Security用户授权.zip

package demo.config; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; /** * Spring Security配置类 */ @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private SecurityService securityService; @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(securityService).passwordEncoder(passwordEncoder()); } @Override protected void configure(HttpSecurity http) throws Exception { //配置没有权限访问时跳转的自定义页面 http.formLogin() //表单登陆 .loginPage("/login.html") //登录页面设置 .loginProcessingUrl("/user/login") //登录访问路径 .defaultSuccessUrl("/test/index") //从login.html页面登录成功之后跳转到该路径 .permitAll(); http.authorizeHttpRequests() //授权配置 //配置/test/insert路径只能是拥有insert权限的用户才能访问 .antMatchers("/test/insert").hasAnyAuthority("insert") //配置/test/info路径只能是拥有admin角色的用户才能访问 .antMatchers("/test/info").hasAnyRole("admin") .anyRequest() //任何请求 .authenticated(); //所有请求都拦截 http.csrf().disable(); //关闭跨站脚本攻击 } /** * 将PasswordEncoder注入到ioc容器 * @return */ @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } }