10. spring boot security (2刷）

￡神魔★判官ぃ 2022-09-08 03:39 116阅读 0赞

## security ##

### 1. pom ###

<dependency>
    			<groupId>org.springframework.boot</groupId>
    			<artifactId>spring-boot-starter-security</artifactId>
    		</dependency>
    
    		<dependency>
    			<groupId>org.springframework.boot</groupId>
    			<artifactId>spring-boot-starter-thymeleaf</artifactId>
    		</dependency>
    
    		starter-web
    
    		<dependency>
    			<groupId>org.thymeleaf.extras</groupId>
    			<artifactId>thymeleaf-extras-springsecurity4</artifactId>
    			<version>3.0.4.RELEASE</version>
    		</dependency>
    
    		
    
    			<groupId>org.springframework.boot</groupId>
    			<artifactId>spring-boot-starter-data-jpa</artifactId>
    
    			<groupId>mysql</groupId>
    			<artifactId>mysql-connector-java</artifactId>

### 配置 Web Security Configurer Adapter ###

*  配置AuthenticationManagerBuilder 和 httpSecurity

@EnableWebSecurity
    @Configuration
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class SecurityConfig extends WebSecurityConfigurerAdapter { 
    
    
    	@Autowired
    	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
            
            //放入内存中的。用密码解析器
    		auth.inMemoryAuthentication()
                .passwordEncoder(new BCryptPasswordEncoder())
                //用户名 和 密码，角色为 roles
                .withUser("forezp")
                .password(new BCryptPasswordEncoder().encode("123456"))
                .roles("USER");
            
    	}
    	// @formatter:on
        
        
        	@Override
    	protected void configure(HttpSecurity http) throws Exception { 
    		http
    				.authorizeRequests()
    					.antMatchers("/css/**", "/index").permitAll()
    					.antMatchers("/user/**").hasRole("USER")
    				    .antMatchers("/blogs/**").hasRole("USER")
    					.and()
    				.formLogin().loginPage("/login").failureUrl("/login-error")
    				.and()
    				.exceptionHandling().accessDeniedPage("/401");
    		http.logout().logoutSuccessUrl("/");
    	}
    
    }

public class MyPasswordEncoder implements PasswordEncoder { 
        @Override
        public String encode(CharSequence charSequence) { 
            return charSequence.toString();
        }
    
        @Override
        public boolean matches(CharSequence charSequence, String s) { 
            return s.equals(charSequence.toString());
        }
    
    }

### controller ###

@Controller
    public class MainController { 
    
    	@RequestMapping("/")
    	public String root() { 
    		return "redirect:/index";
    	}
    
    	@RequestMapping("/index")
    	public String index() { 
    		return "index";
    	}
    
    	@RequestMapping("/user/index")
    	public String userIndex() { 
    		return "user/index";
    	}
    
    	@RequestMapping("/login")
    	public String login() { 
    		return "login";
    	}
    
    	@RequestMapping("/login-error")
    	public String loginError(Model model) { 
    		model.addAttribute("loginError", true);
    		return "login";
    	}
    	@GetMapping("/401")
    	public String accesssDenied() { 
    		return "401";
    	}
    }

### yaml配置 ###

server:
      port: 8080
    
    #logging:
    # level:
    # root: WARN
    # org.springframework.web: INFO
    # org.springframework.security: INFO
    
    spring:
      thymeleaf:
        mode: HTML5
        encoding: UTF-8
        cache: false
    
      datasource:
        driver-class-name: com.mysql.jdbc.Driver
        url: jdbc:mysql://192.168.44.146:3306/spring-security?useUnicode=true&characterEncoding=utf8&characterSetResults=utf8&serverTimezone=GMT%2B8
        username: root
        password: root
    
      jpa:
        hibernate:
          ddl-auto: update
        show-sql: true

### 前端文件 ###

#### 目录结构 ####

resources下

*  有 static 下有 css目录，
 *  有templates 目录，下有 blogs和 user目录

#### templates下 文件 login.html ####

<!DOCTYPE html>
    <html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org">
        <head>
            <title>Login page</title>
            <meta charset="utf-8" />
            <link rel="stylesheet" href="/css/main.css" th:href="@{/css/main.css}" />
    	</head>
        <body>
            <h1>Login page</h1>
            <p>User角色用户: forezp / 123456</p>
            <p>Admin角色用户: admin / 123456</p>
            <p th:if="${loginError}" class="error">用户名或密码错误</p>
            <form th:action="@{/login}" method="post">
                <label for="username">用户名</label>:
                <input type="text" id="username" name="username" autofocus="autofocus" /> <br />
                <label for="password">密码</label>:
                <input type="password" id="password" name="password" /> <br />
                <input type="submit" value="登录" />
            </form>
            <p><a href="/index" th:href="@{/index}">返回首页</a></p>
        </body>
    </html>

