Spring Security前后端分离接入流程保姆级教程

基于角色权限模型与数据权限控制

以小明的摄影作品管理系统为例，从零基础搭建到完整认证鉴权，逐步演示 Spring Security 的接入流程。涵盖基础接入、角色权限扩展、数据权限控制三大模块，每步标注自定义类与 Spring Security 扩展点，配代码、注释和逻辑说明。使用 MyBatisPlus 作为 ORM 框架。

第一部分：基础接入流程 — 前后端分离认证鉴权

第一步：环境准备与依赖引入

目的

搭建 Spring Boot 基础项目，引入 Spring Security 及前后端分离必需组件，使用 MyBatisPlus 替代 JPA 。

操作

** 创建 Spring Boot 项目 **

通过 start.spring.io 创建，选择 Maven 、 Java 17+ ，添加依赖 Spring Web 、 Spring Security 、 MyBatis Plus 、 MySQL Driver 、 Lombok 。
** Pom.xml 核心依赖 **

<dependencies>

    <!-- Spring Web -->

    <dependency>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-web</artifactId>

    </dependency>  

    <!-- Spring Security -->

    <dependency>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-security</artifactId>

    </dependency>  

    <!-- MyBatis Plus -->

    <dependency>

        <groupId>com.baomidou</groupId>

        <artifactId>mybatis-plus-boot-starter</artifactId>

        <version>3.5.3.1</version>

    </dependency>  

    <!-- MySQL驱动 -->

    <dependency>

        <groupId>com.mysql</groupId>

        <artifactId>mysql-connector-j</artifactId>

        <scope>runtime</scope>

    </dependency>  

    <!-- JWT支持 -->

    <dependency>

        <groupId>io.jsonwebtoken</groupId>

        <artifactId>jjwt-api</artifactId>

        <version>0.11.5</version>

    </dependency>

    <dependency>

        <groupId>io.jsonwebtoken</groupId>

        <artifactId>jjwt-impl</artifactId>

        <version>0.11.5</version>

        <scope>runtime</scope>

    </dependency>

    <dependency>

        <groupId>io.jsonwebtoken</groupId>

        <artifactId>jjwt-jackson</artifactId>

        <version>0.11.5</version>

        <scope>runtime</scope>

    </dependency>  

    <!-- Lombok -->

    <dependency>

        <groupId>org.projectlombok</groupId>

        <artifactId>lombok</artifactId>

        <optional>true</optional>

    </dependency>

</dependencies>

第二步：数据库设计与实体类

目的

设计用户、角色表，并让用户 PO 类实现 Spring Security 的 UserDetails 接口。

操作

** 数据库表设计 **

CREATE TABLE sys_user (

    id BIGINT AUTO_INCREMENT PRIMARY KEY,

    username VARCHAR(50) NOT NULL UNIQUE COMMENT '用户名',

    password VARCHAR(100) NOT NULL COMMENT 'BCrypt加密密码',

    email VARCHAR(100) COMMENT '邮箱',

    enabled BOOLEAN DEFAULT TRUE COMMENT '账户是否启用'

);  

CREATE TABLE sys_role (

    id BIGINT AUTO_INCREMENT PRIMARY KEY,

    role_name VARCHAR(50) NOT NULL UNIQUE COMMENT '角色名称（无ROLE_前缀）'

);  

CREATE TABLE sys_user_role (

    user_id BIGINT,

    role_id BIGINT,

    PRIMARY KEY (user_id, role_id),

    FOREIGN KEY (user_id) REFERENCES sys_user(id),

    FOREIGN KEY (role_id) REFERENCES sys_role(id)

);

** 实体类 UserPo 实现 UserDetails 接口 **

import com.baomidou.mybatisplus.annotation.TableName;

import lombok.Data;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.authority.SimpleGrantedAuthority;

import org.springframework.security.core.userdetails.UserDetails;

import java.util.Collection;

import java.util.Set;

import java.util.stream.Collectors;  

