⒈添加starter依赖
1 1 <dependency> 2 2 <groupId>org.springframework.boot</groupId> 3 3 <artifactId>spring-boot-starter-web</artifactId> 4 4 </dependency> 5 5 6 6 <dependency> 7 7 <groupId>org.springframework.boot</groupId> 8 8 <artifactId>spring-boot-starter-security</artifactId> 9 9 </dependency> 1010 1111 <dependency> 1212 <groupId>org.springframework.boot</groupId> 1313 <artifactId>spring-boot-starter-thymeleaf</artifactId> 1414 </dependency> 1515 1616 <!--添加Thymeleaf Spring Security依赖--> 1717 <dependency> 1818 <groupId>org.thymeleaf.extras</groupId> 1919 <artifactId>thymeleaf-extras-springsecurity4</artifactId> 2020 <version>3.0.4.RELEASE</version> 2121 </dependency>
⒉使用配置类定义授权与定义规则
1 1 package cn.coreqi.config; 2 2 3 3 import org.springframework.context.annotation.Configuration; 4 4 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; 5 5 import org.springframework.security.config.annotation.web.builders.HttpSecurity; 6 6 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; 7 7 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; 8 8 9 9 //@Configuration 1010 @EnableWebSecurity 1111 public class SecurityConfig extends WebSecurityConfigurerAdapter { 1212 1313 //定义授权规则 1414 @Override 1515 protected void configure(HttpSecurity http) throws Exception { 1616 //定制请求授权规则 1717 http.authorizeRequests() 1818 .antMatchers("/css/**","/js/**","/fonts/**","index").permitAll() //不拦截，直接访问 1919 .antMatchers("/vip1/**").hasRole("VIP1") 2020 .antMatchers("/vip2/**").hasRole("VIP2") 2121 .antMatchers("/vip3/**").hasRole("VIP3"); 2222 //开启登陆功能（自动配置） 2323 //如果没有登陆就会来到/login（自动生成）登陆页面 2424 //如果登陆失败就会重定向到/login?error 2525 //默认post形式的/login代表处理登陆 2626 http.formLogin().loginPage("/userLogin").failureUrl("/login-error"); 2727 //开启自动配置的注销功能 2828 //访问/logout表示用户注销，清空session 2929 //注销成功会返回/login?logout页面 3030 //logoutSuccessUrl()设置注销成功后跳转的页面地址 3131 http.logout().logoutSuccessUrl("/"); 3232 //开启记住我功能 3333 //登陆成功以后，将cookie发给浏览器保存，以后访问页面带上这个cookie，只要通过检查就可以免登陆 3434 //点击注销会删除cookie 3535 http.rememberMe(); 3636 } 3737 3838 //定义认证规则 3939 @Override 4040 protected void configure(AuthenticationManagerBuilder auth) throws Exception { 4141 //jdbcAuthentication() 在JDBC中查找用户 4242 //inMemoryAuthentication() 在内存中查找用户 4343 4444 auth.inMemoryAuthentication().withUser("fanqi").password("admin").roles("VIP1","VIP2","VIP3") 4545 .and() 4646 .withUser("zhangsan").password("123456").roles("VIP1"); 4747 } 4848 }
⒊编写控制器类（略）
⒋编写相关页面
1 1 <!DOCTYPE html> 2 2 <html lang="en" 3 3 xmlns:th="http://www.thymeleaf.org" 4 4 xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" 5 5 xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4"> 6 6 <head> 7 7 <meta charset="UTF-8"> 8 8 <title>登录页面</title> 9 9 </head> 1010 <body> 1111 <div sec:authorize="isAuthenticated()"> 1212 <p>用户已登录</p> 1313 <p>登录的用户名为：<span sec:authentication="name"></span></p> 1414 <p>用户角色为：<span sec:authentication="principal.authorities"></span></p> 1515 </div> 1616 <div sec:authorize="isAnonymous()"> 1717 <p>用户未登录</p> 1818 </div> 1919 </body> 2020 </html>