SpringSecurity系列——简单配置上手day4-3（源于官网5.7.2版本）

前言

本片开启SpringSecurity入门上手实例，基于官方5.7.2的最新稳定版，springboot2.7.2版，jdk17，我对官方实例进行了一定程度上的修改，增加了其他一些实例代码

注意点

目前官方已决定淘汰使用SpringSecurityConfigurationAdapter

简单配置上手

默认SpringSecurity

1.新建项目

2.添加依赖

3.编写controller

package com.example.login.controller;

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class LoginController {
    @GetMapping("/index")
    public String login(){
        return "login....";
    }

    @GetMapping("/test")
    public String test(){
        return "test...";
    }
}

4.启动测试

当我们访问任意地址时就会跳转至http://localhost:8080/login 输入用户名：user 密码：如下图所示 进行登录 访问成功

---

拦截所有资源

效果上同第一个默认的

1.添加SpringSecurityConfig

package com.example.login.config;

public class SpringSecurityConfig {}

2.添加注解@EnableWebSecurity

package com.example.login.config;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

@EnableWebSecurity
public class SpringSecurityConfig {}

3.注入自定义安全过滤器链

package com.example.login.config;


import org.springframework.context.annotation.Bean;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;


@EnableWebSecurity
public class SpringSecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
        //确保对我们应用程序的任何请求都需要对用户进行身份验证
        httpSecurity.authorizeRequests(authorize ->
                    authorize.anyRequest().authenticated()//拦截全部
        )
                //允许用户使用基于表单的登录进行身份验证
                .formLogin(Customizer.withDefaults())
                //允许用户使用 HTTP Basic 身份验证进行身份验证
                .httpBasic(Customizer.withDefaults());

        return httpSecurity.build();
    }
}

4.启动测试

启动测试效果同默认

放行所有资源

在放行所有资源中我们只需要把authorize.anyRequest().authenticated()改为authorize.anyRequest().permitAll()

package com.example.test1.config;

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@EnableWebSecurity
public class SpringSecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
        httpSecurity.authorizeRequests(authorize ->
                authorize.anyRequest().permitAll()
        )
                .formLogin(Customizer.withDefaults())
                .httpBasic(Customizer.withDefaults());
        return httpSecurity.build();

    }
}

此时我们访问任意资源就都会直接放行

放行单个/多个资源

单个资源的拦截需要用到authorize.mvcMatchers("/test").permitAll() 此时对/test资源进行放行，其他资源一律拦截 当然mvcMatchers()方法中使用的是不定长参数也就是说我们可以传多个也就是说你可以这样写：

 authorize.mvcMatchers("/test","/index").permitAll()

package com.example.test1.config;

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@EnableWebSecurity
public class SpringSecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
        httpSecurity.authorizeRequests(authorize ->
                authorize.mvcMatchers("/test").permitAll()
                .anyRequest().authenticated()
        )
                .formLogin(Customizer.withDefaults())
                .httpBasic(Customizer.withDefaults());
        return httpSecurity.build();

    }
}

拦截单个/多个资源

而拦截单个只是使用.authenticated() 方法 ，当然你也可以同上面放行多个一样拦截多个 如下

authorize.mvcMatchers("/test").authenticated()

package com.example.test1.config;

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@EnableWebSecurity
public class SpringSecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
        httpSecurity.authorizeRequests(authorize ->
                        authorize.mvcMatchers("/test").authenticated()
                                .anyRequest().permitAll()
        )
                .formLogin(Customizer.withDefaults())
                .httpBasic(Customizer.withDefaults());
        return httpSecurity.build();

    }
}