简单说说Spring Security 使用（附加验证码登录，自定义认证）

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

先看官方文档：http://docs.spring.io/spring-security/site/docs/4.0.x/reference/htmlsingle/

spring security4已经加入了注解的方式，但是为了比较清晰了解，还是使用了配置的方式。

第一步：web.xml 加入拦截、

<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

第二步：编写配置文件：spring-security.xml

<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd ">
<http pattern="/common/**" security="none" />
<http pattern="/login.jsp" security="none" />
<http pattern="/user/login" security="none" />
<http pattern="/index" security="none" />
<http use-expressions="true">
<intercept-url pattern="/**" access="isAuthenticated()" />
<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=1" />
<logout invalidate-session="true" logout-url="/logout" logout-success-url="/" />
</http>
<authentication-manager alias="myAuthenticationManager">
<authentication-provider user-service-ref="cwSysUserDetailsService">
<password-encoder hash="md5"></password-encoder>
</authentication-provider>
</authentication-manager></beans:beans>

第三步：编写登录认证函数

package com.eshore.upsweb.service;import java.util.ArrayList;
import java.util.HashSet;
import java.util.List;
import java.util.Set;import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;import com.eshore.upsweb.dao.CwSysUserDAO;
import com.eshore.upsweb.model.CwSysUser;
import com.eshore.upsweb.model.CwSysUserRole;@Service(value="cwSysUserDetailsService")
public class CwSysUserDetailsService implements UserDetailsService{ @Autowired
CwSysUserDAO cwSysUserDAO; @Override
public UserDetails loadUserByUsername(String username)
throws UsernameNotFoundException {
System.out.println("username is " + username);
CwSysUser user = cwSysUserDAO.findUser(username);
List<GrantedAuthority> authorities = buildUserAuthority(user.getUserRoles());
return buildUserForAuthentication(user, authorities);
} /**
* 返回验证角色
* @param userRoles
* @return
*/
private List<GrantedAuthority> buildUserAuthority(Set<CwSysUserRole> userRoles){
Set<GrantedAuthority> setAuths = new HashSet<GrantedAuthority>();
for(CwSysUserRole userRole:userRoles){
setAuths.add(new SimpleGrantedAuthority(userRole.getRole().getRoleId().toString()));
}
List<GrantedAuthority> result = new ArrayList<GrantedAuthority>(setAuths);
return result;
} /**
* 返回验证用户
* @param user
* @param authorities
* @return
*/
private User buildUserForAuthentication(CwSysUser user,List<GrantedAuthority> authorities){
return new User(user.getUserNo(),user.getPassword(),true,true,true,true,authorities);
} /**
*
*/}

第四步：编写登录controller

package com.eshore.upsweb.controller;import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;import org.hibernate.criterion.DetachedCriteria;
import org.hibernate.criterion.Restrictions;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;import com.eshore.upsweb.model.CwSysUser;
import com.eshore.upsweb.model.LoginInfo;
import com.eshore.upsweb.service.CwSysUserService;@Controller
@RequestMapping(value="/user")
public class CwSysUserController {
@Autowired
private CwSysUserService cwSysUserService;
@Autowired
private AuthenticationManager myAuthenticationManager; // 这样就可以自动注入？oh ，mygod ,how can it do so? @RequestMapping(value="/login",method=RequestMethod.POST)
@ResponseBody
public LoginInfo login(@RequestParam(defaultValue="") String username,@RequestParam(defaultValue="") String password,HttpServletRequest request){
if(!checkValidateCode(request)){
return new LoginInfo().failed().msg("验证码错误！");
}
username = username.trim();
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
/* DetachedCriteria detachedCriteria = DetachedCriteria.forClass(CwSysUser.class,"cwSysUser");
detachedCriteria.add(Restrictions.eq("userNo", username));
if(cwSysUserService.countUser(detachedCriteria)==0){
return new LoginInfo().failed().msg("用户名: "+username+" 不存在.");
}
*/ try {
Authentication authentication = myAuthenticationManager.authenticate(authRequest); //调用loadUserByUsername
SecurityContextHolder.getContext().setAuthentication(authentication);
HttpSession session = request.getSession();
session.setAttribute("SPRING_SECURITY_CONTEXT", SecurityContextHolder.getContext()); // 这个非常重要，否则验证后将无法登陆
return new LoginInfo().success().msg(authentication.getName());
} catch (AuthenticationException ex) {
return new LoginInfo().failed().msg("用户名或密码错误");
}
} /**
* 验证码判断
* @param request
* @return
*/
protected boolean checkValidateCode(HttpServletRequest request) {
String result_verifyCode = request.getSession().getAttribute("verifyResult")
.toString(); // 获取存于session的验证值
// request.getSession().setAttribute("verifyResult", null);
String user_verifyCode = request.getParameter("verifyCode");// 获取用户输入验证码
if (null == user_verifyCode || !result_verifyCode.equalsIgnoreCase(user_verifyCode)) {
return false;
}
return true;
}}

