Spring Security 应用详解

一、 集成SpringBoot

1.1  Spring Boot 介绍

1.2 创建maven工程

1）创建maven工程 security-spring-boot，工程结构如下：

2）引入以下依赖：

<?xml version="1.0" encoding="UTF‐8"?> 
<project xmlns="http://maven.apache.org/POM/4.0.0" 
         xmlns:xsi="http://www.w3.org/2001/XMLSchema‐instance" 
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven‐4.0.0.xsd"> 
    <modelVersion>4.0.0</modelVersion> 
 
    <groupId>com.itheima.security</groupId> 
    <artifactId>security‐springboot</artifactId> 
    <version>1.0‐SNAPSHOT</version> 
 
    <parent> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring‐boot‐starter‐parent</artifactId> 
        <version>2.1.3.RELEASE</version> 
    </parent> 
 
    <properties> 
        <project.build.sourceEncoding>UTF‐8</project.build.sourceEncoding>         <maven.compiler.source>1.8</maven.compiler.source> 
        <maven.compiler.target>1.8</maven.compiler.target> 
    </properties> 
    <dependencies> 
        <!‐‐ 以下是>spring boot依赖‐‐> 
        <dependency> 
            <groupId>org.springframework.boot</groupId> 
            <artifactId>spring‐boot‐starter‐web</artifactId> 
        </dependency> 
 
        <!‐‐ 以下是>spring security依赖‐‐> 
        <dependency> 
            <groupId>org.springframework.boot</groupId> 
            <artifactId>spring‐boot‐starter‐security</artifactId> 
        </dependency> 
 
 
        <!‐‐ 以下是jsp依赖‐‐> 
        <dependency> 
            <groupId>javax.servlet</groupId> 
            <artifactId>javax.servlet‐api</artifactId> 
            <scope>provided</scope> 
        </dependency> 
        <!‐‐jsp页面使用jstl标签 ‐‐> 
        <dependency> 
            <groupId>javax.servlet</groupId> 
            <artifactId>jstl</artifactId> 
        </dependency> 
 
        <dependency> 
            <groupId>org.springframework.boot</groupId> 
            <artifactId>spring‐boot‐starter‐tomcat</artifactId> 
            <scope>provided</scope> 
        </dependency> 
        <!‐‐用于编译jsp ‐‐> 
        <dependency> 
            <groupId>org.apache.tomcat.embed</groupId> 
            <artifactId>tomcat‐embed‐jasper</artifactId> 
            <scope>provided</scope> 
        </dependency> 
         <dependency> 
            <groupId>org.projectlombok</groupId> 
            <artifactId>lombok</artifactId> 
            <version>1.18.0</version> 
          </dependency> 
    </dependencies> 
    <build> 
        <finalName>security‐springboot</finalName> 
        <pluginManagement> 
            <plugins> 
                <plugin> 
                    <groupId>org.apache.tomcat.maven</groupId> 
                    <artifactId>tomcat7‐maven‐plugin</artifactId> 
                    <version>2.2</version> 
                </plugin> 
                <plugin> 
                    <groupId>org.apache.maven.plugins</groupId> 
                    <artifactId>maven‐compiler‐plugin</artifactId> 
                    <configuration> 
                        <source>1.8</source> 
                        <target>1.8</target> 
                    </configuration> 
                </plugin> 
 
                <plugin> 
                    <artifactId>maven‐resources‐plugin</artifactId> 
                    <configuration> 
                        <encoding>utf‐8</encoding> 
                        <useDefaultDelimiters>true</useDefaultDelimiters>                         <resources> 
                            <resource> 
                                <directory>src/main/resources</directory>                                 <filtering>true</filtering> 
                                <includes> 
                                    <include>**/*</include> 
                                </includes> 
                            </resource> 
                            <resource> 
                                <directory>src/main/java</directory> 
                                <includes> 
                                    <include>**/*.xml</include> 
                                </includes> 
                            </resource> 
                        </resources> 
                    </configuration> 
                </plugin> 
            </plugins> 
        </pluginManagement> 
    </build> 
 
</project> 
 

1.3spring容器配置

SpringBoot工程启动会自动扫描启动类所在包下的所有Bean，加载到spring容器

在resources下添加application.properties，内容如下：

server.port=8080
server.servlet.context‐path=/security‐springboot
spring.application.name = security‐springboot

2）Spring Boot 启动类

 @SpringBootApplication
public class SecuritySpringBootApp {
    public static void main(String[] args) {
        SpringApplication.run(SecuritySpringBootApp.class, args);    }
 
}

1.4ServletContext配置

由于Springbootstarter自动装配机制，这里无需使用@EnableWebMvc与@ComponentScan，WebConfig如下

 @Configuration
public class WebConfig implements WebMvcConfigurer {
 
    //默认Url根路径跳转到/login，此url为spring security提供
    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/").setViewName("redirect:/login");    }
}
 

视频解析器配置在application.properties中

spring.mvc.view.prefix=/WEB‐INF/views/ 
spring.mvc.view.suffix=.jsp 
 

1.5安全配置

由于Springbootstarter自动装配机制，这里无需使用@EnableWebSecurity，WebSecurityConfig内容如下

 @Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
   //内容跟Spring security入门程序一致
}

1.6测试

LoginController的内容同同Springsecurity入门程序。

 @RestController
public class LoginController {
  //内容略..跟Spring security入门程序保持一致}

二、工作原理

2.1 结构总览

2.2.认证流程

让我们仔细分析认证过程：

2.3AuthenticationProvider介绍

也就是说当web表单提交用户名密码时，Spring Security由DaoAuthenticationProvider处理。

2.4.UserDetailsService 介绍

2.5PasswordEncoder介绍

2.6授权流程

2.6.1授权流程