SpringBoot使用Spring Security實現(xiàn)登錄注銷功能

更新時間：2020年09月24日 10:01:27 作者：W.G.H

這篇文章主要介紹了SpringBoot使用Spring Security實現(xiàn)登錄注銷功能，本文通過實例代碼給大家介紹的非常詳細，對大家的學習或工作具有一定的參考借鑒價值，需要的朋友參考下吧

1.首先看下我的項目結(jié)構(gòu)

在這里插入圖片描述

我們逐個講解

/**
 * 用戶登錄配置類
 * @author Administrator
 *
 */
public class AdminUserDateils implements UserDetails {

	private static final long serialVersionUID = -1546619839676530441L;
	
	 private transient YCAdmin yCAdmin;

	 public AdminUserDateils() {
	}

	 public AdminUserDateils(YCAdmin yCAdmin) {
	  if (yCAdmin != null) {
	   this.yCAdmin = yCAdmin;
	  }
	 }
	

	 
	public YCAdmin getyCAdmin() {
			return yCAdmin;
		}

		public void setyCAdmin(YCAdmin yCAdmin) {
			this.yCAdmin = yCAdmin;
		}

	@Override
	public Collection<? extends GrantedAuthority> getAuthorities() {
		 Collection<GrantedAuthority> authorities = new ArrayList<>();
	  SimpleGrantedAuthority authority = new SimpleGrantedAuthority("admin");
	  authorities.add(authority);
	  return authorities;
	}
	//用戶名密碼
	@Override
	public String getPassword() {
	
		 return yCAdmin.getAdminPassword();
	}
	//賬號
	@Override
	public String getUsername() {
		
		return yCAdmin.getAdminAccount();
	}

	@Override
	public boolean isAccountNonExpired() {
		
		return true;
	}

	@Override
	public boolean isAccountNonLocked() {
		
		return true;
	}

	@Override
	public boolean isCredentialsNonExpired() {
		
		return true;
	}

	@Override
	public boolean isEnabled() {
		
		return true;
	}

}

首先以上AdminUserDateils類是配置用戶登錄成功后，來存儲用戶登錄的信息

/**
 * Spring-Security
 * @author Administrator
 *
 */
@Service
public class AdminCustomerDetailsService implements UserDetailsService{

	
	@Autowired
	private YCAdminMapper yCAdminMapper;
	
	
	@Override
	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
		YCAdmin ycAdmin= yCAdminMapper.selectYCAdminByAccount(username);
		if(ycAdmin==null) {
			
			throw new UsernameNotFoundException("未找到該用戶??！");
		}
		//配置的AdminUserDateils
		AdminUserDateils adminUserDateils = new AdminUserDateils(ycAdmin);
		return adminUserDateils;
	}
}

以上AdminCustomerDetailsService是根據(jù)查找用戶名的，需要實現(xiàn)UserDetailsService接口的loadUserByUsername的方法也就是會找用戶名，這個根據(jù)mapper層，也就是數(shù)據(jù)庫查找，返回只也就是剛才配置的AdminUserDateils類

public class YhPasswordEncoder implements PasswordEncoder{

	@Override
	public String encode(CharSequence rawPassword) {
		return Des3.encrypt(rawPassword.toString());
	}

	@Override
	public boolean matches(CharSequence rawPassword, String encodedPassword) {
		// TODO Auto-generated method stub
		return encode(rawPassword).equals(encodedPassword);
	}

}

以上YhPasswordEncoder 需要繼承是我們PasswordEncoder配置用戶密碼加密的，這里的加密可以按照自己業(yè)務需求來使用加密，按照這樣換一種加密類型就可以了。

public class AdminSecurityConfiguration {

	@Configuration
	@Order(2)
	@EnableWebSecurity
	public static class ClientSecurityConfig extends WebSecurityConfigurerAdapter {
		@Autowired
		private AdminCustomerDetailsService adminCustomerDetailsService;

		@Value("${yunhui.admin.urlContext:/houtai}")
		private String adminUrlContext;
	

		@Value("${yunhui.admin.noLoginUrls:}")
		private String noLoginUrls;

		@Override
		protected void configure(HttpSecurity http) throws Exception {
			
			//循環(huán)獲取用戶不需要驗證url（這里是記錄在yml）
			List<String> clientNoLoginUrls = new ArrayList<String>();
			if (!noLoginUrls.isEmpty()) {
				for (String s : noLoginUrls.split(",")) {
					clientNoLoginUrls.add(adminUrlContext + s);
				}
			}
			http.
					//需要驗證登錄的url
					antMatcher(adminUrlContext + "/**").authorizeRequests()
					//不需登錄驗證的url
					.antMatchers(clientNoLoginUrls.toArray(new String[0])).permitAll()
					.anyRequest().authenticated().and()
					//開啟表單驗證
					.formLogin().
					//驗證登錄的url
					loginProcessingUrl("/houtai/login")
					//登錄的頁面
					.loginPage("/houtai/login")
					//登錄成功后跳轉(zhuǎn)
					.defaultSuccessUrl("/houtai").permitAll().and()
					//注銷登錄的url
					.logout().logoutUrl("/houtai/loginout")
					//注銷之后跳轉(zhuǎn)的頁面
					.logoutSuccessUrl("/houtai")
					.and().rememberMe().and().csrf().disable();;
			
		}
		
		@Override
		public void configure(AuthenticationManagerBuilder auth) throws Exception {
			//需要哪個service，和驗證密碼的方式，剛才我們都配置了
			auth.userDetailsService(adminCustomerDetailsService).passwordEncoder(new YhPasswordEncoder());
		}
}

最后就是配置首先開啟
@Configuration
@EnableWebSecurity
的注解