Spring Boot如何使用Spring Security

xiaoxiao2021-03-01  6

依赖

<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency>

Spring Security配置

@Configuration @EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter { public static final String AUTHENTICATION_HEADER_NAME = "Authorization"; public static final String AUTHENTICATION_URL = "/api/auth/login"; public static final String REFRESH_TOKEN_URL = "/api/auth/token"; public static final String API_ROOT_URL = "/api/**"; @Autowired private RestAuthenticationEntryPoint authenticationEntryPoint; @Autowired private AuthenticationSuccessHandler successHandler; @Autowired private AuthenticationFailureHandler failureHandler; @Autowired private AjaxAuthenticationProvider ajaxAuthenticationProvider; @Autowired private JwtAuthenticationProvider jwtAuthenticationProvider; @Autowired private TokenExtractor tokenExtractor; @Autowired private AuthenticationManager authenticationManager; @Autowired private ObjectMapper objectMapper; protected AjaxLoginProcessingFilter buildAjaxLoginProcessingFilter(String loginEntryPoint) throws Exception { AjaxLoginProcessingFilter filter = new AjaxLoginProcessingFilter(loginEntryPoint, successHandler, failureHandler, objectMapper); filter.setAuthenticationManager(this.authenticationManager); return filter; } protected JwtTokenAuthenticationProcessingFilter buildJwtTokenAuthenticationProcessingFilter(List<String> pathsToSkip, String pattern) throws Exception { SkipPathRequestMatcher matcher = new SkipPathRequestMatcher(pathsToSkip, pattern); JwtTokenAuthenticationProcessingFilter filter = new JwtTokenAuthenticationProcessingFilter(failureHandler, tokenExtractor, matcher); filter.setAuthenticationManager(this.authenticationManager); return filter; } @Bean @Override public AuthenticationManager authenticationManagerBean() throws Exception { return super.authenticationManagerBean(); } @Override protected void configure(AuthenticationManagerBuilder auth) { auth.authenticationProvider(ajaxAuthenticationProvider); auth.authenticationProvider(jwtAuthenticationProvider); } @Override protected void configure(HttpSecurity http) throws Exception { List<String> permitAllEndpointList = Arrays.asList( AUTHENTICATION_URL, REFRESH_TOKEN_URL, "/console" ); http .csrf().disable() // 我们不需要基于CSWF的JWT认证 .exceptionHandling() .authenticationEntryPoint(this.authenticationEntryPoint) .and() .sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.STATELESS) .and() .authorizeRequests() .antMatchers(permitAllEndpointList.toArray(new String[permitAllEndpointList.size()])) .permitAll() .and() .authorizeRequests() .antMatchers(API_ROOT_URL).authenticated() // Protected API End-points .and() .addFilterBefore(new CustomCorsFilter(), UsernamePasswordAuthenticationFilter.class) .addFilterBefore(buildAjaxLoginProcessingFilter(AUTHENTICATION_URL), UsernamePasswordAuthenticationFilter.class) .addFilterBefore(buildJwtTokenAuthenticationProcessingFilter(permitAllEndpointList, API_ROOT_URL), UsernamePasswordAuthenticationFilter.class); } }

通过 @EnableWebMvcSecurity 注解开启Spring Security的功能

继承 WebSecurityConfigurerAdapter ,并重写它的方法来设置一些web安全的细节configure(HttpSecurity http) 方法 通过 authorizeRequests() 定义哪些URL需要被保护、哪些不需要被保护。例如以上代码指定了 / 和 /home 不需要任何认证就可以访问,其他的路径都必须通过身份验证。通过 formLogin() 定义当需要用户登录时候,转到的登录页面。configureGlobal(AuthenticationManagerBuilder auth) 方法,在内存中创建了一个用户,该用户的名称为user,密码为password,用户角色为USER。

 

 

 

转载请注明原文地址: https://www.6miu.com/read-3650112.html

最新回复(0)