@Data

@TableName("sys_user")

public class UserPo implements UserDetails {

    private Long id;

    private String username;

    private String password;

    private String email;

    private Boolean enabled = true;

    private Set<RolePo> roles;  

    @Override

    public Collection<? extends GrantedAuthority> getAuthorities() {

        return roles.stream()

            .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getRoleName()))

            .collect(Collectors.toList());

    }  

    @Override

    public boolean isAccountNonExpired() { return true; }  

    @Override

    public boolean isAccountNonLocked() { return true; }  

    @Override

    public boolean isCredentialsNonExpired() { return true; }  

    @Override

    public boolean isEnabled() { return enabled; }

}

** 角色实体类 RolePo **

import com.baomidou.mybatisplus.annotation.TableName;

import lombok.Data;  

@Data

@TableName("sys_role")

public class RolePo {

    private Long id;

    private String roleName;

}

第三步： MyBatisPlus Mapper 层

目的

使用 MyBatisPlus Mapper 操作数据库。

操作

** UserMapper 接口 **

import com.baomidou.mybatisplus.core.mapper.BaseMapper;

import org.apache.ibatis.annotations.Param;

import java.util.Optional;  

public interface UserMapper extends BaseMapper<UserPo> {

    Optional<UserPo> findByUsername(@Param("username") String username);

}

** RoleMapper 接口 **

import com.baomidou.mybatisplus.core.mapper.BaseMapper;

import org.apache.ibatis.annotations.Param;  

public interface RoleMapper extends BaseMapper<RolePo> {

    Optional<RolePo> findByRoleName(@Param("roleName") String roleName);

}

第四步： Service 层 — 实现 UserDetailsService

目的

实现 Spring Security 的 UserDetailsService 接口，配置密码编码器。

操作

** 自定义 UserDetailsService 实现类 **

import lombok.RequiredArgsConstructor;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.core.userdetails.UsernameNotFoundException;

import org.springframework.stereotype.Service;  

@Service

@RequiredArgsConstructor

public class UserDetailsServiceImpl implements UserDetailsService {  

    private final UserMapper userMapper;  

    @Override

    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        UserPo user = userMapper.findByUsername(username)

            .orElseThrow(() -> new UsernameNotFoundException("用户不存在：" + username));

        return user;

    }

}

** 配置密码编码器 **

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.crypto.password.PasswordEncoder;  

@Configuration

public class PasswordEncoderConfig {  

    @Bean

    public PasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();

    }

}

第五步： Spring Security 配置类

目的

配置认证规则、授权规则、 JWT 过滤器。

操作

** 自定义 Security 配置类 **

import lombok.RequiredArgsConstructor;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.authentication.AuthenticationManager;

import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;

import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.http.SessionCreationPolicy;

import org.springframework.security.crypto.password.PasswordEncoder;

import org.springframework.security.web.SecurityFilterChain;

import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;  

@Configuration

@EnableWebSecurity

@EnableGlobalMethodSecurity(prePostEnabled = true)

@RequiredArgsConstructor

public class SecurityConfig {  

    private final UserDetailsServiceImpl userDetailsService;

    private final JwtAuthFilter jwtAuthFilter;

    private final PasswordEncoder passwordEncoder;  

    @Bean

    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

        http.csrf(csrf -> csrf.disable())

            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))

            .authorizeHttpRequests(auth -> auth

                .requestMatchers("/api/auth/login", "/api/auth/register").permitAll()

                .requestMatchers("/api/admin/**").hasRole("ADMIN")

                .requestMatchers("/api/user/**").hasAnyRole("ADMIN", "USER")

                .anyRequest().authenticated()

            )

            .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class)

            .userDetailsService(userDetailsService)

            .passwordEncoder(passwordEncoder);  

        return http.build();

    }  

    @Bean

    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {

        return config.getAuthenticationManager();

    }

}

第六步： JWT 工具类与过滤器

目的

实现 JWT 生成、验证、提取用户名，并通过过滤器转换为认证信息。

操作

** JWT 工具类 JwtUtils **

import io.jsonwebtoken.Claims;

import io.jsonwebtoken.Jwts;

import io.jsonwebtoken.SignatureAlgorithm;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.stereotype.Component;

import java.util.Date;

import java.util.function.Function;  

