Spring Security 默认启动的功能--登录，CSRF

Spring Security (一)
官方文档看一下下
1.pom引入

		
			org.springframework.boot
			spring-boot-starter-security
		

2.添加配置文件

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Bean
	public UserDetailsService userDetailsService()  {
		InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
		manager.createUser(User.withUsername("user").password("password").roles("USER").build());
		return manager;
	}
}

3.访问之前写好的某一个接口，跳转到了如下页面

what？？这页面哪来的，默认配置厉害了
看看官方文档吧 ，这里有很多默认配置
There really isn’t much to this configuration, but it does a lot. You can find a summary of the features below:
（1） 默认每个url都要被校验
Require authentication to every URL in your application
（2） 默认的登录页面 如上图
Generate a login form for you
（3） 可以用 user/password 登录
Allow the user with the Username user and the Password password to authenticate with form based authentication
呵呵……并不能 报错 java.lang.IllegalArgumentException: There is no PasswordEncoder mapped for the id “null”

不用AuthenticationManagerBuilder和AuthenticationProviderBean 配置时可以用UserDetailsService
密码加下密就可以登录了。

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    @Bean
    public UserDetailsService userDetailsService()  {
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(User.withUsername("aaa")
                .password(new BCryptPasswordEncoder().encode("bbb"))
                .roles("USER").build());
        return manager;
    }
}

或者

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication()
                .passwordEncoder(new BCryptPasswordEncoder())
                .withUser("aaa")
                .password(new BCryptPasswordEncoder().encode("bbb"))
                .roles("USER");

    }

（4） 允许退出，怎么退？
Allow the user to logout
（5） 防止CSRF 跨站请求伪造 攻击
CSRF attack prevention
参考 https://blog.csdn.net/xiaoxinshuaiga/article/details/80766369
参考https://blog.csdn.net/u013185616/article/details/70446392
简单的说，攻击者在session还未失效的时候利用认证信息。
默认POST请求都被拦截，如果不用这个功能，可以在WebSecurityConfig中加如下配置

@Override
protected void configure(HttpSecurity http) throws Exception {
         http.csrf().disable();
}

如果用，就要在请求的header中加token
写个ajaxPOST请求，一顿操作猛如虎，发现静态文件找不到了，加如下。

@Configuration
public class WebMvcConfig extends WebMvcConfigurationSupport {
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/static/**").addResourceLocations("classpath:/static/");
    }
}

get请求不拦截

POST请求403

beforeSend中request.setRequestHeader(header, token);

亲爱的，你好！
POST请求

这样就好用了~ _csrf是默认的也可以自己定义

（6）防御会话伪造session攻击
Session Fixation protection
后面的改天再说
（7）
Security Header integration
HTTP Strict Transport Security for secure requests
X-Content-Type-Options integration
Cache Control (can be overridden later by your application to allow caching of your static resources)
X-XSS-Protection integration
X-Frame-Options integration to help prevent Clickjacking
（8）
Integrate with the following Servlet API methods
HttpServletRequest#getRemoteUser()
HttpServletRequest.html#getUserPrincipal()
HttpServletRequest.html#isUserInRole(java.lang.String)
HttpServletRequest.html#login(java.lang.String, java.lang.String)
HttpServletRequest.html#logout()