资源数据下载：

  • security
  • springbootdata
  • 前端文件

    使用Security依赖启动器自带登录业务

  1. 创建项目
  2. 引入Lombol、Spring Web、MySQL Driver、Thymeleaf
    1. image.png
  3. 自己配置好maven、lombok配置
  4. 引入第七章前端代码在resources的templates路径
    1. image.png
    2. index内代码查看 ```html

  5. <!DOCTYPE html>

    欢迎进入电影网站首页

    普通电影

    VIP专享

    ```

  6. 在项目创建controller包

    1. 包下创建FileController类,编写用于页面请求的控制类 ```java package com.example.demo.controller;

import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.PathVariable;

@Controller public class FileController { //影片详情页 @GetMapping(“/detail/{type}/{path}”) //请求映射地址为/detail/{type}/{path},{}是占位符，里面指向的是方法体内的参数type和path //定义参数type和path为接收参数，返回具体的路径。实现向影片详情页面请求跳转. public String toDetail(@PathVariable(“type”) String type, @PathVariable(“path”) String path) { return “detail/“+type+”/“+path; //从resource内的templates找到detail/{type}/{path},返回视图显示 } }

  2. 6. 引入security依赖入pom.xml（maven仓库）
  3. ```xml
  4. <dependency>
  5.   <groupId>org.springframework.boot</groupId>
  6.   <artifactId>spring-boot-starter-security</artifactId>
  7.   <version>2.6.7</version>
  8. </dependency>
  1. 重新启动
    1. image.png
    2. 浏览器查看
    3. image.png
    4. image.png
    5. 输入控制台显示的Spring Security提供的默认的账户密码，登录
    6. image.png
    7. 这种默认安全管理方式存在诸多问题，例如：只有唯一的默认登录用户user、密码随机生成且过于暴露、登录页面及错误提示页面不是我们想要的等。
  2. 我们可以通过自定义WebSecurityConfigurerAdapter类型的Bean组件来覆盖默认访问规则。搜索WebSecurityConfigurerAdapter，可知是抽象类。我们通过继承该类后，重写或重载其中的方法来实现自定义。
    1. 主要的两个配置方法
      1. configure(AuthenticationManagerBuilder auth)
        1. 定制用户认证管理器来实现用户认证
      2. configure(HttpSecurity http)
        1. 定制基于HTTP请求的用户访问控制

实现自定义用户认证

内存身份认证（无法用于实际生产，只可作为初学者测试）

  1. 创建config包
    1. 包下创建SecurityConfig类 ```java package com.example.demo.config;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

//开启MVC Security安全支持 @EnableWebSecurity
//继承抽象类WebSecurityConfigurerAdapter，通过重写其中方法实现自定义 public class SecurityConfig extends WebSecurityConfigurerAdapter{
@Override//@Override 注解用于指定方法必须重写，让编译器了解该方法必须重写，如果不重写就报错 protected void configure(AuthenticationManagerBuilder auth) throws Exception{ //密码设置需要设置编码器 BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(); //1.使用内存用户信息，作为测试使用 auth.inMemoryAuthentication().passwordEncoder(encoder) .withUser(“shitou”).password(encoder.encode(“123456”)).roles(“common”) .and() .withUser(“李四”).password(encoder.encode(“123456”)).roles(“vip”); } }