第五步：编写对应的登录jsp

<%@ page language="java" contentType="text/html; charset=UTF-8"
pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<!DOCTYPE html">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Login</title>
<link href="./common/bootstrap/css/bootstrap.min.css" rel="stylesheet">
<link href="./common/bootstrap/css/bootstrap-theme.min.css" rel="stylesheet">
<link rel="stylesheet" type="text/css" href="./common/css/demo.css">
<link rel="stylesheet" type="text/css" href="./common/css/style.css">
<link rel="stylesheet" type="text/css" href="./common/css/animate-custom.css">
<link rel="stylesheet" href="./common/bootstrap/css/bootstrap.css" type="text/css"></link>
<script type="text/javascript" src="./common/bootstrap/js/bootstrap.min.js"></script>
<script type="text/javascript" src="./common/jquery/jquery-2.1.1.min.js"></script>
<body>
<div class="container">
<header> </header>
<div id="container_demo">
<div id="wrapper">
<div id="login" class="animate form">

<h1>电信融合支付平台</h1>
<form id='loginForm' method="POST">
<p>
<label for="" class="uname" data-icon="u"> 用户名 </label>
<input id="username" name="username" required="required" type="text" placeholder="myusername or mymail@mail.com">
</p>
<p>
<label for="" class="youpasswd" data-icon="p"> 密码 </label>
<input id="password" name="password" required="required" type="password" placeholder="eg. X8df!90EO">
</p>
<p>
<label for="verification" class="verification" data-icon="v"> 验证 </label>
<img src="index" id="verify" align="middle" title="看不清，请点我" style="cursor:hand;"/><br/>
<input type="verification" id="verifyCode" name="verifyCode" placeholder="验证码" required="required">
</p>

<p class="login button">
<input type="submit" id="submitId" value="登录">
</p>
</form>
</div>
</div>
</div>
</body> <script type="text/javascript">
$(function(){
/////////////////登录提交////////////////////////////
$("#loginForm").submit(function() {
var username=$("#username").val();
var password=$("#password").val();
var verifyCode=$("#verifyCode").val();
var data={username:username,password:password,verifyCode:verifyCode};
var url="/upsweb/user/login";
$.ajax({
type: "POST",
url: url,
data: data,
// contentType: "application/json",
dataType: "json",
success:function (result) {
if(result.ok){
location.href="/upsweb";
}else{
$(".error").remove();
$("#loginForm").prepend("<div class='error'><font color='red'>"+result.msg+"</font></div>");
$("#verify").attr("src","/upsweb/index?timestamp="+new Date().getTime()); // 刷新验证码
}
},
error:function(XMLHttpRequest, textStatus, errorThrown){
// alert(XMLHttpRequest.status);
// alert(XMLHttpRequest.readyState);
// alert(textStatus);
//alert(XMLHttpRequest.responseText);
alert('读取超时，请检查网络连接');
}
});
return false;
});
///////////////////验证码更新/////////////
$("#verify").click(function(){
$(this).attr("src","/upsweb/index?timestamp="+new Date().getTime());
}); }); $(function ()
{ $("#dd").popover();
});
</script>
</html>