SpringSecurity拦截请求和登录实例

1. 配置pom.xml

    4.0.0
    
        org.springframework.boot
        spring-boot-starter-parent
        2.1.6.RELEASE
         
    
    com.chenbin
    securitydemo
    0.0.1-SNAPSHOT
    war
    securitydemo
    Demo project for Spring Boot

    
        1.8
    

    
        
            org.springframework.boot
            spring-boot-starter-security
        
        
            org.springframework.boot
            spring-boot-starter-web
        
    

    
        
            
                org.springframework.boot
                spring-boot-maven-plugin
            
        
    

2. 新建SpringSecurityConfig类
（1）public void configure(WebSecurity web) throws Exception【该方法配置哪些路径可以被访问】，如下：

@Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/js/**","/css/**","/images/**");
    }

（2）protected void configure(HttpSecurity http)【该方法配置Http请求规则】，如下：

@Override
    protected void configure(HttpSecurity http) throws Exception {
        //http请求验证匹配规则（antMatchers）都通过(permitAll)，
        // 其它(anyRequest)都验证(authenticated)，and登出(logout)允许(permitAll)，and表单登录。
        http.authorizeRequests()
                .antMatchers("/").permitAll()
                .anyRequest().authenticated()
                .and()
                .logout().permitAll()
                .and()
                .formLogin();
        http.csrf().disable();
    }

（3）protected void configure(AuthenticationManagerBuilder auth)【该方法指定一个账号，赋予一个角色，该账号可以登录通过】（较简单的登录）：

@Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("admin").password(new BCryptPasswordEncoder().encode("123456")).roles("ADMIN");
    }

完整代码：

package com.chenbin.securitydemo;


import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@Configuration
@EnableWebSecurity
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder()).withUser("admin").password(new BCryptPasswordEncoder().encode("123456")).roles("ADMIN");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //http请求验证匹配规则（antMatchers）都通过(permitAll)，
        // 其它(anyRequest)都验证(authenticated)，and登出(logout)允许(permitAll)，and表单登录。
        http.authorizeRequests()
                .antMatchers("/").permitAll()
                .anyRequest().authenticated()
                .and()
                .logout().permitAll()
                .and()
                .formLogin();
        http.csrf().disable();
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/js/**","/css/**","/images/**");
    }
}

4. 在Application主类中添加Controller,包含"/“和”/hello"路径，以此判断SpringSecurity是否生效。

package com.chenbin.securitydemo;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.List;

@SpringBootApplication
@RestController
@MapperScan( basePackages = {"com.chenbin.securitydemo.mappertest"})
public class SecuritydemoApplication {
    public static void main(String[] args) {
        SpringApplication.run(SecuritydemoApplication.class, args);
    }


    @RequestMapping("/")
    public String index(){
        return "hello spring boot";
    }


    @RequestMapping("/hello")
    public String hello(){
        return "hello页面，已登录！";
    }
}

5. 访问http://localhost:8080可以成功，访问http://localhost:8080/hello需要登录，输入admin,123456可以登录成功，证明配置正确，代码无误。