  2.       2. 重启运行
  3.          1. ![image.png](https://cdn.nlark.com/yuque/0/2022/png/22384052/1653013908659-0e457a1d-347e-47c6-8056-7ada0df1afc9.png#clientId=ue82bcf67-d977-4&crop=0&crop=0&crop=1&crop=1&from=paste&height=396&id=u14eda918&margin=%5Bobject%20Object%5D&name=image.png&originHeight=495&originWidth=1595&originalType=binary&ratio=1&rotation=0&showTitle=false&size=39892&status=done&style=none&taskId=ua1506837-16ae-44f9-acf8-36049e5a53a&title=&width=1276)
  4.          2. ![image.png](https://cdn.nlark.com/yuque/0/2022/png/22384052/1653013923133-51ea45d6-1870-402b-b711-e455f16bda1d.png#clientId=ue82bcf67-d977-4&crop=0&crop=0&crop=1&crop=1&from=paste&height=505&id=uf111cc30&margin=%5Bobject%20Object%5D&name=image.png&originHeight=631&originWidth=1249&originalType=binary&ratio=1&rotation=0&showTitle=false&size=36212&status=done&style=none&taskId=u266983ee-747b-4994-8aaf-d18c8ca8e09&title=&width=999.2)
  5.          3. 输入配置的自定义账户密码，可跳转到对应页面
  6.          4. ![image.png](https://cdn.nlark.com/yuque/0/2022/png/22384052/1653014187026-3f70b084-996f-4605-a309-4596dbaee4f2.png#clientId=ue8dbb611-3f54-4&crop=0&crop=0&crop=1&crop=1&from=paste&height=423&id=u031ccee6&margin=%5Bobject%20Object%5D&name=image.png&originHeight=529&originWidth=1715&originalType=binary&ratio=1&rotation=0&showTitle=false&size=52720&status=done&style=none&taskId=u999cd2eb-94ad-4ed2-a39f-77682adc9ad&title=&width=1372)
  7. 1. JDBC身份验证的实现
  8.    1. 本质：用数据库已有的用户信息在项目中实现用户认证服务，需要提前准备好相关数据
  9.    2. source代码引入数据库文件springboot.sql和security.sql
  10.    3. <br />
  11. ```sql
  12. set character set utf8;
  13. drop database if exists springbootdata;
  14. # 创建数据库
  15. CREATE DATABASE springbootdata default character set utf8;
  16. # 选择使用数据库
  17. USE springbootdata;
  18. # 创建表t_article并插入相关数据
  19. DROP TABLE IF EXISTS `t_article`;
  20. CREATE TABLE `t_article` (
  21.   `id` int(20) NOT NULL AUTO_INCREMENT COMMENT '文章id',
  22.   `title` varchar(200) DEFAULT NULL COMMENT '文章标题',
  23.   `content` longtext COMMENT '文章内容',
  24.   PRIMARY KEY (`id`)
  25. ) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8;
  26. set character set utf8;
  27. INSERT INTO `t_article` VALUES ('1', 'Spring Boot基础入门', '从入门到精通讲解...');
  28. INSERT INTO `t_article` VALUES ('2', 'Spring Cloud基础入门', '从入门到精通讲解...');
  29. # 创建表t_comment并插入相关数据
  30. DROP TABLE IF EXISTS `t_comment`;
  31. CREATE TABLE `t_comment` (
  32.   `id` int(20) NOT NULL AUTO_INCREMENT COMMENT '评论id',
  33.   `content` longtext COMMENT '评论内容',
  34.   `author` varchar(200) DEFAULT NULL COMMENT '评论作者',
  35.   `a_id` int(20) DEFAULT NULL COMMENT '关联的文章id',
  36.   `deleted` int(20) DEFAULT 0,
  37.   PRIMARY KEY (`id`)
  38. ) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8;
  39. set character set utf8;
  40. INSERT INTO `t_comment` VALUES ('1', '很全、很详细', '狂奔的蜗牛', '1', '0');
  41. INSERT INTO `t_comment` VALUES ('2', '赞一个', 'tom', '1', '0');
  42. INSERT INTO `t_comment` VALUES ('3', '很详细', 'kitty', '1', '0');
  43. INSERT INTO `t_comment` VALUES ('4', '很好，非常详细', '张三', '1', '0');
  44. INSERT INTO `t_comment` VALUES ('5', '很不错', '张杨', '2', '0');
  1. # 选择使用数据库
  2. USE springbootdata;
  3. # 创建表t_customer并插入相关数据
  4. DROP TABLE IF EXISTS `t_customer`;
  5. CREATE TABLE `t_customer` (
  6.   `id` int(20) NOT NULL AUTO_INCREMENT,
  7.   `username` varchar(200) DEFAULT NULL,
  8.   `password` varchar(200) DEFAULT NULL,
  9. # tinyint类型对应booolean类型
  10.   `valid` tinyint(1) NOT NULL DEFAULT '1',
  11.   PRIMARY KEY (`id`)
  12. ) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8;
  13. INSERT INTO `t_customer` VALUES ('1', 'shitou', '$2a$10$d8tE/Eqw4e6/ormxMKBtAOgDxt3XY1QsfukGq.OXeSL1XyqhcJAH6', '1');
  14. INSERT INTO `t_customer` VALUES ('2', '李四', '$2a$10$5ooQI8dir8jv0/gCa1Six.GpzAdIPf6pMqdminZ/3ijYzivCyPlfK', '1');
  15. # 创建表t_authority并插入相关数据
  16. DROP TABLE IF EXISTS `t_authority`;
  17. CREATE TABLE `t_authority` (
  18.   `id` int(20) NOT NULL AUTO_INCREMENT,
  19.   `authority` varchar(20) DEFAULT NULL,
  20.   PRIMARY KEY (`id`)
  21. ) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8;
  22. INSERT INTO `t_authority` VALUES ('1', 'ROLE_common');
  23. INSERT INTO `t_authority` VALUES ('2', 'ROLE_vip');
  24. # 创建表t_customer_authority并插入相关数据
  25. DROP TABLE IF EXISTS `t_customer_authority`;
  26. CREATE TABLE `t_customer_authority` (
  27.   `id` int(20) NOT NULL AUTO_INCREMENT,
  28.   `customer_id` int(20) DEFAULT NULL,
  29.   `authority_id` int(20) DEFAULT NULL,
  30.   PRIMARY KEY (`id`)
  31. ) ENGINE=InnoDB AUTO_INCREMENT=5 DEFAULT CHARSET=utf8;
  32. INSERT INTO `t_customer_authority` VALUES ('1', '1', '1');
  33. INSERT INTO `t_customer_authority` VALUES ('2', '2', '2');
  35. # 记住我功能中创建持久化Token存储的数据表
  36. create table persistent_logins (username varchar(64) not null,
  37.                                 series varchar(64) primary key,
  38.                                 token varchar(64) not null,
  39.                                 last_used timestamp not null);
  1. pom.xml添加JDBC连接数据库的依赖启动器 ```xml 
    1.  <dependency>
    2.      <groupId>org.springframework.boot</groupId>
    3.      <artifactId>spring-boot-starter-jdbc</artifactId>
    4.  </dependency>
    5.  <dependency>
    6.      <groupId>mysql</groupId>
    7.      <artifactId>mysql-connector-java</artifactId>
    8.      <scope>runtime</scope>
    9.  </dependency>
  2. 3. 配置数据库连接
  3. ```properties
  4. #数据库连接配置
  5. spring.datasource.url=jdbc:mysql://localhost:3306/springbootdata?serverTimezone=UTC
  6. spring.datasource.username=root
  7. spring.datasource.password=root
  1. 重新编写SecurityConfig ```properties package com.example.demo.config;

