spring security入门小demo

1.Spring Security简介

Spring Security是一个能够为基于Spring的企业应用系统提供声明式的安全访问控制解决方案的安全框架。它提供了一组可以在Spring应用上下文中配置的Bean，充分利用了Spring IoC，DI（控制反转Inversion of Control ,DI:Dependency Injection 依赖注入）和AOP（面向切面编程）功能，为应用系统提供声明式的安全访问控制功能，减少了为企业系统安全控制编写大量重复代码的工作。

2.目标

• 创建一个java的maven工程的ssm框架web项目
• 测试登录正确时跳转到主页
• 测试登录用户名密码不正确时跳转到错误页面
• 目录结构
  

步骤

第一步 依赖pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0modelVersion>
    <groupId>cn.itcast.demogroupId>
    <artifactId>spring-security-demoartifactId>
    <packaging>warpackaging>
    <version>0.0.1-SNAPSHOTversion>
    <properties>
        <spring.version>4.2.4.RELEASEspring.version>
    properties>

    <dependencies>

        <dependency>
            <groupId>org.springframeworkgroupId>
            <artifactId>spring-coreartifactId>
            <version>${spring.version}version>
        dependency>
        <dependency>
            <groupId>org.springframeworkgroupId>
            <artifactId>spring-webartifactId>
            <version>${spring.version}version>
        dependency>

        <dependency>
            <groupId>org.springframeworkgroupId>
            <artifactId>spring-webmvcartifactId>
            <version>${spring.version}version>
        dependency>

        <dependency>
            <groupId>org.springframeworkgroupId>
            <artifactId>spring-context-supportartifactId>
            <version>${spring.version}version>
        dependency>

        <dependency>
            <groupId>org.springframeworkgroupId>
            <artifactId>spring-testartifactId>
            <version>${spring.version}version>
        dependency>

        <dependency>
            <groupId>org.springframeworkgroupId>
            <artifactId>spring-jdbcartifactId>
            <version>${spring.version}version>
        dependency>

        <dependency>
            <groupId>org.springframework.securitygroupId>
            <artifactId>spring-security-webartifactId>
            <version>4.1.0.RELEASEversion>
        dependency>

        <dependency>
            <groupId>org.springframework.securitygroupId>
            <artifactId>spring-security-configartifactId>
            <version>4.1.0.RELEASEversion>
        dependency>

        <dependency>
            <groupId>javax.servletgroupId>
            <artifactId>servlet-apiartifactId>
            <version>2.5version>
            <scope>providedscope>
        dependency>


    dependencies>
    <build>
        <plugins>
            
            <plugin>
                <groupId>org.apache.maven.pluginsgroupId>
                <artifactId>maven-compiler-pluginartifactId>
                <version>3.2version>
                <configuration>
                    <source>1.8source>
                    <target>1.8target>
                    <encoding>UTF-8encoding>
                configuration>
            plugin>
            <plugin>
                <groupId>org.apache.tomcat.mavengroupId>
                <artifactId>tomcat7-maven-pluginartifactId>
                <configuration>
                    
                    <port>9090port>
                    
                    <path>/path>
                configuration>
            plugin>
        plugins>
    build>
project>

第二步 web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns="http://java.sun.com/xml/ns/javaee"
	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
	version="2.5">	

  	 <context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>classpath:spring-security.xml</param-value>
	 </context-param>
	 <listener>
		<listener-class>
			org.springframework.web.context.ContextLoaderListener
		</listener-class>
	 </listener>
	
	 <filter>  
		<filter-name>springSecurityFilterChain</filter-name>  
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>  
	 </filter>  
	 <filter-mapping>  
		<filter-name>springSecurityFilterChain</filter-name>  
		<url-pattern>/*  
	 
	

第三步 配置文件

<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
	





	<http pattern="/login.html" security="none"/>
	<http pattern="/login_error.html" security="none"/>
	
	<http use-expressions="false">
		
		<intercept-url pattern="/**"  access="ROLE_USER" />
		
		
		<form-login login-page="/login.html" default-target-url="/index.html"
					authentication-failure-url="/login_error.html"  />
		 
		<csrf disabled="true" />
	http>

	
    <authentication-manager>
		<authentication-provider>
			<user-service>
				<user name="admin"  password="123456" authorities="ROLE_USER" />
			user-service>
		authentication-provider>
	authentication-manager>

beans:beans>

第四步 书写 登录页，主页，错误页

login.html

<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>登陆title>
head>
<body>
<form action="/login" method="post">
    用户名: <input type="text" name="username"> <br>
    密码: <input type="text" name="password"> <br>
    <button>登陆button>
form>
body>
html>

login_error.html

<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>错误提示页title>
head>
<body>
   用户名或密码错误
body>
html>

index.html

<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>首页title>
head>
<body>
 欢迎进入神奇的spring security 世界~~~~
body>
html>

3.测试

4.git地址

https://github.com/hufanglei/pinyou/tree/sprinig-security-demo

---

完