@Component

public class JwtUtils {  

    @Value("${app.jwt.secret}")

    private String secret;  

    @Value("${app.jwt.expiration}")

    private long expiration;  

    public String generateToken(UserDetails userDetails) {

        return Jwts.builder()

            .setSubject(userDetails.getUsername())

            .setIssuedAt(new Date())

            .setExpiration(new Date(System.currentTimeMillis() + expiration))

            .signWith(SignatureAlgorithm.HS256, secret)

            .compact();

    }  

    public String extractUsername(String token) {

        return extractClaim(token, Claims::getSubject);

    }  

    public boolean validateToken(String token, UserDetails userDetails) {

        final String username = extractUsername(token);

        return (username.equals(userDetails.getUsername())) && !isTokenExpired(token);

    }  

    private <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {

        final Claims claims = Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();

        return claimsResolver.apply(claims);

    }  

    private boolean isTokenExpired(String token) {

        return extractClaim(token, Claims::getExpiration).before(new Date());

    }

}

** JWT 认证过滤器 JwtAuthFilter **

import lombok.RequiredArgsConstructor;

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import org.springframework.security.core.context.SecurityContextHolder;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;

import org.springframework.stereotype.Component;

import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;  

@Component

@RequiredArgsConstructor

public class JwtAuthFilter extends OncePerRequestFilter {  

    private final JwtUtils jwtUtils;

    private final UserDetailsServiceImpl userDetailsService;  

    @Override

    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)

            throws ServletException, IOException {

        try {

            String jwt = parseJwt(request);

            if (jwt != null && jwtUtils.validateToken(jwt)) {

                String username = jwtUtils.extractUsername(jwt);

                UserDetails userDetails = userDetailsService.loadUserByUsername(username);

                UsernamePasswordAuthenticationToken authentication =

                    new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());

                authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));

                SecurityContextHolder.getContext().setAuthentication(authentication);

            }

        } catch (Exception e) {

            logger.error("无法设置用户认证: {}", e);

        }  

        filterChain.doFilter(request, response);

    }  

    private String parseJwt(HttpServletRequest request) {

        String headerAuth = request.getHeader("Authorization");

        if (headerAuth != null && headerAuth.startsWith("Bearer ")) {

            return headerAuth.substring(7);

        }

        return null;

    }

}

第七步：登录接口与资源接口

目的

编写登录接口认证并生成 Token ，编写受保护资源接口。

操作

** 登录控制器 AuthController **

import lombok.RequiredArgsConstructor;

import org.springframework.http.ResponseEntity;

import org.springframework.security.authentication.AuthenticationManager;

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import org.springframework.security.core.Authentication;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.web.bind.annotation.*;  

@RestController

@RequestMapping("/api/auth")

@RequiredArgsConstructor

public class AuthController {  

    private final AuthenticationManager authenticationManager;

    private final JwtUtils jwtUtils;  

    @PostMapping("/login")

    public ResponseEntity<JwtResponse> login(@RequestBody LoginRequest loginRequest) {

        Authentication authentication = authenticationManager.authenticate(

            new UsernamePasswordAuthenticationToken(

                loginRequest.getUsername(),

                loginRequest.getPassword()

            )

        );  

        SecurityContextHolder.getContext().setAuthentication(authentication);

        UserDetails userDetails = (UserDetails) authentication.getPrincipal();

        String jwt = jwtUtils.generateToken(userDetails);  

        return ResponseEntity.ok(new JwtResponse(jwt, userDetails.getUsername()));

    }

}

第二部分：权限表扩展指南 — 基于角色权限模型

一、数据库扩展

目的

新增权限表实现细粒度权限控制。

操作

** 新增权限表结构 **

CREATE TABLE sys_permission (

    id BIGINT AUTO_INCREMENT PRIMARY KEY,

    permission_symbol VARCHAR(100) NOT NULL UNIQUE COMMENT '权限符号（如 user:add）',

    permission_name VARCHAR(100) NOT NULL COMMENT '权限名称'