#### templatese下 index.html文件 ####

<head>
            <title>Hello Spring Security</title>
            <meta charset="utf-8" />
            <link rel="stylesheet" href="/css/main.css" th:href="@{/css/main.css}" />
        </head>
        <body>
    
            <h1>Hello Spring Security</h1>
            <p>这个界面没有受保护，你可以进已被保护的界面.</p>
    
            <div th:fragment="logout" sec:authorize="isAuthenticated()">
                登录用户: <span sec:authentication="name"></span> |
                用户角色: <span sec:authentication="principal.authorities"></span>
                <div>
                    <form action="#" th:action="@{/logout}" method="post">
                        <input type="submit" value="登出" />
                    </form>
                </div>
            </div>
    
            <ul>
                <li>点击<a href="/user/index" th:href="@{/user/index}">去/user/index保护的界面</a></li>
            </ul>
        </body>

#### templates下 404.html ####

<body>
    	<div >
          	<div >
            	<h2> 权限不够</h2>
            </div>
    		<div sec:authorize="isAuthenticated()">
    			<p>已有用户登录</p>
    			<p>用户: <span sec:authentication="name"></span></p>
     			<p>角色: <span sec:authentication="principal.authorities"></span></p>
    		</div>
     		<div sec:authorize="isAnonymous()">
    			<p>未有用户登录</p>
    		</div>
    		<p>
    			拒绝访问！
    		</p>
    	</div>
    
    </body>

#### /user/index.html ####

<head>
            <title>Hello Spring Security</title>
            <meta charset="utf-8" />
            <link rel="stylesheet" href="/css/main.css" th:href="@{/css/main.css}" />
        </head>
        <body>
            <div th:substituteby="index::logout"></div>
            <h1>这个界面是被保护的界面</h1>
            <p><a href="/index" th:href="@{/index}">返回首页</a></p>
    
            <p><a href="/blogs" th:href="@{/blogs}">管理博客</a></p>
    
    
        </body>

#### /blogs/list.html ####

<!DOCTYPE html>
    <html xmlns:th="http://www.thymeleaf.org" >
    <body>
    <div>
        <table >
            <thead>
            <tr>
                <td>博客编号</td>
                <td>博客名称</td>
                <td>博客描述</td>
            </tr>
            </thead>
            <tbody>
            <tr th:each="blog: ${blogModel.blogsList}">
                <td th:text="${blog.id}"></td>
                <td th:text="${blog.name}"></td>
                <td th:text="${blog.content}"></td>
                <td>
                    <div >
                        <a th:href="@{ '/blogs/' + ${blog.id}+'/deletion'}">
                            删除
                        </a>
                    </div>
                </td>
            </tr>
            </tbody>
        </table>
    </div>
    
    </body>
    </html>

### 测试 ###

> http://localhost:8080/index 可以访问
> 
> http://localhost:8080/user/index 会跳转到：http://localhost:8080/login （需要USER权限）
> 
> 登录后：即可访问到 /user/index

### 2. 增加 Admin 角色，删除博客 ###

auth.inMemoryAuthentication()
        .passwordEncoder(new BCryptPasswordEncoder())
        .withUser("admin")
        .password(new BCryptPasswordEncoder().encode("123456"))
        .roles("ADMIN","USER");

#### blogs controller ####

@RestController
    @RequestMapping("/blogs")
    public class BlogController { 
    
        @Autowired
        BlogService blogService;
        
        @GetMapping
        public ModelAndView list(Model model) { 
    
            List<Blog> list =blogService.getBlogs();
            model.addAttribute("blogsList", list);
            return new ModelAndView("blogs/list", "blogModel", model);
        }
    
        //重要
        @PreAuthorize("hasAuthority('ROLE_ADMIN')")  // 对应 ADMIN 权限
        @GetMapping(value = "/{id}/deletion")
        public ModelAndView delete(@PathVariable("id") Long id, Model model) { 
            blogService.deleteBlog(id);
            model.addAttribute("blogsList", blogService.getBlogs());
            return new ModelAndView("blogs/list", "blogModel", model);
        }
    }

#### 实体类 service 等 ####

public class Blog { 
        private Long id;
        private String name;
        private String content;
    
    }

@Service
    public class BlogService implements IBlogService { 
    
        private List<Blog> list=new ArrayList<>();
    
        public BlogService(){ 
            list.add(new Blog(1L, " spring in action", "good!"));
            list.add(new Blog(2L,"spring boot in action", "nice!"));
        }
    
        @Override
        public List<Blog> getBlogs() { 
            return list;
        }
    
        @Override
        public void deleteBlog(long id) { 
            Iterator iter = list.iterator();
            while(iter.hasNext()) { 
                Blog blog= (Blog) iter.next();
                if (blog.getId()==id){ 
                    iter.remove();
                }
            }
        }
    }

