thymeleaf+springsecurity整合

2020-04-15 本文已影响0人 IT宝哥哥

使用简单的内存模式进行thymeleaf+springsecurity整合

1. 创建项目后倒入maven

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.thymeleaf.extras</groupId>
            <artifactId>thymeleaf-extras-springsecurity5</artifactId>
            <version>3.0.4.RELEASE</version>
        </dependency>

2. 创建控制器

image.png

package com.example.redpack.controller;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
public class RouteController {
    @RequestMapping({"/","index"})
    public String index(){
        return "index";
    }

    @RequestMapping("level1/1")
    public String level1(){
        return "level1/1";
    }
    @RequestMapping("level2/1")
    public String level2(){
        return "level2/1";
    }
    @RequestMapping("level3/1")
    public String level3(){
        return "level3/1";
    }
}

3. 创建SecurityConfig

image.png

package com.example.redpack.config;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    //认证
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
//        super.configure(auth);
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                .withUser("test").password(new BCryptPasswordEncoder().encode("test")).roles("level1", "level2", "level3")
                .and()
                .withUser("guest").password(new BCryptPasswordEncoder().encode("guest")).roles("level1");
    }

    //授权
    @Override
    protected void configure(HttpSecurity http) throws Exception {
//        super.configure(http);
        //授权用户角色可以访问
        http.authorizeRequests()
                .antMatchers("/", "/index").permitAll()
                .antMatchers("/level1/**").hasRole("level1")
                .antMatchers("/level2/**").hasRole("level2")
                .antMatchers("/level3/**").hasRole("level3");
        http.csrf().disable();//关闭csrf,不能get请求logout
        http.formLogin();//开启登录，必须开启，否则无法使用认证
        http.formLogin().usernameParameter("username").passwordParameter("password");//设置表单的username和password,方便自定义
        http.rememberMe();
    }
}

4. 创建html页面

//index.html
<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
<h2>index</h2>
fds
<ul>
    <div sec:authorize="isAuthenticated()">
        <div sec:authentication="name"></div>
        <a href="/logout">退出</a>
    </div>
    <div sec:authorize="isAnonymous()">
        <a href="/login">登录</a>
    </div>
    <li sec:authorize="hasRole('level1')"><a href="/level1/1">level1</a></li>
    <li sec:authorize="hasRole('level2')"><a href="/level2/1">level2</a></li>
    <li sec:authorize="hasRole('level3')"><a href="/level3/1">level3</a></li>
</ul>
</body>
</html>

其他页面内容省略只是测试能否实现权限控制。

5. 效果

guest用户登录，没有level2和level3菜单

test用户登录，所有的菜单都显示

6. 注意事项

maven版本和index.html页面内的xml路径，尤其是xmlns:sec。
sec标签参考： https://github.com/thymeleaf/thymeleaf-extras-springsecurity