1. 創(chuàng)建Maven工程

創(chuàng)建maven工程spring-security-demo,打包方式:war

2. 導(dǎo)入依賴(lài)

重點(diǎn)

spring-security-web

spring-security-config

POM文件

<project xmlns="http://maven.apache.org/POM/4.0.0" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation=
    "http://maven.apache.org/POM/4.0.0 
    http://maven.apache.org/maven-v4_0_0.xsd">
    
    <modelVersion>4.0.0</modelVersion>
    
    <groupId>cn.itcast.demo</groupId>
    <artifactId>spring-security-demo</artifactId>
    <packaging>war</packaging>
    <version>0.0.1-SNAPSHOT</version>
    
    <properties>
        <spring.version>4.2.4.RELEASE</spring.version>
    </properties>
    
    <dependencies>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webmvc</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context-support</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-test</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-jdbc</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>4.1.0.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>4.1.0.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>servlet-api</artifactId>
            <version>2.5</version>
            <scope>provided</scope>
        </dependency>
    </dependencies>
    
    <build>
      <plugins>     
          <!-- java編譯插件 -->
          <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.2</version>
                <configuration>
                    <source>1.7</source>
                    <target>1.7</target>
                    <encoding>UTF-8</encoding>
                </configuration>
          </plugin>      
          <plugin>
                <groupId>org.apache.tomcat.maven</groupId>
                <artifactId>tomcat7-maven-plugin</artifactId>
                <configuration>
                    <!-- 指定端口 -->
                    <port>9090</port>
                    <!-- 請(qǐng)求路徑 -->
                    <path>/</path>
                </configuration>
          </plugin>
       </plugins>  
    </build>
    
</project>

3. Web.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    version="2.5">
    <!--配置spring-security.xml文件的位置-->
     <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring-security.xml</param-value>
     </context-param>
     <!--spring整合web配置監(jiān)聽(tīng)器,自動(dòng)裝配Spring的applicationContext.xml的配置信息-->
     <listener>
        <listener-class>
            org.springframework.web.context.ContextLoaderListener
        </listener-class>
     </listener>
     <!--spring-security的過(guò)濾器鏈-->
     <filter>  
        <filter-name>springSecurityFilterChain</filter-name> 
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>  
     </filter>  
     <filter-mapping>  
        <filter-name>springSecurityFilterChain</filter-name>  
        <url-pattern>/*</url-pattern>  
     </filter-mapping>  
</web-app>

4. index.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Index</title>
</head>
<body>
    <h1>Welcome To The Magic World of Spring-Security</h1>
</body>
</html>

5. spring-security.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="
    http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security 
    http://www.springframework.org/schema/security/spring-security.xsd">

    <!-- 頁(yè)面攔截規(guī)則 -->
    <http use-expressions="false">
        <intercept-url pattern="/**" access="ROLE_USER" />
        <form-login/>   
    </http>

    <!-- 認(rèn)證管理器 -->
    <authentication-manager>
        <authentication-provider>
            <user-service>
                <user name="admin" password="123456" authorities="ROLE_USER"/>
            </user-service>     
        </authentication-provider>  
    </authentication-manager>
</beans:beans>

配置說(shuō)明

1. <beans:beans>

<beans:beans> : :beans之前的beans為前綴,之前并不需要這么配置直接<beans>即可,因?yàn)?code>beans是默認(rèn)的,而在本案例中由于xmlns為xmlns="http://www.springframework.org/schema/security",spring-security才是默認(rèn)的,在使用spring-security相關(guān)的標(biāo)簽是不需要使用前綴,之所以把spring-security設(shè)置為默認(rèn)的,是因?yàn)?code>spring-security使用的標(biāo)簽多且頻繁

2. intercept-url

intercept-url 表示攔截頁(yè)面

/* 表示的是該目錄下的資源饥悴，只包括本級(jí)目錄不包括下級(jí)目錄

/** 表示的是該目錄以及該目錄下所有級(jí)別子目錄的資源

2.1. use-expressions

use-expressions 為是否使用使用 Spring 表達(dá)式語(yǔ)言（ SpEL ）剪勿，默認(rèn)為true ,如果開(kāi)啟，則攔截的配置應(yīng)該寫(xiě)成以下形式

<intercept-url pattern="/**" access="hasRole('ROLE_USER')" />

3. <form-login/>

form-login 為開(kāi)啟表單登陸

此案例我們沒(méi)有登錄頁(yè)，而是使用了系統(tǒng)自動(dòng)生成的登陸頁(yè)

用戶(hù)自定義登錄頁(yè)

實(shí)際開(kāi)發(fā)中清钥，我們不可能使用系統(tǒng)生成的登錄頁(yè)，而是使用我們自己的登錄頁(yè)鹿响。

1.重建登錄頁(yè)

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Login</title>
</head>
<body>
<form action='/login' method='POST'>
    <table>
        <tr>
            <td>用戶(hù)名:</td>
            <td><input type='text' name='username' value=''></td>
        </tr>
        <tr>
            <td>密碼:</td>
            <td><input type='password' name='password' /></td>
        </tr>
        <tr>
            <td colspan='2'><input name="submit" type="submit"
                value="登陸" /></td>
            </tr>
        </table>
    </form>
</body>
</html>

2. 構(gòu)建登陸失敗頁(yè) login_error.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Error</title>
</head>
<body>
    <h1>登錄失敗!!!</h1>
</body>
</html>

3. 修改 spring 配置文件spring-security.xml

<!-- 以下頁(yè)面不被攔截 -->
<http pattern="/login.html" security="none"></http>
<http pattern="/login_error.html" security="none"></http>
<!-- 頁(yè)面攔截規(guī)則 -->
<http use-expressions="false">
    <intercept-url pattern="/*" access="ROLE_USER" />
    <form-login login-page="/login.html" default-target-url="/index.html" authentication-failure-url="/login_error.html"/>  
    <csrf disabled="true"/>
</http>

配置說(shuō)明

1. security="none"

   設(shè)置此資源不被攔截.
   如果你沒(méi)有設(shè)置登錄頁(yè)security="none" 周伦，將會(huì)出現(xiàn)以下錯(cuò)誤

   該網(wǎng)頁(yè)無(wú)法正常運(yùn)作
   localhost將您重定向的次數(shù)過(guò)多
   

   原因是由于自定義的login.html的沒(méi)有設(shè)置通行權(quán)限會(huì)被反復(fù)重定向。

2. form-login

   • login-page：指定登錄頁(yè)面湃崩。
   • authentication-failure-url：指定了身份驗(yàn)證失敗時(shí)跳轉(zhuǎn)到的頁(yè)面荧降。
   • default-target-url：指定了成功進(jìn)行身份驗(yàn)證和授權(quán)后默認(rèn)呈現(xiàn)給用戶(hù)的頁(yè)面。

3. <csrf disabled="true"/>

   關(guān)閉csrf ,如果不加會(huì)出現(xiàn)錯(cuò)誤

   CSRF（Cross-site request forgery）跨站請(qǐng)求偽造攒读，也被稱(chēng)為“One Click Attack”或者Session Riding朵诫，通常縮寫(xiě)為CSRF或者XSRF薄扁，是一種對(duì)網(wǎng)站的惡意利用剪返。