天天看點
傳回

第9章　保護Web應用--Spring Security 之 HelloWord

概述：

Web安全保駕護航，涉及面很廣，從前端到資料庫都有，先簡單用一下Spring Security Demo 來感受一下功能

1、開發環境：

JDK 1.8

maven 3.5

eclipse Neon

2、工程結構：

第9章　保護Web應用--Spring Security 之 HelloWord

3、web.xml 

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
  <display-name>spring-security-helloworld</display-name>
  <servlet>
  	<servlet-name>mvc-dispatcher</servlet-name>
  	<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
  	<load-on-startup>1</load-on-startup>
  	
  </servlet>
  <servlet-mapping>
  	<servlet-name>mvc-dispatcher</servlet-name>
  	<url-pattern>/</url-pattern>
  	
  </servlet-mapping>
  <listener>
  	<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>
  <context-param>
  	<param-name>contextConfigLocation</param-name>
  	<param-value>classpath:spring-security.xml</param-value>
  </context-param>
  <filter>
  	<filter-name>springSecurityFilterChain</filter-name>
  	<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>
  <filter-mapping>
  	<filter-name>springSecurityFilterChain</filter-name>
  	<url-pattern>/*</url-pattern>
  </filter-mapping>
  
</web-app>

總結：

1、在沒有顯示引入Springmvc.xml 配置檔案，預設是WEB-INF/{servlet-name}-servlet.xml  例如上面自動尋找 WEB-INF/mvc-dispatcher-servlet.xml,當然也可以顯示指定

2、配置spring-security.xml 安全政策相關的

3、配置一個過濾器代理，通過代理去關聯具體的過濾器

4、pom.xml 

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.jack</groupId>
  <artifactId>spring-security-helloworld</artifactId>
  <version>0.0.1-SNAPSHOT</version>
  <name>spring-security-helloworld</name>

	<licenses>
		<license>
			<name>The Apache Software License, Version 2.0</name>
			<url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
			<distribution>repo</distribution>
		</license>
	</licenses>
	<properties>
		<jdk.version>1.8</jdk.version>
		<spring.version>4.3.8.RELEASE</spring.version>
		<spring.security.version>3.2.3.RELEASE</spring.security.version>
		<jstl.version>1.2</jstl.version>
	</properties>

	<dependencies>

		<!-- Spring 3 dependencies -->
		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>spring-core</artifactId>
			<version>${spring.version}</version>
		</dependency>

		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>spring-web</artifactId>
			<version>${spring.version}</version>
		</dependency>

		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>spring-webmvc</artifactId>
			<version>${spring.version}</version>
		</dependency>

		<!-- Spring Security -->
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-web</artifactId>
			<version>${spring.security.version}</version>
		</dependency>

		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-config</artifactId>
			<version>${spring.security.version}</version>
		</dependency>

		<!-- jstl for jsp page -->
		<dependency>
			<groupId>jstl</groupId>
			<artifactId>jstl</artifactId>
			<version>${jstl.version}</version>
		</dependency>

	</dependencies>

	<build>
		<finalName>SpringSecurityHelloWorld</finalName>
		<plugins>

			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-compiler-plugin</artifactId>
				<version>2.3.2</version>
				<configuration>
					<source>${jdk.version}</source>
					<target>${jdk.version}</target>
				</configuration>
			</plugin>

			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-eclipse-plugin</artifactId>
				<version>2.9</version>
				<configuration>
					<downloadSources>true</downloadSources>
					<downloadJavadocs>false</downloadJavadocs>
					<wtpversion>2.0</wtpversion>
				</configuration>
			</plugin>

		</plugins>
	</build>
	
</project>

總結：

1、這裡引入Spring Security 的jar包有

<dependency>

<groupId>org.springframework.security</groupId>

<artifactId>spring-security-web</artifactId>

<version>${spring.security.version}</version>

</dependency>

<dependency>

<groupId>org.springframework.security</groupId>

<artifactId>spring-security-config</artifactId>

<version>${spring.security.version}</version>

</dependency>

5、mvc-dispatcher-servlet.xml 

<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:context="http://www.springframework.org/schema/context"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="
        http://www.springframework.org/schema/beans     
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
        http://www.springframework.org/schema/context 
        http://www.springframework.org/schema/context/spring-context-3.0.xsd">
        
