springboot11-01-security入门

场景：

有3个页面：首页、登录页、登录成功后的主页面，如下图：

如果没有登录，点击“去主页”，会跳转到登录页

如果已经登录，点击“去主页”，跳转到主页，显示“hello 用户名”

下面用springboot + spring security简单实现：

1.新建maven项目，添加pom支持：

 <?xml version="1.0" encoding="UTF-8"?>
 <project xmlns="http://maven.apache.org/POM/4.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>

     <groupId>com.mlxs.springboot11.security01</groupId>
     <artifactId>springboot11-security01</artifactId>
     <version>1.0-SNAPSHOT</version>

     <!--父依赖包-->
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
         <version>1.4.2.RELEASE</version>
         <relativePath/>
     </parent>

     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <java.version>1.8</java.version>
     </properties>

     <dependencies>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter</artifactId>
         </dependency>
         <!--测试-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
         </dependency>
         <!--mvc-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
         <!-- security -->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-security</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-thymeleaf</artifactId>
         </dependency>
     </dependencies>
 </project>

2.boot启动类

@SpringBootApplication
public class StartApp {

    public static void main(String[] args) {
        SpringApplication.run(StartApp.class, args);
    }
}

3.页面控制器类：

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

/**
 * UserController类描述:
 *
 * @author yangzhenlong
 * @since 2017/5/23
 */
@Controller
public class UserController {

    @RequestMapping(value = "/")
    public String index(){
        return "/index";
    }

    @RequestMapping(value = "/login")
    public String login(){
        return "/login";
    }

    @RequestMapping(value = "/home")
    public String home(){
        return "/home";
    }
}

4.WebSecurityConfig配置类

 package com.mlxs.security.config;

 import com.mlxs.util.MD5Util;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.crypto.password.PasswordEncoder;

 /**
  * WebSecurityConfig类描述:
  *
  * @author yangzhenlong
  * @since 2017/5/18
  */
 @Configuration
 @EnableWebSecurity
 //@EnableGlobalMethodSecurity(prePostEnabled = true)//允许进入页面方法前检验
 public class WebSecurityConfig extends WebSecurityConfigurerAdapter{

     @Bean
     @Override
     protected AuthenticationManager authenticationManager() throws Exception {
         return super.authenticationManager();
     }

     @Override
     protected void configure(HttpSecurity httpSecurity) throws Exception {

         httpSecurity.authorizeRequests()
                 .antMatchers("/", "/login").permitAll() //无需验证权限
                 .anyRequest().authenticated() //其他地址的访问均需验证权限
                 .and().formLogin().loginPage("/login").defaultSuccessUrl("/home").permitAll()//指定登录页是"/login" //登录成功后默认跳转到"/home"
                 .and().logout().logoutSuccessUrl("/login").permitAll(); //退出登录后的默认url是"/login"
     }

     /**
      * 全局配置
      * @param builder
      * @throws Exception
      */
     @Autowired
     public void configure(AuthenticationManagerBuilder builder) throws Exception {
         builder
                 .userDetailsService(this.myUDService())
                 .passwordEncoder(this.passwordEncoder());
         //或者用下面的方式，直接配置固定的用户和对应的角色
         /*builder.inMemoryAuthentication().withUser("test").password("1234").roles("USER");
         builder.inMemoryAuthentication().withUser("admin").password("admin").roles("ADMIN");
         builder.inMemoryAuthentication().withUser("dba").password("root").roles("ADMIN","DBA");*/
     }

     /**
      * 设置用户密码的加密方式：MD5加密
      * @return
      */
     @Bean
     public PasswordEncoder passwordEncoder(){
         PasswordEncoder pe = new PasswordEncoder() {//自定义密码加密方式
             //加密
             @Override
             public String encode(CharSequence charSequence) {
                 return MD5Util.encode((String)charSequence);
             }

             //校验密码
             @Override
             public boolean matches(CharSequence charSequence, String s) {
                 return MD5Util.encode((String)charSequence).equals(s);
             }
         };
         return pe;
     }

     /**
      * 自定义用户服务，获取用户信息
      * @return
      */
     @Bean
     public MyUDService myUDService(){
         return new MyUDService();
     }
 }

5.MD5工具类：

 public class MD5Util {

     private static final String SALT = "test";//盐值

     public static String encode(String password) {
         password = password + SALT;
         MessageDigest md5 = null;
         try {
             md5 = MessageDigest.getInstance("MD5");
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
         char[] charArray = password.toCharArray();
         byte[] byteArray = new byte[charArray.length];

         for (int i = 0; i < charArray.length; i++)
             byteArray[i] = (byte) charArray[i];
         byte[] md5Bytes = md5.digest(byteArray);
         StringBuffer hexValue = new StringBuffer();
         for (int i = 0; i < md5Bytes.length; i++) {
             int val = ((int) md5Bytes[i]) & 0xff;
             if (val < 16) {
                 hexValue.append("0");
             }

             hexValue.append(Integer.toHexString(val));
         }
         return hexValue.toString();
     }

     /*public static void main(String[] args) {
         System.out.println(MD5Util.encode("admin"));

         System.out.println("是否相等：" + MD5Util.encode("admin").equals("66d4aaa5ea177ac32c69946de3731ec0"));
     }*/
 }

6.用户信息服务类

 package com.mlxs.security.config;

 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;

 import java.util.ArrayList;
 import java.util.List;

 /**
  * MyUDService类描述: 用户服务类，用来从读取用户信息
  *
  * @author yangzhenlong
  * @since 2017/5/22
  */
 public class MyUDService implements UserDetailsService {
     @Override
     public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
         if(s.equals("admin")) {
             List<SimpleGrantedAuthority> authorities = new ArrayList<SimpleGrantedAuthority>();
             authorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));

             User user = new User("admin", "66d4aaa5ea177ac32c69946de3731ec0", authorities);//用户名和通过MD5加密后的密码
             return user;
         }else{
             throw new UsernameNotFoundException("UserName " + s + " not found");
         }
     }

 }

启动app类，访问：http:localhost:8080

登录用户名/密码： admin / admin