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

//开启MVC Security安全支持 @EnableWebSecurity
//继承抽象类WebSecurityConfigurerAdapter，通过重写其中方法实现自定义 public class SecurityConfig extends WebSecurityConfigurerAdapter{
//Autowired相当于new，来自于springboot本身，用于注入组件 @Autowired //装配了DataSource数据源作为属性 private DataSource dataSource; //@Override 注解用于指定方法必须重写，让编译器了解该方法必须重写，如果不重写就报错 @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception{

  1.     /* 1. 内存实现身份认证
  2.       //密码设置需要设置编码器
  4.     BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
  5.     //1.使用内存用户信息，作为测试使用。定义了一个common用户，一个vip用户，设定了默认账户密码
  6.     auth.inMemoryAuthentication().passwordEncoder(encoder)
  7.             .withUser("shitou").password(encoder.encode("123456")).roles("common")
  8.             .and()
  9.             .withUser("李四").password(encoder.encode("123456")).roles("vip");
  10. }    */
  12.     //2. JDBC进行身份验证
  13.     //密码设置需要设置编码器 
  14.     BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
  15.     //使用JDBC进行身份认证
  16.     //根据浏览器所输入的用户名寻找名字，密码权限
  17.     String userSQL = "select username,password,valid from t_customer "+
  18.                     "where username = ?";
  19. //SQL语句输错不报错，实际情况下不会直接敲SQL代码
  20.     String authoritySQL = "select c.username,a.authority from t_customer c,"+
  21.                             "t_authority a,t_customer_authority ca where "+
  22.                             "ca.customer_id=c.id and ca.authority_id=a.id and c.username =?";
  23.     //auth调用jdbc权限管理的方法.编码器.数据源.执行SQL语句
  24.     auth.jdbcAuthentication().passwordEncoder(encoder)
  25.                             .dataSource(dataSource)
  26.                             .usersByUsernameQuery(userSQL)
  27.                             .authoritiesByUsernameQuery(authoritySQL);
  28. }

