📅  最后修改于: 2020-12-05 03:07:50             🧑  作者: Mango
Spring Security提供了我们可以在应用程序中使用的登录和注销功能。创建安全的Spring应用程序很有帮助。
在这里,我们将使用Spring Security创建一个Spring MVC应用程序,并实现登录和注销功能。
首先,我们创建了一个maven项目,并在pom.xml文件中提供了以下项目依赖项。
4.0.0
com.javatpoint
springSecurityLoginOut
0.0.1-SNAPSHOT
war
1.8
1.8
org.springframework
spring-webmvc
5.0.2.RELEASE
org.springframework.security
spring-security-web
5.0.0.RELEASE
org.springframework.security
spring-security-core
5.0.0.RELEASE
org.springframework.security
spring-security-config
5.0.0.RELEASE
javax.servlet
javax.servlet-api
3.1.0
provided
javax.servlet
jstl
1.2
org.apache.maven.plugins
maven-war-plugin
2.6
false
之后,我们创建了配置文件以启用登录功能,并仅允许访问授权用户。
该项目包含以下四个Java文件。
AppConfig.java
package com.javatpoint;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.view.InternalResourceViewResolver;
import org.springframework.web.servlet.view.JstlView;
@EnableWebMvc
@Configuration
@ComponentScan({ "com.javatpoint.controller.*" })
public class AppConfig {
@Bean
public InternalResourceViewResolver viewResolver() {
InternalResourceViewResolver viewResolver
= new InternalResourceViewResolver();
viewResolver.setViewClass(JstlView.class);
viewResolver.setPrefix("/WEB-INF/views/");
viewResolver.setSuffix(".jsp");
return viewResolver;
}
}
MvcWebApplicationInitializer.java
package com.javatpoint;
import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;
public class MvcWebApplicationInitializer extends
AbstractAnnotationConfigDispatcherServletInitializer {
@Override
protected Class>[] getRootConfigClasses() {
return new Class[] { WebSecurityConfig.class };
}
@Override
protected Class>[] getServletConfigClasses() {
// TODO Auto-generated method stub
return null;
}
@Override
protected String[] getServletMappings() {
return new String[] { "/" };
}
}
SecurityWebApplicationInitializer.java
package com.javatpoint;
import org.springframework.security.web.context.*;
public class SecurityWebApplicationInitializer
extends AbstractSecurityWebApplicationInitializer {
}
WebSecurityConfig.java
package com.javatpoint;
import org.springframework.context.annotation.*;
//import org.springframework.security.config.annotation.authentication.builders.*;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.*;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@EnableWebSecurity
@ComponentScan("com.javatpoint")
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Bean
public UserDetailsService userDetailsService() {
InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
manager.createUser(User.withDefaultPasswordEncoder()
.username("irfan").password("khan").roles("ADMIN").build());
return manager;
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.anyRequest().hasRole("ADMIN")
.and().formLogin().and()
.httpBasic()
.and()
.logout()
.logoutUrl("/j_spring_security_logout")
.logoutSuccessUrl("/")
;
}
}
HomeController:处理用户请求的控制器。
package com.javatpoint.controller;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
@Controller
public class HomeController {
@RequestMapping(value = "/", method = RequestMethod.GET)
public String index() {
return "index";
}
@RequestMapping(value="/logout", method=RequestMethod.GET)
public String logoutPage(HttpServletRequest request, HttpServletResponse response) {
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
if (auth != null){
new SecurityContextLogoutHandler().logout(request, response, auth);
}
return "redirect:/";
}
}
我们有一个JSP文件index.jsp ,其中包含以下代码。
<%@ page language="java" contentType="text/html; charset=UTF-8"
pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
Home
Hello ${pageContext.request.userPrincipal.name},
Welcome to Javatpoint!
Click here to logout
创建上述文件后,我们的项目结构如下所示:
输出量
使用apache tomcat运行时,它将向浏览器生成以下输出。
现在,提供要登录的用户凭据。
成功登录后会显示主页,请参见下文。
在这里,我们创建了一个注销链接,可用于注销。让我们签出并注销该应用程序。
然后重定向回到登录页面。
好了,我们已经创建了一个成功的Spring MVC应用程序,该应用程序使用Spring Security来实现登录和注销功能。