快捷導(dǎo)航

詳解springboot?springsecuroty中的注銷和權(quán)限控制問題

更新時間：2022年03月08日 11:46:02 作者：從0開始丿

這篇文章主要介紹了springboot-springsecuroty?注銷和權(quán)限控制,賬戶注銷需要在SecurityConfig中加入開啟注銷功能的代碼，權(quán)限控制要導(dǎo)入springsecurity和thymeleaf的整合依賴，本文通過實(shí)例代碼給大家介紹的非常詳細(xì)，需要的朋友參考下吧

1 賬戶注銷

1.1 在SecurityConfig中加入開啟注銷功能的代碼

src/main/java/com/lv/config/SecurityConfig.java

package com.lv.config;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
//AOP : 攔截器!
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    //授權(quán)
    @Override
    public void configure(HttpSecurity http) throws Exception {
        //首頁所有人都可以訪問,功能頁只有對應(yīng)的有權(quán)限的人才能訪問
        //請求授權(quán)的規(guī)則~(鏈?zhǔn)骄幊?
        http.authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/level1/**").hasRole("vip1")
                .antMatchers("/level2/**").hasRole("vip2")
                .antMatchers("/level3/**").hasRole("vip3");
        //沒有權(quán)限默認(rèn)會跳轉(zhuǎn)到登錄頁,需要開啟登錄頁面
        http.formLogin();
        //注銷,開啟了注銷功能,跳到首頁
        http.logout().logoutSuccessUrl("/");
        //防止跨站工具, get,post
        http.csrf().disable();//關(guān)閉csrf功能,注銷失敗可能的原因
    }
    //認(rèn)證,springboot 2.1.x 可以直接使用
    //密碼編碼:PasswordEncoder
    //在Spring Security 5.0+ 新增了很多加密方法~
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //這些數(shù)據(jù)正常應(yīng)該從數(shù)據(jù)庫中讀
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                .withUser("lv").password(new BCryptPasswordEncoder().encode("123456")).roles("vip2","vip3")
                .and()
                .withUser("root").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2","vip3")
                .withUser("guest").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1");
}

1.2 在index.html 添加注銷的按鈕

src/main/resources/templates/index.html

<!--登錄注銷-->
<div class="right menu">
    <div>
        <a class="item" th:href="@{/toLogin}">
            <i class="address card icon"></i>登錄
        </a>
    </div>
    <div>
        <a class="item" th:href="@{/logout}">
            <i class="sign-out icon"></i>注銷
        </a>
    </div>
</div>

1.3 啟動項目測試

訪問登錄頁面,登錄 guest 賬戶,該賬戶可以訪問 level1的頁面

登錄成功后,點(diǎn)擊 level1的鏈接,成功跳轉(zhuǎn)到 level 頁面,然后點(diǎn)擊注銷按鈕

彈回到首頁,再次點(diǎn)擊點(diǎn)擊 level1 頁面

跳轉(zhuǎn)到了登錄頁面

說明賬戶注銷成功

2 權(quán)限控制

2.1 導(dǎo)入springsecurity和thymeleaf的整合依賴

pom.xml

<!-- springSecurity和thymeleaf整合包 -->
<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity4</artifactId>
    <version>3.0.2.RELEASE</version>
</dependency>

2.2 springboot版本降級

pom.xml

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.0.9.RELEASE</version>
    <relativePath/> <!-- lookup parent from repository -->
</parent>

必須將springboot的版本降到2.0.9以下,否則 sec:authorize="isAuthenticated()" 不會生效.版本降低后,需要手動導(dǎo)入junit依賴,否則測試類會報錯

<dependency>
    <groupId>org.junit.jupiter</groupId>
    <artifactId>junit-jupiter</artifactId>
    <version>RELEASE</version>
    <scope>test</scope>
</dependency>

2.3 引入約束

在index.html的頭文件中添加springsecurity和thymeleaf的整合約束

src/main/resources/templates/index.html

<html xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">

2.4 修改頁面代碼

主要修改兩部分,一部分是登錄狀態(tài)下顯示用戶名,和注銷按鈕,未登錄顯示登錄按鈕通過 sec:authorize="isAuthenticated()" 實(shí)現(xiàn).另一部分是根據(jù)登錄用戶的權(quán)限顯示不同的頁面菜單,通過 sec:authorize="hasRole('vip1')" 實(shí)現(xiàn).