}

  2. 5. 重启启动，输入数据库的用户密码。
  4. <a name="WVKed"></a>
  5. ## UserDetailsService身份验证
  7. 1. 创建相关实体类Customer和Authority——Entity或Domain层
  8. ```java
  9. package com.example.demo.entity;
  11. import javax.persistence.*;
  13. import lombok.Data;
  15. @Data    //Lombok注解，自动创建get、set、toString
  16. @Entity(name = "t_customer")    //需要引入jpa依赖包spring data jpa
  17. public class Customer {
  18.     @Id        //用于标注数据库主键为下方的id
  19.     @GeneratedValue(strategy = GenerationType.IDENTITY)        //设置表示主键是自增策略
  20.     private Integer id;
  21.     private String username;
  22.     private String password;
  23. }
  1. package com.example.demo.entity;
  3. import javax.persistence.*;
  5. import lombok.Data;
  7. @Data
  8. @Entity(name = "t_authority ")
  9. public class Authority {
  10.     @Id 
  11.     @GeneratedValue(strategy = GenerationType.IDENTITY)
  12.     private Integer id;
  13.     private String authority ;
  14. }
  1. 创建数据访问层Dao层（Repository层）的两个接口CustomerRepository和AuthorityRepository ```java package com.example.demo.repository;

import org.springframework.data.jpa.repository.JpaRepository;

import com.example.demo.entity.Customer;

public interface CustomerRepository extends JpaRepository { Customer findByUsername(String username); }

  1. ```java
  2. package com.example.demo.repository;
  4. import java.util.List;
  6. import org.springframework.data.jpa.repository.JpaRepository;
  7. import org.springframework.data.jpa.repository.Query;
  9. import com.example.demo.entity.Authority;
  11. public interface AuthorityRepository extends JpaRepository<Authority,Integer> {
  12.     @Query(value = "select a.* from t_customer c,t_authority a,"
  13.             + "t_customer_authority ca where ca.customer_id=c.id and ca.authority_id=a.id and c.username =?1",
  14.             nativeQuery = true)
  15.     public List<Authority> findAuthoritiesByUsername(String username);
  16. }

  1. 引入Redis依赖

    1. <!-- 引入Redis依赖spring-boot-starter-data-redis -->
    2.      <dependency>
    3.              <groupId>org.springframework.boot</groupId>
    4.          <artifactId>spring-boot-starter-data-redis</artifactId>
    5.              <version>2.7.0</version>
    6.      </dependency>

  2. 配置redis

    1. #Redis配置(默认的主机地址、端口)
    2. spring.redis.host=127.0.0.1
    3. spring.redis.port=6379
    4. spring.redis.password=

  3. 创建Service层，定义查询用户及角色信息的服务接口 ```java package com.example.demo.Service;

import java.util.List;

import org.springframework.beans.factory.annotation.Autowired; import org.springframework.data.redis.core.RedisTemplate;

import com.example.demo.entity.Authority; import com.example.demo.entity.Customer; import com.example.demo.repository.AuthorityRepository; import com.example.demo.repository.CustomerRepository;

public class CustomerService { @Autowired private CustomerRepository customerRepository; @Autowired private AuthorityRepository authorityRepository; private RedisTemplate redisTemplate; public Customer getCustomer(String username){ Customer customer=null; Object o = redisTemplate.opsForValue().get(“customer“+username); if(o!=null){ customer=(Customer)o;//缓存空间内有值则转换值未Customer类型 }else { customer = customerRepository.findByUsername(username); //调用Dao层根据名字查找的方法
if(customer!=null){ redisTemplate.opsForValue().set(“customer“+username,customer); } } return customer; }

  1. public List<Authority> getCustomerAuthority(String username){
  2.     List<Authority> authorities=null;
  3.     Object o = redisTemplate.opsForValue().get("authorities_"+username);
  4.     if(o!=null){
  5.         authorities=(List<Authority>)o;
  6.     }else {
  7.         authorities=authorityRepository.findAuthoritiesByUsername(username);
  8.         if(authorities.size()>0){
  9.            redisTemplate.opsForValue().set("authorities_"+username,authorities);
  10.         } }
  11.     return authorities;}