);  

CREATE TABLE sys_role_permission (

    role_id BIGINT,

    permission_id BIGINT,

    PRIMARY KEY (role_id, permission_id),

    FOREIGN KEY (role_id) REFERENCES sys_role(id),

    FOREIGN KEY (permission_id) REFERENCES sys_permission(id)

);

二、实体类扩展

目的

修改角色与用户实体类关联权限。

操作

** 新增权限实体类 PermissionPo **

import com.baomidou.mybatisplus.annotation.TableName;

import lombok.Data;

import java.util.Set;  

@Data

@TableName("sys_permission")

public class PermissionPo {

    private Long id;

    private String permissionSymbol;

    private String permissionName;

    private Set<RolePo> roles;

}

** 修改角色实体类 RolePo **

import com.baomidou.mybatisplus.annotation.TableName;

import lombok.Data;

import java.util.Set;  

@Data

@TableName("sys_role")

public class RolePo {

    private Long id;

    private String roleName;

    private Set<PermissionPo> permissions;

    private Set<UserPo> users;

}

** 修改用户实体类 UserPo 权限加载 **

@Override

public Collection<? extends GrantedAuthority> getAuthorities() {

    Set<GrantedAuthority> authorities = new HashSet<>();

    for (RolePo role : roles) {

        authorities.add(new SimpleGrantedAuthority("ROLE_" + role.getRoleName()));

        for (PermissionPo permission : role.getPermissions()) {

            authorities.add(new SimpleGrantedAuthority(permission.getPermissionSymbol()));

        }

    }

    return authorities;

}

三、 MyBatisPlus Mapper 扩展

目的

添加权限相关 Mapper 接口。

操作

** PermissionMapper **

import com.baomidou.mybatisplus.core.mapper.BaseMapper;

import org.apache.ibatis.annotations.Param;

import java.util.Optional;  

public interface PermissionMapper extends BaseMapper<PermissionPo> {

    Optional<PermissionPo> findByPermissionSymbol(@Param("symbol") String symbol);

}

四、 Service 层扩展

目的

实现权限管理服务。

操作

** 权限管理服务 PermissionService **

import lombok.RequiredArgsConstructor;

import org.springframework.stereotype.Service;

import org.springframework.transaction.annotation.Transactional;

import java.util.Arrays;

import java.util.stream.Collectors;  

@Service

@RequiredArgsConstructor

public class PermissionService {  

    private final PermissionMapper permissionMapper;

    private final RoleMapper roleMapper;  

    @Transactional

    public void assignPermissionToRole(Long roleId, String permissionSymbol) {

        RolePo role = roleMapper.selectById(roleId);

        PermissionPo permission = permissionMapper.findByPermissionSymbol(permissionSymbol)

            .orElseGet(() -> {

                PermissionPo p = new PermissionPo();

                p.setPermissionSymbol(permissionSymbol);

                p.setPermissionName(parsePermissionName(permissionSymbol));

                permissionMapper.insert(p);

                return p;

            });  

        role.getPermissions().add(permission);

        roleMapper.updateById(role);

    }  

    private String parsePermissionName(String symbol) {

        return Arrays.stream(symbol.split(":"))

            .map(word -> word.substring(0, 1).toUpperCase() + word.substring(1))

            .collect(Collectors.joining(" "));

    }

}

五、控制器层扩展 — 使用权限注解

目的

通过 @PreAuthorize 注解控制方法权限。

操作

** 用户控制器使用权限注解 **

import org.springframework.security.access.prepost.PreAuthorize;

import org.springframework.web.bind.annotation.*;  

@RestController

@RequestMapping("/api/users")

public class UserController {  

    @PostMapping

    @PreAuthorize("hasAuthority('user:add')")

    public ResponseEntity<?> addUser() {

        return ResponseEntity.ok("添加用户");

    }  

    @DeleteMapping("/{id}")

