spring-security——web权限方案：自动登录

摘要：SpringSecurity基于数据库实现自动登录功能的开发步骤。

基于数据库实现Remember-me

开发步骤

1. 创建数据库表

CREATE TABLE `persistent_logins` (
`username` varchar(64) NOT NULL,
`series` varchar(64) NOT NULL,
`token` varchar(64) NOT NULL,
`last_used` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE 
CURRENT_TIMESTAMP,
PRIMARY KEY (`series`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

2. 修改配置类

• 在配置类中注入数据源，配置操作数据库对象

@Autowired
    private DataSource dataSource;

    @Bean
    public PersistentTokenRepository persistentTokenRepository() {
        JdbcTokenRepositoryImpl jdbcTokenRepository = new JdbcTokenRepositoryImpl();
        jdbcTokenRepository.setDataSource(dataSource);
        // 自动创建数据库表（已手动创建）
        // jdbcTokenRepository.setCreateTableOnStartup(true);
        return jdbcTokenRepository;
    }

• 在configure(HttpSecurity http)方法中设置自动登录

.and().rememberMe().tokenRepository(persistentTokenRepository())
.tokenValiditySeconds(60) // 设置有效时长
.userDetailsService(userDetailsService)

package com.shg.securitydemo.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl;
import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;

import javax.sql.DataSource;

/**
 * @author: shg
 * @create: 2022-05-16 1:44 下午
 */
@Configuration
public class SecurityConfig3 extends WebSecurityConfigurerAdapter {

    @Qualifier("userDetailsService2")
    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private DataSource dataSource;

    @Bean
    public PersistentTokenRepository persistentTokenRepository() {
        JdbcTokenRepositoryImpl jdbcTokenRepository = new JdbcTokenRepositoryImpl();
        jdbcTokenRepository.setDataSource(dataSource);
        // 自动创建数据库表（已手动创建）
        // jdbcTokenRepository.setCreateTableOnStartup(true);
        return jdbcTokenRepository;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService)
                .passwordEncoder(passwordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 配置退出的路径
        http.logout().logoutUrl("/logout").logoutSuccessUrl("/test/logout").permitAll();
        // 配置没有访问权限是返回的页面路径
        http.exceptionHandling().accessDeniedPage("/403.html");
        http.formLogin() // 自定义自己编写的登录页面
                .loginPage("/login.html")
                .loginProcessingUrl("/user/login") // 登录访问路径
                .defaultSuccessUrl("/success.html").permitAll() // 登录成功后跳转页面
                .and().authorizeRequests()
                .antMatchers("/", "/user/login").permitAll() // 设置哪些路径可以直接访问不需要认证
                // hasAuthority 方法
                .antMatchers("/test/hello").hasAuthority("admin") // 设置路径 "/test/hello" 需要admin权限才能访问
                // hasAnyAuthority 方法
                .antMatchers("/test/share").hasAnyAuthority("admin", "root")
                // hasRole 方法
                .antMatchers("/test/role").hasRole("admin")
                .anyRequest().authenticated()
                .and().rememberMe().tokenRepository(persistentTokenRepository())
                .tokenValiditySeconds(60) // 设置有效时长
                .userDetailsService(userDetailsService)
                .and().csrf().disable(); // 关闭csrf防护
    }
}

3. 修改登录页面login.html

• 添加一个复选框，复选框的name必须为remember-me

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>login</title>
</head>
<body>
  <form action="/user/login" method="post">
      用户名：<input type="text" name="username">
      <br />
      密码：<input type="text" name="password">
      <br />
      <input type="checkbox" name="remember-me" />记住我
      <input type="submit" value="login">
  </form>
</body>
</html>