   <context:component-scan base-package="com.jack.*"/>     
   
   <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
   	<property name="prefix">
   		<value>/WEB-INF/pages/</value>
   	</property>
   	<property name="suffix">
   		<value>.jsp</value>
   	</property>
   </bean>

</beans>

6、spring-security.xml 主要配置檔案

<beans:beans xmlns="http://www.springframework.org/schema/security"

xmlns:beans="http://www.springframework.org/schema/beans" 

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://www.springframework.org/schema/beans

http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

http://www.springframework.org/schema/security

http://www.springframework.org/schema/security/spring-security-3.2.xsd">

<http auto-config="true">

<intercept-url pattern="/admin**" access="ROLE_USER"/>

</http>

<authentication-manager>

<authentication-provider>

<user-service>

<user name="jack" password="123456" authorities="ROLE_USER"/>

</user-service>

</authentication-provider>

</authentication-manager>

</beans:beans>

總結：

1、<http>表示攔截http請求， auto-config="true" 表示自動處理請求出現各種情況，例如輸錯了提示資訊

2、<intercept-url > 表示攔截具體url位址 pattern就是正規表達式， access 表示通過角色

3、<authentication-manager>表示驗證經理，<authentication-provider>提供通行票

4、<user-service>表示使用者登入功能，彈出輸入框， authorities 跟 access 值一樣

7、HelloController.java  

package com.jack.controller;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.servlet.ModelAndView;

@Controller
public class HelloController {
	
	@RequestMapping(value={"/","/welcome**"}, method=RequestMethod.GET)
	public ModelAndView welcomePage(){
		
		ModelAndView model = new ModelAndView();
		model.addObject("title", "Spring Security Hello World");
		model.addObject("message", "This is welcom page!");
		model.setViewName("hello");
		return model;
	}
	
	@RequestMapping(value ="/admin**", method= RequestMethod.GET)
	public ModelAndView adminPage(){
		ModelAndView model = new ModelAndView();
		model.addObject("title", "SpringSecurity Hello World");
		model.addObject("message", "This is protected page!");
		model.setViewName("admin");
		
		return model;
	}
	
}

總結：

1、一般情況傳回一個字元串對應jsp，這裡可以傳回一個視圖，model可以帶資料，model也可以設定視圖名稱

2、addObject() 可以直接在jsp通過 ${title} 形式擷取資料

8、jsp

hello.jsp

<%@page session="false"%>
<html>
<body>
	<h1>Title : ${title}</h1>	
	<h1>Message : ${message}</h1>	
</body>
</html>

admin.jsp

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%@ page session="true" %>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Insert title here</title>
</head>
<body>
	<h1>Title: ${title }</h1>
	<h1>Message: ${message }</h1>
	<c:if test="${pageContext.request.userPrincipal.name !=null }">
		 <h2>Welcome : ${pageContext.request.userPrincipal.name}
           | <a href="<c:url value=" target="_blank" rel="external nofollow" /j_spring_security_logout" />" > Logout</a></h2>
	</c:if>
</body>
</html>

總結：

1、這裡有一個if 判斷， pageContext.request.userPrincipal.name 表示作用域為頁面Request請求userPrincipal.name 表示通過安全檢查姓名

2、Logout登出的意思，/j_spring_security_logout 這句話就是去掉pageContext.request.userPrincipal.name 的值為空，下次需要輸入使用者名和密碼進入

9、效果：

歡迎頁

第9章　保護Web應用--Spring Security 之 HelloWord

admin.jsp

第9章　保護Web應用--Spring Security 之 HelloWord

輸入錯誤密碼

第9章　保護Web應用--Spring Security 之 HelloWord

輸入正确密碼

第9章　保護Web應用--Spring Security 之 HelloWord

總結：

本質上AOP切面功能，執行請求進行攔截處理，包括這裡輸入框界面

參考位址：https://www.mkyong.com/spring-security/spring-security-hello-world-example/

Spring實戰筆記 Spring Security Maven helloworld 入門
上一篇: 0.1Spring Security：Web方案
下一篇: 如何将xml檔案轉變成java對象

繼續閱讀