}

  2. 6. 自定义一个UserDetailsService接口的实现类，通过loadUserByUsername(String s)方法调用用户业务处理类中已有的方法进行用户详情封装
  3. ```java
  4. package com.example.demo.Service;
  6. import java.util.List;
  7. import java.util.stream.Collectors;
  9. import org.springframework.beans.factory.annotation.Autowired;
  10. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  11. import org.springframework.security.core.userdetails.*;
  12. import org.springframework.stereotype.Service;
  13. import org.springframework.web.client.HttpClientErrorException.NotFound;
  15. import com.example.demo.entity.Authority;
  16. import com.example.demo.entity.Customer;
  18. //自定义一个UserDetailsService接口实现类进行用户认证信息封装
  19. @Service
  20. public class UserDetailsServiceImpl implements    UserDetailsService {
  21.     @Autowired
  22.     private CustomerService customerService;
  23.     @Override
  24.     //面向接口的类型，通过源码规定好的返回的类型进行修改。
  25.     public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
  26.         //通过业务方法获取用户以及权限信息
  27.         Customer customer = customerService.getCustomer(s);
  29.         List<Authority> authorities = customerService.getCustomerAuthority(s);
  30.         //对用户权限进行封装
  31.         List<SimpleGrantedAuthority> list = authorities.stream()
  32.                 .map(authority->new SimpleGrantedAuthority(authority.getAuthority()))
  33.                 .collect(Collectors.toList());
  34.         //返回封装的UserDetails用户详情类
  35.         if(customer!=null) {
  36.             UserDetails userDetails = new User(customer.getUsername(),customer.getPassword(),list);
  37.             return userDetails;
  38.         }else {
  39.             //如果查询的用户不存在（用户名不存在），必须抛出异常
  40.             throw new UsernameNotFoundException("当前用户不存在！");
  41.         }
  42.     }
  43. }
  1. 使用UserDetailsService进行身份认证 ```java package com.example.demo.config;

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import com.example.demo.Service.UserDetailsServiceImpl;

//开启MVC Security安全支持 @EnableWebSecurity
//继承抽象类WebSecurityConfigurerAdapter，通过重写其中方法实现自定义 public class SecurityConfig extends WebSecurityConfigurerAdapter{
/*//Autowired相当于new，来自于springboot本身，用于注入组件 @Autowired //装配了DataSource数据源作为属性 private DataSource dataSource; //@Override 注解用于指定方法必须重写，让编译器了解该方法必须重写，如果不重写就报错 @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception{

  1.      /*1. 内存实现身份认证
  2.       //密码设置需要设置编码器
  4.     BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
  5.     //1.使用内存用户信息，作为测试使用。定义了一个common用户，一个vip用户，设定了默认账户密码
  6.     auth.inMemoryAuthentication().passwordEncoder(encoder)
  7.             .withUser("shitou").password(encoder.encode("123456")).roles("common")
  8.             .and()
  9.             .withUser("李四").password(encoder.encode("123456")).roles("vip");
  10. }    
  12.     //2. JDBC进行身份验证
  13.     //密码设置需要设置编码器 
  14.     BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
  15.     //使用JDBC进行身份认证
  16.     //根据浏览器所输入的用户名寻找名字，密码权限
  17.     String userSQL = "select username,password,valid from t_customer "+
  18.                     "where username = ?";
  19.     String authoritySQL = "select c.username,a.authority from t_customer c,"+
  20.                             "t_authority a,t_customer_authority ca where "+
  21.                             "ca.customer_id=c.id and ca.authority_id=a.id and c.username =?";
  22.     //auth调用jdbc权限管理的方法.编码器.数据源.执行SQL语句
  23.     auth.jdbcAuthentication().passwordEncoder(encoder)
  24.                             .dataSource(dataSource)
  25.                             .usersByUsernameQuery(userSQL)
  26.                             .authoritiesByUsernameQuery(authoritySQL);
  27.     */
  28. @Autowired
  29. private UserDetailsServiceImpl userDetailsService;
  30. @Override
  31. protected void configure(AuthenticationManagerBuilder auth)throws Exception{
  32.     //密码设置需要编码器
  33.     BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
  34.     //3.使用UserDetailsService进行身份验证
  35.     auth.userDetailsService(userDetailsService).passwordEncoder(encoder);

} }

```

  1. 效果测试

image.png
image.pngimage.pngimage.png