** * 定义加密算法 * @return *//* */ @Bean public PasswordEncoder passwordEncoder(){ return new BCryptPasswordEncoder(10);//使用BCrypt,加密强度，值越大安全性越高 } }