SpringSecurity配置403权限访问页面
【摘要】 @toc 1、未配置之前 2、开始配置 2.1 新建一个unauth.html<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title>Title</title></head><body><h1>没有访问的权限</h1></body></html> 2.2 在继承WebSecurityConfigure...
@toc
1、未配置之前
2、开始配置
2.1 新建一个unauth.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Title</title>
</head>
<body>
<h1>没有访问的权限</h1>
</body>
</html>
2.2 在继承WebSecurityConfigurerAdapter的配置类中设置
关键代码：
//配置没有权限访问自定义跳转的页面
http.exceptionHandling()
.accessDeniedPage("/unauth.html");
配置类完整代码：
package com.atguigu.springsecuritydemo1.config;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
@Configuration
public class SecurityConfigTest extends WebSecurityConfigurerAdapter {
@Autowired
private UserDetailsService userDetailsService;
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(password());
}
@Bean
PasswordEncoder password(){
return new BCryptPasswordEncoder();
}
@Override
protected void configure(HttpSecurity http) throws Exception {
//退出配置
http.logout().logoutUrl("/logout")
.logoutSuccessUrl("/test/hello")
.permitAll();
//配置没有权限访问自定义跳转的页面
http.exceptionHandling().accessDeniedPage("/unauth.html");
http.formLogin() //自定义自己编写的登陆页面
.loginPage("/login.html") //登录页面设置
.loginProcessingUrl("/user/login") //登录访问路径
.defaultSuccessUrl("/success.html").permitAll() //登录成功之后，跳转路径
.and().authorizeRequests()
//设置哪些路径可以直接访问，不需要认证
.antMatchers("/","/test/hello","/user/login").permitAll()
//当前登录的用户，只有具有admins权限才可以访问这个路径
//1、hasAuthority方法
//.antMatchers("/test/index").hasAuthority("admins")
//2、hasAnyAuthority方法
// .antMatchers("/test/index").hasAnyAuthority("admins,manager")
//3、hasRole方法 ROLE_sale
.antMatchers("/test/index").hasRole("sale")
//4、hasAnyRole方法
.anyRequest().authenticated()
.and().csrf().disable(); //关闭csrf防护
}
}
2.3 继承UserDetailsService接口的实现类
package com.atguigu.springsecuritydemo1.service;
import com.atguigu.springsecuritydemo1.entity.Users;
import com.atguigu.springsecuritydemo1.mapper.UsersMapper;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;
import java.util.List;
@Service("userDetailsService")
public class MyUserDetailService implements UserDetailsService {
@Autowired
private UsersMapper usersMapper;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
//调用userMapper中的方法，根据用户名查询数据库
QueryWrapper<Users> wrapper=new QueryWrapper<>();//条件构造器
//where username=?
wrapper.eq("username",username);
Users users= usersMapper.selectOne(wrapper);
//判断
if(users==null){ //数据库没有用户名，认证失败
throw new UsernameNotFoundException("用户名不存在！");
}
List<GrantedAuthority> auths= AuthorityUtils.commaSeparatedStringToAuthorityList("admins,ROLE_sale");
//从查询数据库返回user对象，得到用户名和密码，返回
return new User(users.getUsername(),new BCryptPasswordEncoder().encode(users.getPassword()),auths);
}
}
3、测试
现在我故意将原先的sale改为sale1制造错误
启动项目并访问http://localhost:8111/test/index
输入lucy 123
成功实现
【版权声明】本文为华为云社区用户原创内容，未经允许不得转载，如需转载请自行联系原作者进行授权。如果您发现本社区中有涉嫌抄袭的内容，欢迎发送邮件进行举报，并提供相关证据，一经查实，本社区将立刻删除涉嫌侵权内容，举报邮箱：
cloudbbs@huaweicloud.com
- 点赞
- 收藏
- 关注作者
评论（0）