在这部分学习下如何配置一个简单的spring-security例子。
1. 项目结构
2.首先在web.xml中添加如下代码
<?xml version="1.0" encoding="UTF-8"?> <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0" metadata-complete="false"> <display-name>chapter1</display-name> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- Spring配置文件开始 --> <context-param> <param-name>contextConfigLocation</param-name> <param-value> classpath:applicationContext.xml </param-value> </context-param> <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <servlet> <servlet-name>springmvc</servlet-name> <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> <init-param> <param-name>contextConfigLocation</param-name> <param-value>classpath:dispatcher-servlet.xml</param-value> </init-param> <load-on-startup>1</load-on-startup> <async-supported>true</async-supported> </servlet> <servlet-mapping> <servlet-name>springmvc</servlet-name> <url-pattern>/</url-pattern> </servlet-mapping> </web-app>
3. 在security.xml中添加如下代码:
<security:http> <security:intercept-url pattern="/**" access="ROLE_USER"/> <security:form-login/> <security:logout/> </security:http>
这段代码表示应用中所有的url都要安全控制,需要请求的用户拥有” ROLE_USER”这个权限;
要求请求所有url前,用户必须先登录;
系统允许用户退出
4. 在用户访问系统的一个url的时候,security会检测用户是否登录,若没有登录,那么就跳到一个默认生成的登录页面;接下来配置登录用户的信息;在security.xml中添加如下代码:
<security:authentication-manager> <security:authentication-provider> <security:user-service> <security:user name="silentwu" password="123456" authorities="ROLE_USER, ROLE_ADMIN"/> </security:user-service> </security:authentication-provider> </security:authentication-manager>
这里简单配置了一个用户,用户拥有的权限:ROLE_USER, ROLE_ADMIN
5. 到此,项目就可以发布到服务器上运行了。
在浏览器中请求:http://localhost/chapter1/index.html , 自动跳转到登录
输入配置的用户名,密码