SpringSecurity核心功能

1. 認(rèn)證（你是誰(shuí)）
2. 授權(quán)（你能干什么）
3. 攻擊防護(hù)（防止偽造身份）

SpringSecurity基本原理

image.png

自定義用戶認(rèn)證邏輯

• 處理用戶信息獲取邏輯(實(shí)現(xiàn)UserDetailService接口)

@Configuration
public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
  @Autowired
  private MyUserDetailService userDetailService;
  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
//    auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder());
//    springSecurity推薦使用BCrypt加密
      auth.userDetailsService(userDetailService).passwordEncoder(new BCryptPasswordEncoder());
  }
  @Override
  protected void configure(HttpSecurity http) throws Exception {
//        http.httpBasic()
      http.formLogin()
              .and()
              .authorizeRequests()
              .anyRequest()
              .authenticated();
      super.configure(http);
  }
}

@Component
@Slf4j
public class MyUserDetailService implements UserDetailsService {
  @Override
  public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
      log.info("登錄用戶名：{}", s);
//        根據(jù)用戶名查找用戶信息(根據(jù)各自實(shí)際需求來查找用戶密碼、權(quán)限等信息)
      return new User(s, new BCryptPasswordEncoder().encode("1234"), AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));
  }
}

• 處理用戶校驗(yàn)邏輯(實(shí)現(xiàn)UserDetails接口墨闲，除了判斷密碼是否正確外脑融，判斷用戶賬號(hào)是否過期、凍結(jié)艘包、刪除等等)

@Component
@Slf4j
public class MyUserDetailService implements UserDetailsService {
  @Override
  public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
      log.info("登錄用戶名：{}", s);
//        根據(jù)用戶名查找用戶信息(根據(jù)各自實(shí)際需求來查找用戶密碼寨典、權(quán)限等信息)
//        根據(jù)查找到的用戶信息判斷用戶是否被凍結(jié)
      return new User(s, new BCryptPasswordEncoder().encode("1234"),true,true,true,false,AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));
  }
}

• 處理密碼加密解密（實(shí)現(xiàn)PasswordEncoder接口房匆，推薦BCrypt加密）

//配置類中注入加密類
@Bean
  public PasswordEncoder passwordEncoder(){
      return new BCryptPasswordEncoder();
  }

@Component
@Slf4j
public class MyUserDetailService implements UserDetailsService {
  @Autowired
  private PasswordEncoder passwordEncoder;
  @Override
  public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
      log.info("登錄用戶名：{}", s);
//        根據(jù)用戶名查找用戶信息(根據(jù)各自實(shí)際需求來查找用戶密碼耸成、權(quán)限等信息)
//        根據(jù)查找到的用戶信息判斷用戶是否被凍結(jié)
      String password = passwordEncoder.encode("1234");
      return new User(s, password, true, true, true, false, AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));
  }
}