Springsecurity搭建自定義登陸頁面

時間 2019-12-16

標籤 springsecurity 搭建自定義登陸頁面欄目 Spring 简体版

原文原文鏈接

1.springSecurity的搭建

新建一個springboot的web項目,我這邊只選中了web,創建後以下:html

pom依賴:java

<!-- https://mvnrepository.com/artifact/org.apache.tomcat.embed/tomcat-embed-jasper -->
        <!--配置支持jsp-->
        <dependency>
            <groupId>org.apache.tomcat.embed</groupId>
            <artifactId>tomcat-embed-jasper</artifactId>
            <version>8.5.12</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/javax.servlet/javax.servlet-api -->
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>javax.servlet-api</artifactId>
            <version>3.1.0</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/javax.servlet/jstl -->
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>jstl</artifactId>
            <version>1.2</version>
        </dependency>

        <!--添加static和templates的依賴-->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>

        <dependency>
            <!-- 因爲我使用的spring boot因此我是引入spring-boot-starter-security並且我使用了spring io因此不須要填寫依賴的版本號 -->
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

複製代碼

以上的jsp依賴若是用不上能夠不加哦web

2.編寫SecurityConfiguration來繼承WebSecurityConfigurerAdapter

WebSecurityConfigurerAdapter是security中瀏覽器登陸設置的主類這裏咱們繼承後重寫如下的三個方法:spring

HttpSecurity（HTTP請求安全處理）
AuthenticationManagerBuilder（身份驗證管理生成器）
WebSecurity（WEB安全）

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        super.configure(auth);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/hello","/login.html").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                //指定登陸頁的路徑
                .loginPage("/hello")
            	//指定自定義form表單請求的路徑
                .loginProcessingUrl("/authentication/form")
                .failureUrl("/login?error")
                .defaultSuccessUrl("/success")
                //必須容許全部用戶訪問咱們的登陸頁（例如未驗證的用戶，不然驗證流程就會進入死循環）
                //這個formLogin().permitAll()方法容許全部用戶基於表單登陸訪問/login這個page。
                .permitAll();
        		//默認都會產生一個hiden標籤 裏面有安全相關的驗證 防止請求僞造 這邊咱們暫時不須要 可禁用掉
        		http .csrf().disable();

    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        super.configure(web);
    }

}

複製代碼

這邊咱們指定的登陸頁的訪問方法爲/Hello的方法,這邊咱們來編寫這個Controller層:apache

@Controller
public class LoginController {

    @RequestMapping("/hello")
    public String hello() {
        //這邊咱們,默認是返到templates下的login.html
        return "login";
    }
}

複製代碼

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.w3.org/1999/xhtml">
<head>
    <meta charset="UTF-8">
    <title>第一個HTML頁面</title>
</head>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
自定義表單驗證:
<!--<form name="f" action="/login" method="post">-->
    <form name="f" action="/authentication/form" method="post">
<br/>
用戶名:
<input type="text" name="username" placeholder="name"><br/>
密碼:
<input type="password" name="password" placeholder="password"><br/>
<input name="submit" type="submit" value="提交">
</form>
</body>
</html>
複製代碼

這裏值的注意的是表單的用戶名name和password輸入框的name=""要和security裏面的驗證的對應:瀏覽器

name="username";name="password",不然沒法識別,另外action="/authentication/form"要與.loginProcessingUrl("/authentication/form")相對應,緣由爲:tomcat

因爲security是由UsernamePasswordAuthenticationFilter這個類定義登陸的,裏面默認是/login路徑,咱們要讓他用咱們的/authentication/form路徑,就須要配置.loginProcessingUrl("/authentication/form")安全