    @PreAuthorize("hasAuthority('user:delete')")

    public ResponseEntity<?> deleteUser(@PathVariable Long id) {

        return ResponseEntity.ok("删除用户");

    }

}

第三部分：数据权限控制 — 订单查询只查看自己创建的订单

一、数据库扩展 — 订单表

目的

设计订单表关联创建人。

操作

** 订单表结构 **

CREATE TABLE sys_order (

    id BIGINT AUTO_INCREMENT PRIMARY KEY,

    order_no VARCHAR(50) NOT NULL COMMENT '订单编号',

    amount DECIMAL(10,2) NOT NULL COMMENT '订单金额',

    creator_id BIGINT NOT NULL COMMENT '创建人ID',

    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,

    FOREIGN KEY (creator_id) REFERENCES sys_user(id)

);

** 订单实体类 OrderPo **

import com.baomidou.mybatisplus.annotation.TableName;

import lombok.Data;

import java.math.BigDecimal;

import java.time.LocalDateTime;  

@Data

@TableName("sys_order")

public class OrderPo {

    private Long id;

    private String orderNo;

    private BigDecimal amount;

    private Long creatorId;

    private LocalDateTime createdAt;

}

二、 MyBatisPlus Mapper 与 Service

目的

实现订单数据访问与权限过滤。

操作

** OrderMapper **

import com.baomidou.mybatisplus.core.mapper.BaseMapper;

import org.apache.ibatis.annotations.Param;

import java.util.List;  

public interface OrderMapper extends BaseMapper<OrderPo> {

    List<OrderPo> findByCreatorId(@Param("creatorId") Long creatorId);

}

** 订单服务实现 **

import lombok.RequiredArgsConstructor;

import org.springframework.security.core.context.SecurityContextHolder;

import org.springframework.stereotype.Service;

import java.util.List;  

@Service

@RequiredArgsConstructor

public class OrderServiceImpl implements OrderService {  

    private final OrderMapper orderMapper;

    private final UserMapper userMapper;  

    @Override

    public List<OrderPo> findMyOrders() {

        UserPo currentUser = getCurrentUser();

        return orderMapper.findByCreatorId(currentUser.getId());

    }  

    @Override

    public OrderPo findOrderById(Long id) {

        OrderPo order = orderMapper.selectById(id);

        UserPo currentUser = getCurrentUser();  

        if (!order.getCreatorId().equals(currentUser.getId())) {

            throw new AccessDeniedException("无权访问此订单");

        }

        return order;

    }  

    private UserPo getCurrentUser() {

        String username = SecurityContextHolder.getContext().getAuthentication().getName();

        return userMapper.findByUsername(username).orElseThrow();

    }

}

三、控制器层实现

目的

编写订单相关接口，集成数据权限控制。

操作

** 订单控制器 **

import org.springframework.security.access.prepost.PreAuthorize;

import org.springframework.web.bind.annotation.*;  

@RestController

@RequestMapping("/api/orders")

@RequiredArgsConstructor

public class OrderController {  

    private final OrderService orderService;  

    @GetMapping

    @PreAuthorize("hasAuthority('order:view')")

    public ResponseEntity<List<OrderPo>> getMyOrders() {

        List<OrderPo> orders = orderService.findMyOrders();

        return ResponseEntity.ok(orders);

    }  

    @GetMapping("/{id}")

    @PreAuthorize("hasAuthority('order:view')")

    public ResponseEntity<OrderPo> getOrderById(@PathVariable Long id) {

        OrderPo order = orderService.findOrderById(id);

        return ResponseEntity.ok(order);

    }

}

总结

通过以上三部分整合，我们实现了 Spring Security 前后端分离接入、角色权限扩展、数据权限控制的完整流程。核心要点如下：

** 基础接入 ** ：实现用户认证与 JWT 授权。
** 权限扩展 ** ：通过权限表与角色关联，实现细粒度权限控制。
** 数据权限 ** ：在 Service 层手动过滤数据，确保用户只能查看自己创建的订单。

整个系统兼顾了安全性与灵活性，适用于中小型项目的权限管理需求。