spring boot+freemarker+spring security标签权限判断

时间：2021-07-07 06:23:27

spring boot+freemarker+spring security标签权限判断

SpringBoot+SpringSecurity+Freemarker项目中在页面上使用security标签控制按钮显示隐藏达到对按钮级权限控制还是比较方便的，如下配置即可。

1、引入依赖

<dependency>

<groupId>org.springframework.security</groupId>

<artifactId>spring-security-taglibs</artifactId>

</dependency> 		

<dependency>

<groupId>javax.servlet.jsp</groupId>

<artifactId>jsp-api</artifactId>

<version>2.2.1-b03</version>

</dependency>

　　

2、依赖引入后到spring-security-taglibs包中META-INF下security.tld复制出来，放到/resources/下，最后建一个目录tags，如下：

spring boot+freemarker+spring security标签权限判断

3、建一个配置类：ClassPathTldsLoader.java

import java.util.Arrays;

import java.util.List;

import javax.annotation.PostConstruct;

import org.apache.commons.lang.ArrayUtils;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.web.servlet.view.freemarker.FreeMarkerConfigurer;

public class ClassPathTldsLoader {

	  /**

     * 指定路径

     */

    private static final String SECURITY_TLD = "/security.tld";

    final private List<String> classPathTlds;

    public ClassPathTldsLoader(String... classPathTlds) {

        super();

        if(ArrayUtils.isEmpty(classPathTlds)){

            this.classPathTlds = Arrays.asList(SECURITY_TLD);

        }else{

            this.classPathTlds = Arrays.asList(classPathTlds);

        }

    }

    @Autowired

    private FreeMarkerConfigurer freeMarkerConfigurer;

    @PostConstruct

    public void loadClassPathTlds() {

        freeMarkerConfigurer.getTaglibFactory().setClasspathTlds(classPathTlds);

    }

}

　　

4.然后在网站配置文件SecurityConfig.java中加入bean

/**

	 * 自动加载security-taglibs

	 * @return

	 */

	    @Bean

	    @ConditionalOnMissingBean(ClassPathTldsLoader.class)

	    public ClassPathTldsLoader classPathTldsLoader(){

	        return new ClassPathTldsLoader();

	    }

　　

参考：

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;

import org.springframework.context.annotation.Bean;

import org.springframework.security.authentication.AuthenticationProvider;

import org.springframework.security.authentication.dao.DaoAuthenticationProvider;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.crypto.password.PasswordEncoder;

@EnableWebSecurity

//启用全局post安全方法设置

@EnableGlobalMethodSecurity(prePostEnabled=true)

public class SecurityConfig extends WebSecurityConfigurerAdapter {

	private static final String key = "muyang.my";

	@Autowired

	private UserDetailsService userDetailsService;

	@Bean

	public PasswordEncoder passwordEncoder()

	{

		return new BCryptPasswordEncoder();

	}

	@Bean

	public AuthenticationProvider authenticationProvider() {

		DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();

		authenticationProvider.setUserDetailsService(userDetailsService);

		//密码加密方式

		authenticationProvider.setPasswordEncoder(passwordEncoder());

		return authenticationProvider;

	}

	@Override

	protected void configure(HttpSecurity http) throws Exception {

		// TODO Auto-generated method stub

		//super.configure(http);

		//关闭csrf验证:跨站攻击

		//http.csrf().disable();

		//权限设置

		http.authorizeRequests()     //定义那些url需要保护，哪些不需要保护

		.antMatchers("/static/**").permitAll()  //都可以访问

		.antMatchers("/user/**").hasRole("ADMIN") //需要登陆才能访问

		.and()

		.headers().frameOptions().disable() //解决js跨站把x-frame-options disable即可

		.and()

		.formLogin() //基于FORM表单登陆验证

		.loginPage("/login").failureUrl("/login-error") //自定义登陆界面//自定义登陆错误页面

		.and().rememberMe().key(key) //记住我

		.and().exceptionHandling().accessDeniedPage("/403");  // 处理异常，拒绝访问就重定向到 403 页面

	}

	/**

	 * 认证信息管理

	 * @param auth

	 * @throws Exception

	 */

	@Autowired

	public  void configureGlobal(AuthenticationManagerBuilder  auth) throws Exception {

		// TODO Auto-generated method stub

		//super.configure(auth);

		//auth.inMemoryAuthentication().withUser("admin").password("123456").roles("ADMIN");

		auth.userDetailsService(userDetailsService);

		auth.authenticationProvider(authenticationProvider());

	}

	/**

	 * 自动加载security-taglibs

	 * @return

	 */

	    @Bean

	    @ConditionalOnMissingBean(ClassPathTldsLoader.class)

	    public ClassPathTldsLoader classPathTldsLoader(){

	        return new ClassPathTldsLoader();

	    }

}

　　

5、在freemarker页面顶部引入标签

<#assign security=JspTaglibs["http://www.springframework.org/security/tags"] />

　　

使用标签

<@security.authorize access="hasRole('ADMIN')">

222

</@security.authorize>

　　

6.或者

<%@taglib uri="http://www.springframework.org/security/tags" prefix="sec"%>

<sec:authorize access="isAuthenticated()">

    <% response.sendRedirect("main"); %>

</sec:authorize>

　　

相关文章