基于ssm框架springsecurity

概念:
Spring Security是spring采用AOP思想烁涌，基于servlet過濾器實現(xiàn)的安全框架朽缎。它提供了完善的認證機制和方法級的授權(quán)功能沃缘。是一款非常優(yōu)秀的權(quán)限管理框架。

導(dǎo)入相關(guān)jar包

<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>5.4.0</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-taglibs</artifactId>
<version>5.4.0</version>
</dependency>

配置web.xml文件

<!--Spring Security過濾器鏈鞭达，注意過濾器名稱必須叫springSecurityFilterChain-->
    <filter>        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>
            org.springframework.web.filter.DelegatingFilterProxy
        </filter-class>
    </filter>
    <!--攔截路徑-->
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

配置spring-security.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:aop="http://www.springframework.org/schema/aop"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:security="http://www.springframework.org/schema/security"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans.xsd
 http://www.springframework.org/schema/context
  http://www.springframework.org/schema/context/spring-context.xsd
      http://www.springframework.org/schema/aop
          http://www.springframework.org/schema/aop/spring-aop.xsd
      http://www.springframework.org/schema/tx
    http://www.springframework.org/schema/tx/spring-tx.xsd
            http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">
    <!--配置springsecurity-->
    <!--
    auto-config="true" 表示自動加載springsecurity的配置文件
    use-expressions="true" 表示使用spring的el表達式來配置springsecurity
    -->
    <security:http auto-config="true" use-expressions="true">
        <!--攔截器-->
        <!--pattern="/**" 表示攔截所有資源
        access="hasAnyRole('ROLE_USER')" 表示只有ROLE_USER角色才能訪問資源
        -->
        <security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER')"/>
    </security:http>

    <!--設(shè)置Spring Security認證用戶信息的來源-->
    <!--springsecurity默認的認證必須是加密的司忱，加上(noop) 表示不加密認證。-->
    <security:authentication-manager>
        <security:authentication-provider>
            <security:user-service>
                <security:user name="user" password="{noop}user" authorities="ROLE_USER"/>
                <security:user name="admin" password="{noop}admin" authorities="ROLE_ADMIN"/>
            </security:user-service>
        </security:authentication-provider>
    </security:authentication-manager>


</beans>

QQ截圖20200930205943.jpg

springsecurity過濾器鏈加載原理

QQ截圖20201002160445.jpg

QQ截圖20201002160519.jpg

QQ截圖20201002160601.jpg

QQ截圖20201002160714.jpg

QQ截圖20201002160857.jpg

QQ截圖20201002161402.jpg

QQ截圖20201002163823.jpg

QQ截圖20201002164959.jpg

 <!--去掉csfr攔截的過濾器-->
        <security:csrf disabled="true"/>
html頁面
<%@taglib uri= "http://www.springframework.org/tags" prefix=" security"%>

<form action="${pageContext.request.contextPath}/login" method="post">
         <security:csrfInput/>  //在認證form表單內(nèi)攜帶token

去掉csfr攔截的過濾器表示就沒有起到過濾作用畴蹭，從而導(dǎo)致${pageContext.request.contextPath}/login可以直接訪問坦仍，而如果