> 测试为：只有admin 登录了，才能删除

### 3. 从数据库中 读取数据 ###

*  引用 pom

starter-data-jpa
    mysql-connector-java

*  yaml配置是那些，jpa自动创建 和 mysql配置

#### user类 ####

@Entity
    public class User implements UserDetails, Serializable { 
    
    	@Id
    	@GeneratedValue(strategy = GenerationType.IDENTITY)
    	private Long id;
    
    	@Column(nullable = false,  unique = true)
    	private String username;
    
    	@Column
    	private String password;
    
        //多对多表， user_id 和 role_id，表明为：user_role
    	@ManyToMany(cascade = CascadeType.ALL, fetch = FetchType.EAGER)
    	@JoinTable(name = "user_role", 
                   joinColumns = @JoinColumn(name = "user_id", referencedColumnName = "id"),
    		inverseJoinColumns = @JoinColumn(name = "role_id", referencedColumnName = "id"))
    	private List<Role> authorities;
        
    
    	public User() { 
    	}
    
    	//id get set
    
    	@Override
    	public Collection<? extends GrantedAuthority> getAuthorities() { 
    		return authorities;
    	}
    
    	public void setAuthorities(List<Role> authorities) { 
    		this.authorities = authorities;
    	}
    
    	@Override
    	getUsername()
        
        //name set
    	
    
    	@Override
    	getPassword() 
    	
    	//password set方法
            
    	@Override
    	public boolean isAccountNonExpired() { 
    		return true;
    	}
    
    	@Override
    	public boolean isAccountNonLocked() { 
    		return true;
    	}
    
    	@Override
    	public boolean isCredentialsNonExpired() { 
    		return true;
    	}
    
    	@Override
    	public boolean isEnabled() { 
    		return true;
    	}
    
    
    }

#### role类 ####

@Entity
    public class Role implements GrantedAuthority { 
    
    	@Id
    	@GeneratedValue(strategy = GenerationType.IDENTITY)
    	private Long id;
    
    	@Column(nullable = false)
    	private String name;
    
    	@Override
    	public String getAuthority() { 
    		return name;
    	}
    
    	@Override
    	public String toString() { 
    		return name;
    	}
    }

#### userService ####

@Service
    public class UserService implements UserDetailsService { 
    
        @Autowired
        private UserDao userRepository;
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { 
            return userRepository.findByUsername(username);
        }
    }
    
    
    public interface UserDao extends JpaRepository<User, Long>{ 
    
    	User findByUsername(String username);
    }

#### securityConfig配置增加 ####

@Autowired
    	UserDetailsService userDetailsService;
    
    	@Autowired
    	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
    
    		auth.userDetailsService(userDetailsService).passwordEncoder(new MyPasswordEncoder());
    	}

#### 资源下 建立 scheme.sql ####

DROP TABLE IF EXISTS 'role'; //建立角色表
    CREATE TABLE 'role' (
      'id' bigint(20) NOT NULL AUTO_INCREMENT,
      'name' varchar(255) COLLATE utf8_bin NOT NULL,
      PRIMARY KEY ('id')
    ) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8 COLLATE=utf8_bin;
    
    DROP TABLE IF EXISTS 'user'; //建立用户表
    CREATE TABLE 'user' (
      'id' bigint(20) NOT NULL AUTO_INCREMENT,
      'password' varchar(255) COLLATE utf8_bin DEFAULT NULL,
      'username' varchar(255) COLLATE utf8_bin NOT NULL,
      PRIMARY KEY ('id'),
      UNIQUE KEY 'UK_sb8bbouer5wak8vyiiy4pf2bx' ('username')
    ) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8 COLLATE=utf8_bin;
    
    DROP TABLE IF EXISTS 'user_role'; //建立用户角色表
    CREATE TABLE 'user_role' (
      'user_id' bigint(20) NOT NULL,
      'role_id' bigint(20) NOT NULL,
      KEY 'FKa68196081fvovjhkek5m97n3y' ('role_id'),
      KEY 'FK859n2jvi8ivhui0rl0esws6o' ('user_id'),
      CONSTRAINT 'FK859n2jvi8ivhui0rl0esws6o' FOREIGN KEY ('user_id') REFERENCES 'user' ('id'),
      CONSTRAINT 'FKa68196081fvovjhkek5m97n3y' FOREIGN KEY ('role_id') REFERENCES 'role' ('id')
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_bin; 
    
    
    //插入数据
    INSERT INTO user (id, username, password) VALUES (1, 'forezp', '123456');
    INSERT INTO user (id, username, password)  VALUES (2, 'admin', '123456');
    
    INSERT INTO role (id, name) VALUES (1, 'ROLE_USER');
    INSERT INTO role (id, name) VALUES (2, 'ROLE_ADMIN');
    
    //forezp 有 ROLE_USER角色
    INSERT INTO user_role (user_id, role_id) VALUES (1, 1);
    
    //admin 这两个角色都有
    INSERT INTO user_role (user_id, role_id) VALUES (2, 1);
    INSERT INTO user_role (user_id, role_id) VALUES (2, 2);