SpringSecurity自定义请求参数名、自定义登录处理器

用户名和密码请求参数名自定义

在进行登录验证时，SpringSecurity会执行UsernamePasswordAuthenticationFilter过滤器，查看源码可知参数名有默认值，且只接收post请求

修改配置类即可完成对默认值的修改

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter{
	@Bean
	public PasswordEncoder getPasswordEncoder(){
		return new BCryptPasswordEncoder();
	}
	
	@Override
	protected void configure(HttpSecurity http) throws Exception{
		http.authorizeRequests()
		.antMatchers("/login.html").permitAll()
		.anyRequest().authenticated();
		
		http.formLogin()
		.loginPage("/login.html")
		.usernameParameter("name")	//自定义用户名请求参数名
		.passwordParameter("pwd")	//自定义密码请求参数名
		.loginProcessingUrl("/login")
		.successForwordUrl("/main")
		.failureForwordUrl("/error");
	}
}

自定义登录成功/失败处理器

在使用successForwordUrl()或failureForwordUrl()使登录成功或失败转发请求到对应地址时，内部调用的是successHandler()或failureHandler()方法，而successHandler()或failureHandler()调用的又是ForwardAuthenticationSuccessHandler类的onAuthenticationSuccess()或ForwardAuthenticationFailureHandler类的onAuthenticationFailure()执行请求转发




由于是请求转发，当遇到需要跳转到站外或在前后端分离的项目中就无法使用了，这时候需要自定义处理器来实现重定向跳转

1. 编写控制器类实现AuthenticationSuccess/FailureHandler接口

   public class ConstomAuthenticationSuccessHandler implements AuthenticationSuccessHandler{
   	@Override
   	public void onAuthenticationSuccess(HttpServletRequest request,HttpServletResponse response,Authentication authentication) throws IOEeception,ServletException{
   		//authentication的Principal中存储了User信息
   		User user=(User)authentication.getPrincipal();
   		user.getUsername();
   		user.getPassword();		//输出为null
   		user.getAuthorities();
   		//响应重定向到百度
   		response.sendRedirect("http://www.baidu.com");
   	}
   }
   

   public class ConstomAuthenticationFailureHandler implements AuthenticationFailureHandler{
   	@Override
   	public void onAuthenticationFailure(HttpServletRequest request,HttpServletResponse response,Authentication authentication) throws IOEeception,ServletException{
   		//authentication的Principal中存储了User信息
   		User user=(User)authentication.getPrincipal();
   		user.getUsername();
   		user.getPassword();		//输出为null
   		user.getAuthorities();
   		//响应重定向到百度
   		response.sendRedirect("http://www.baidu.com");
   	}
   }
   

2. 修改配置类

   @Configuration
   public class SecurityConfig extends WebSecurityConfigurerAdapter{
   	@Bean
   	public PasswordEncoder getPasswordEncoder(){
   		return new BCryptPasswordEncoder();
   	}
   	
   	@Override
   	protected void configure(HttpSecurity http) throws Exception{
   		http.authorizeRequests()
   		.antMatchers("/login.html").permitAll()
   		.anyRequest().authenticated();
   		
   		http.formLogin()
   		.loginPage("/login.html")
   		//.loginProcessingUrl("/login")
   		.successHandler(new ConstomAuthenticationSuccessHandler())
   		//.successForwordUrl("/main")
   		.failureHandler(new ConstomAuthenticationFailureHandler())
   		.failureForwordUrl("/error");
   	}
   }