src/main/resources/templates/index.html

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
    <title>首頁</title>
    <!--semantic-ui-->
    <link  rel="stylesheet">
    <link th:href="@{/qinjiang/css/qinstyle.css}" rel="stylesheet">
</head>
<body>

<!--主容器-->
<div class="ui container">
    <div class="ui segment" id="index-header-nav" th:fragment="nav-menu">
        <div class="ui secondary menu">
            <a class="item"  th:href="@{/index}">首頁</a>
            <!--登錄注銷-->
            <div class="right menu">
                <!--如果未登錄:顯示登錄按鈕-->
                <div sec:authorize="!isAuthenticated()">
                    <a class="item" th:href="@{/toLogin}">
                        <i class="address card icon"></i>登錄
                    </a>
                </div>
                <!--如果已登錄:顯示用戶名和注銷按鈕-->
                <div sec:authorize="isAuthenticated()">
                    <a class="item">
                        用戶名:<span sec:authentication="name"></span>
                    </a>
                </div>
                <div sec:authorize="isAuthenticated()">
                    <a class="item" th:href="@{/logout}">
                        <i class="sign-out icon"></i>注銷
                    </a>
                </div>
            </div>
        </div>
    </div>
    <div class="ui segment" style="text-align: center">
        <h3>Spring Security Study by 秦疆</h3>
    </div>
    <div>
        <br>
        <div class="ui three column stackable grid">
            <!--菜單根據(jù)用戶的角色動態(tài)實(shí)現(xiàn)-->
            <div class="column" sec:authorize="hasRole('vip1')">
                <div class="ui raised segment">
                    <div class="ui">
                        <div class="content">
                            <h5 class="content">Level 1</h5>
                            <hr>
                            <div><a th:href="@{/level1/1}"><i class="bullhorn icon"></i> Level-1-1</a></div>
                            <div><a th:href="@{/level1/2}"><i class="bullhorn icon"></i> Level-1-2</a></div>
                            <div><a th:href="@{/level1/3}"><i class="bullhorn icon"></i> Level-1-3</a></div>
                        </div>
                    </div>
                </div>
            </div>
            <div class="column" sec:authorize="hasRole('vip2')">
                <div class="ui raised segment">
                    <div class="ui">
                        <div class="content">
                            <h5 class="content">Level 2</h5>
                            <hr>
                            <div><a th:href="@{/level2/1}"><i class="bullhorn icon"></i> Level-2-1</a></div>
                            <div><a th:href="@{/level2/2}"><i class="bullhorn icon"></i> Level-2-2</a></div>
                            <div><a th:href="@{/level2/3}"><i class="bullhorn icon"></i> Level-2-3</a></div>
                        </div>
                    </div>
                </div>
            </div>
            <div class="column" sec:authorize="hasRole('vip3')">
                <div class="ui raised segment">
                    <div class="ui">
                        <div class="content">
                            <h5 class="content">Level 3</h5>
                            <hr>
                            <div><a th:href="@{/level3/1}"><i class="bullhorn icon"></i> Level-3-1</a></div>
                            <div><a th:href="@{/level3/2}"><i class="bullhorn icon"></i> Level-3-2</a></div>
                            <div><a th:href="@{/level3/3}"><i class="bullhorn icon"></i> Level-3-3</a></div>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>
<script th:src="@{/qinjiang/js/jquery-3.1.1.min.js}"></script>
<script th:src="@{/qinjiang/js/semantic.min.js}"></script>
</body>
</html>

2.5 重啟程序測試

未登錄頁面

登錄 lv 用戶的頁面

登錄 geust 用戶的頁面

登錄 root 用戶的頁面

頁面顯示都不同,權(quán)限控制成功實(shí)現(xiàn)

到此這篇關(guān)于springboot-springsecuroty 注銷和權(quán)限控制的文章就介紹到這了,更多相關(guān)springboot注銷和權(quán)限控制內(nèi)容請搜索腳本之家以前的文章或繼續(xù)瀏覽下面的相關(guān)文章希望大家以后多多支持腳本之家！

您可能感興趣的文章: