Security基于注解的用户授权.zip

package demo.config; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; /** * Spring Security配置类 */ @EnableWebSecurity @EnableGlobalMethodSecurity(securedEnabled = true) //开启security注解 public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private SecurityService securityService; @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { // 对密码进行加密。123 是密码明文，现在 Spring Security 强制性要求『不允许明文存储密码』。 // String password =passwordEncoder().encode("123");//调用PasswordEncoder加密器的加密方法 // auth.inMemoryAuthentication().withUser("tom").password(password).roles("admin"); auth.userDetailsService(securityService).passwordEncoder(passwordEncoder()); } @Override protected void configure(HttpSecurity http) throws Exception { //配置没有权限访问时跳转的自定义页面 http.formLogin() //表单登陆 .loginPage("/login.html") //登录页面设置 .loginProcessingUrl("/user/login") //security登录访问的路径，即：login.html表单提交的路径，无需在controller中声明 .defaultSuccessUrl("/success.html") //从login.html页面登录成功之后跳转到该路径 .permitAll(); http.authorizeHttpRequests() //认证配置 //配置/test/insert路径只能是拥有insert权限的用户才能访问 .antMatchers("/test/insert").hasAnyAuthority("insert") //配置/test/info路径只能是拥有admin角色的用户才能访问 .antMatchers("/test/info").hasAnyRole("admin") .anyRequest() //任何请求 .authenticated(); //所有请求都拦截 http.csrf().disable(); //关闭跨站脚本攻击 } /** * 将PasswordEncoder注入到ioc容器 * @return */ @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } }