Spring Security 自定义登录页面

SpringMVC + Spring Security，自定义登录页面登录验证

学习参考：http://www.mkyong.com/spring-security/spring-security-form-login-example/

使用的过滤器：

　　1、web.authentication.logout.LogoutFilter：

　　　　监控一个实际为退出功能的URL（默认为/j_spring_security_logout），并且在匹配退出功能。

　　2、web.authentication.UsernamePasswordAuthenticationFilter：

　　　　监控一个使用用户名和密码基于form认证的/j_spring_security_check），并在URL匹配该用户。

项目结构如下图

1、Maven的pom.xml

 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.</modelVersion>
     <groupId>com.mcs</groupId>
     <artifactId>springmvc01</artifactId>
     <version>0.0.-SNAPSHOT</version>
     <packaging>war</packaging>

     <properties>
         <project.build.sourceEncoding>UTF-</project.build.sourceEncoding>
     </properties>

     <dependencies>
         <!-- junit -->
         <dependency>
             <groupId>junit</groupId>
             <artifactId>junit</artifactId>
             <scope>test</scope>
         </dependency>
         <!-- log4j -->
         <dependency>
             <groupId>log4j</groupId>
             <artifactId>log4j</artifactId>
         </dependency>
         <!-- servlet -->
         <dependency>
             <groupId>javax.servlet</groupId>
             <artifactId>javax.servlet-api</artifactId>
             <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>javax.servlet.jsp</groupId>
             <artifactId>javax.servlet.jsp-api</artifactId>
             <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>javax.servlet</groupId>
             <artifactId>jstl</artifactId>
         </dependency>

         <!-- spring -->
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-core</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-context</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-context-support</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-orm</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-webmvc</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-tx</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-jdbc</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-aspects</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-messaging</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-test</artifactId>
         </dependency>
         <!-- spring security -->
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-core</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-web</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-config</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-taglibs</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-acl</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-data</artifactId>
         </dependency>
         <!-- spring data jpa -->
         <dependency>
             <groupId>org.springframework.data</groupId>
             <artifactId>spring-data-jpa</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework.data</groupId>
             <artifactId>spring-data-rest-webmvc</artifactId>
         </dependency>

         <!-- jackson -->
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
         </dependency>

         <!-- commons -->
         <dependency>
             <groupId>commons-logging</groupId>
             <artifactId>commons-logging</artifactId>
         </dependency>
         <dependency>
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
         </dependency>
         <dependency>
             <groupId>commons-fileupload</groupId>
             <artifactId>commons-fileupload</artifactId>
         </dependency>

         <!-- mysql -->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
         </dependency>
         <!-- c3p0 -->
         <dependency>
             <groupId>com.mchange</groupId>
             <artifactId>c3p0</artifactId>
         </dependency>

     </dependencies>

     <dependencyManagement>
         <dependencies>
             <dependency>
                 <groupId>io.spring.platform</groupId>
                 <artifactId>platform-bom</artifactId>
                 <version>2.0..RELEASE</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
             <dependency>
                 <groupId>org.springframework</groupId>
                 <artifactId>spring-framework-bom</artifactId>
                 <version>4.2..RELEASE</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
             <dependency>
                 <groupId>org.springframework.data</groupId>
                 <artifactId>spring-data-releasetrain</artifactId>
                 <version>Gosling-SR1</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
         </dependencies>
     </dependencyManagement>

     <repositories>
         <!-- ... possibly other repository elements ... -->
         <repository>
             <id>spring-milestone</id>
             <name>Spring Milestone Repository</name>
             <url>http://repo.springsource.org/milestone</url>
         </repository>
     </repositories>

 </project>

2、spring-mvc.xml

 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context" xmlns:mvc="http://www.springframework.org/schema/mvc" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
         http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.2.xsd
         http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.2.xsd">

     <context:component-scan base-package="com.mcs.action.**" />

     <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
         <property name="prefix" value="/WEB-INF/views/"></property>
         <property name="suffix" value=".jsp"></property>
     </bean>

 </beans>

3、spring-security.xml

 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security" xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.0.xsd
         http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

     <!-- auto-config = true 则使用from-login. 如果不使用该属性 则默认为http-basic(没有session). -->
     <security:http auto-config="true">
         <!-- intercept-url:拦截器,可以设定哪些路径需要哪些权限来访问. filters=none 不使用过滤,也可以理解为忽略 -->
         <security:intercept-url pattern="/admin**" access="hasRole('ROLE_USER')" />

         <!--
             login-page:默认指定的登录页面.
             authentication-failure-url:出错后跳转页面.
             default-target-url:成功登陆后跳转页面 默认登录保护url
         -->
         <security:form-login
             login-page="/login.action"
             default-target-url="/welcome.action"
             authentication-failure-url="/login.action?error"
             login-processing-url="/j_spring_security_check"
             username-parameter="username"
             password-parameter="password" />

         <!-- logout-success-url:成功注销后跳转到的页面; -->
         <security:logout
              logout-url="/j_spring_security_logout"
              logout-success-url="/login.action"
              invalidate-session="true" />

         <security:http-basic />

         <!-- enable csrf protection -->
         <security:csrf />
     </security:http>

     <security:authentication-manager>
         <security:authentication-provider>
             <security:user-service>
                 <security:user name="admin" password="" authorities="ROLE_USER" />
             </security:user-service>
         </security:authentication-provider>
     </security:authentication-manager>

 </beans>

4、web.xml

 <?xml version="1.0" encoding="UTF-8"?>
 <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xmlns="http://xmlns.jcp.org/xml/ns/javaee"
     xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
     id="WebApp_ID" version="3.1">

     <!-- 项目名称 -->
     <display-name>Spring security</display-name>    

     <!-- 配置字符集过滤器 -->
     <!-- 必须配置在所有过滤器的前面 -->
     <filter>
         <filter-name>encodingFilter</filter-name>
         <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
         <init-param>
             <param-name>encoding</param-name>
             <param-value>UTF-</param-value>
         </init-param>
     </filter>
     <!-- 配置项目的编码mapping -->
     <filter-mapping>
         <filter-name>encodingFilter</filter-name>
         <url-pattern>/*</url-pattern>
     </filter-mapping>

     <!-- 配置spring security filter -->
     <filter>
         <filter-name>springSecurityFilterChain</filter-name>
         <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
     </filter>
     <filter-mapping>
         <filter-name>springSecurityFilterChain</filter-name>
         <url-pattern>/*</url-pattern>
     </filter-mapping>

         <!-- 开启spring功能 -->
     <listener>
         <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
     </listener>

     <!-- 防止内存溢出监听器 -->
     <listener>
         <listener-class>org.springframework.web.util.IntrospectorCleanupListener</listener-class>
     </listener>    

     <!-- 指定spring相关文件的位置 -->
     <context-param>
         <param-name>contextConfigLocation</param-name>
         <param-value>classpath:spring-security.xml</param-value>
     </context-param>

     <!-- 配置spring mvc -->
     <servlet>
         <servlet-name>springMvc</servlet-name>
         <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
         <init-param>
             <param-name>contextConfigLocation</param-name>
             <param-value>classpath:spring-mvc.xml</param-value>
         </init-param>
         <load-on-startup>1</load-on-startup>
     </servlet>
     <!-- 配置spring mvc mapping -->
     <servlet-mapping>
         <servlet-name>springMvc</servlet-name>
         <url-pattern>*.action</url-pattern>
     </servlet-mapping>

     <!-- 配置session超时时间，单位分钟 -->
     <session-config>
         <session-timeout>15</session-timeout>
     </session-config>

     <!-- 设置欢迎页面 -->
     <welcome-file-list>
         <welcome-file>/index.jsp</welcome-file>
     </welcome-file-list>

 </web-app>

5、HelloController

 package com.mcs.action;

 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.servlet.ModelAndView;

 @Controller
 public class HelloController {

     @RequestMapping(value = { "/", "/welcome**" }, method = RequestMethod.GET)
     public ModelAndView welcomePage() {

         ModelAndView model = new ModelAndView();
         model.addObject("title", "Spring Security Hello World");
         model.addObject("message", "这是一个欢迎页面!");
         model.setViewName("hello");
         return model;

     }

     @RequestMapping(value = "/admin**", method = RequestMethod.GET)
     public ModelAndView adminPage() {

         ModelAndView model = new ModelAndView();
         model.addObject("title", "Spring Security Hello World");
         model.addObject("message", "这是一个安全被保护的页面!");
         model.setViewName("admin");

         return model;

     }

     //Spring Security see this :
         @RequestMapping(value = "/login", method = RequestMethod.GET)
         public ModelAndView login(
             @RequestParam(value = "error", required = false) String error,
             @RequestParam(value = "logout", required = false) String logout) {

             ModelAndView model = new ModelAndView();
             if (error != null) {
                 model.addObject("error", "用户名或密码不正确!");
             }

             if (logout != null) {
                 model.addObject("msg", "您已成功注销系统.");
             }
             model.setViewName("login");

             return model;

         }

 }

6、hello.jsp

 <%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
 <%@page session="false"%>
 <html>
 <body>
     <h1>标题 : ${title}</h1>
     <h1>消息 : ${message}</h1>
 </body>
 </html>

7、login.jsp

 <%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
 <%@ taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt"%>

 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
 <title>Insert title here</title>
     <style>
         .error {
             padding: 15px;
             margin-bottom: 20px;
             border: 1px solid transparent;
             border-radius: 4px;
             color: #a94442;
             background-color: #f2dede;
             border-color: #ebccd1;
         }

         .msg {
             padding: 15px;
             margin-bottom: 20px;
             border: 1px solid transparent;
             border-radius: 4px;
             color: #31708f;
             background-color: #d9edf7;
             border-color: #bce8f1;
         }

         #login-box {
             width: 300px;
             padding: 20px;
             margin: 100px auto;
             background: #fff;
             -webkit-border-radius: 2px;
             -moz-border-radius: 2px;
             border: 1px solid #;
         }
     </style>
 </head>
 <body onload='document.loginForm.username.focus();'>
     <div id="login-box">
         <h2>请输入您的用户名与密码</h2>
         <c:if test="${not empty error}">
             <div class="error">${error}</div>
         </c:if>
         <c:if test="${not empty msg}">
             <div class="msg">${msg}</div>
         </c:if>

         <form name='loginForm'  action="<c:url value='/j_spring_security_check' />" method='POST'>
               <table>
                 <tr>
                     <td>用户:</td>
                     <td><input type='text' name='username' value=''></td>
                 </tr>
                 <tr>
                     <td>密码:</td>
                     <td><input type='password' name='password' /></td>
                 </tr>
                 <tr>
                     <td colspan=''><input name="submit" type="submit"
                         value="登录" /></td>
                 </tr>
               </table>

               <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
         </form>
     </div>

 </body>
 </html>

8、admin.jsp

 <%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
 <%@page session="true"%>
 <html>
 <body>
     <h1>标题 : ${title}</h1>
     <h1>消息 : ${message}</h1>

     <c:url value="/j_spring_security_logout"  var="logoutUrl" />

     <!-- csrt for log out-->
     <form action="${logoutUrl}" method="post" id="logoutForm">
       <input type="hidden"  name="${_csrf.parameterName}" value="${_csrf.token}" />
     </form>

     <script>
         function formSubmit() {
             document.getElementById("logoutForm").submit();
         }
     </script>

     <c:if test="${pageContext.request.userPrincipal.name != null}">
         <h2>
             欢迎 : ${pageContext.request.userPrincipal.name} 登录本系统 | <a
                 href="javascript:formSubmit()"> 注销</a>
         </h2>
     </c:if>

 </body>
 </html>