Spring Security 入门原理及实战

@Controller
public class AppController {

    @RequestMapping("/hello")
    @ResponseBody
    String home() {
        return "Hello ,spring security!";
    }
}

dependency>
    groupId>org.springframework.bootgroupId>
    artifactId>spring-boot-starter-securityartifactId>
dependency>

security.basic.enabled=false

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .formLogin().and()
                .httpBasic();
    }
}

html>head>title>Login Pagetitle>head>body onload=‘document.f.username.focus();‘>
h3>Login with Username and Passwordh3>form name=‘f‘ action=‘/login‘ method=‘POST‘>
table>
    tr>td>User:td>td>input type=‘text‘ name=‘username‘ value=‘‘>td>tr>
    tr>td>Password:td>td>input type=‘password‘ name=‘password‘/>td>tr>
    tr>td colspan=‘2‘>input name="submit" type="submit" value="Login"/>td>tr>
    input name="_csrf" type="hidden" value="635780a5-6853-4fcd-ba14-77db85dbd8bd" />
table>
form>body>html>

security.user.name=admin
security.user.password=admin

@Controller
@RequestMapping("/product")
public class ProductTestController {

    @RequestMapping("/info")
    @ResponseBody
    public String productInfo(){
        return " some product info ";
    }
}
-------------------------------------------
@Controller
@RequestMapping("/admin")
public class AdminTestController {

    @RequestMapping("/home")
    @ResponseBody
    public String productInfo(){
        return " admin home page ";
    }
}

@Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .inMemoryAuthentication()
                .withUser("admin1") // 管理员，同事具有 ADMIN,USER权限，可以访问所有资源
                    .password("admin1")
                    .roles("ADMIN", "USER")
                    .and()
                .withUser("user1").password("user1") // 普通用户，只能访问 /product/**
                    .roles("USER");
    }

 @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                    .antMatchers("/product/**").hasRole("USER")
                    .antMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
                .and()
                .formLogin().and()
                .httpBasic();
    }

public interface SecurityContext extends Serializable {
    /**
     * Obtains the currently authenticated principal, or an authentication request token.
     *
     * @return the Authentication or null if no authentication
     * information is available
     */
    Authentication getAuthentication();

    /**
     * Changes the currently authenticated principal, or removes the authentication
     * information.
     *
     * @param authentication the new Authentication token, or
     * null if no further authentication information should be stored
     */
    void setAuthentication(Authentication authentication);
}

SecurityContextHolder看名知义，是一个holder,用来hold住SecurityContext实例的。其作用就是存储当前认证信息。

在典型的web应用程序中，用户登录一次，然后由其会话ID标识。服务器缓存持续时间会话的主体信息。

在Spring Security中，在请求之间存储SecurityContext的责任落在SecurityContextPersistenceFilter上，

默认情况下，该上下文将上下文存储为HTTP请求之间的HttpSession属性。

它会为每个请求恢复上下文SecurityContextHolder，并且最重要的是，在请求完成时清除SecurityContextHolder。

SecurityContextHolder是一个类，他的功能方法都是静态的（static）。

SecurityContextHolder可以设置指定JVM策略（SecurityContext的存储策略），这个策略有三种：
1. MODE_THREADLOCAL：SecurityContext 存储在线程中。
2. MODE_INHERITABLETHREADLOCAL：SecurityContext 存储在线程中，但子线程可以获取到父线程中的 SecurityContext。
3. MODE_GLOBAL：SecurityContext 在所有线程中都相同。
SecurityContextHolder默认使用MODE_THREADLOCAL模式，即存储在当前线程中。在spring security应用中，我们通常能看到类似如下的代码：
SecurityContextHolder.getContext().setAuthentication(token);

public interface Authentication extends Principal, Serializable {
 
    Collection extends GrantedAuthority> getAuthorities();
    Object getCredentials();
    Object getDetails();
    Object getPrincipal();
    boolean isAuthenticated();
    void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException;
}

public interface UserDetails extends Serializable {

    Collection extends GrantedAuthority> getAuthorities();
    String getPassword();
    String getUsername();
    boolean isAccountNonExpired();
    boolean isAccountNonLocked();
    boolean isCredentialsNonExpired();
    boolean isEnabled();
}

public interface AuthenticationManager {
    Authentication authenticate(Authentication authentication)
            throws AuthenticationException;
}