基于SpringSecurity、Springboot的前后端权限管理

立即下载用AI写一个

发布时间：2019-08-26

58人 | 浏览：7415次 | 收藏 |

技术：jdk1.8+springboot2.1.6+SpringSecurity2.1.6+redis+vue

运行环境：jdk1.8+redis+mysql5.7+vue+idea+vscode

概述

基于SpringSecurity的Springboot项目，前后端分离。功能包括：字典管理、用户管理、角色管理、权限管理、token刷新等

详细

# SpringSecurity前后端分离项目

## 1-功能
* 1- 字典管理
* 2- 用户管理
* 3- 角色管理
* 4- 权限管理
* 5- 部门管理

动态权限配置

## 2-运行

### 1-后端项目运行

将 sql 目录下的jlazy.sql导入数据库

修改 application-dev.peroperties 配置文件

```xml
## mysql配置
spring.datasource.url=jdbc:p6spy:127.0.0.1：3306://localhost/jlazy?useSSL=false&useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull
spring.datasource.username=root
spring.datasource.password=root

## redis 配置
spring.redis.database=0
spring.redis.cluster.nodes=
# spring.redis.host=
# spring.redis.port=6379
spring.redis.password=123456
```
redis 如果是集群使用以下进行配置

```
spring.redis.cluster.nodes=
```

如果是单机使用以下进行配置

```
spring.redis.host=
spring.redis.port=6379
```

### 2-前端运行

进入前端项目界面，执行命令进行相关包安装

```
npm install
```

启动

```
npm run dev
```

## 3-效果图

登录页：http://localhost:8080/login

用户
名密码： admin/123456

![](/contentImages/image/20190825/muhZXNr2mMyRYu9tRam.png)

![](/contentImages/image/20190825/IzXXimTob00jqS3kxJI.png)

![](/contentImages/image/20190825/w5K6ZMxnHj0ritUd0yP.png)

![](/contentImages/image/20190825/KHapKkbqBr9UxKWp2x1.png)

![](/contentImages/image/20190825/Q3ze4dVexoRvPqJv5sC.png)

![](/contentImages/image/20190825/WIX35SinNmHUPocxuQM.png)

![](/contentImages/image/20190825/UQW09qq9dZJkmM2qjLS.png)

![](/contentImages/image/20190825/yk76NaUxSfz1rRxSH4Y.png)

## 4-主要逻辑代码

### dao 层

采用 mybatis-plus 进行CURD，这里注意了，采用了逻辑删除

```java
package com.ljaer.jlazy.mybatisplus;

import com.baomidou.mybatisplus.core.config.GlobalConfig;
import com.baomidou.mybatisplus.extension.plugins.PaginationInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.AutoConfigureAfter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.stereotype.Component;

@Configuration
public class MyBatisPlusConfig {

/**
     * 自动填充功能
     * @return
     */
    @Bean
    public GlobalConfig globalConfig() {
        GlobalConfig globalConfig = new GlobalConfig();
        globalConfig.setMetaObjectHandler(new MetaHandler());
        return globalConfig;
    }

/**
     * 分页插件
     */
    @Bean
    public PaginationInterceptor paginationInterceptor() {
        PaginationInterceptor paginationInterceptor = new PaginationInterceptor();
        // paginationInterceptor.setLimit(你的最大单页限制数量，默认 500 条，小于 0 如 -1 不受限制);
        return paginationInterceptor;
    }

}
```

### SpringSecurity 配置

核心配置

* 1- 密码比对采用了 BCryptPasswordEncoder ，该方式的好处是相同密码加密存储到数据库中的结果是不一样的。
* 2- 采用从数据库查询权限拦截的方式

```
// 查询数据库获取权限列表
        List<Permission> listPermission = iPermissionService.list();

for (Permission permission : listPermission) {
            if(StringUtils.isNotBlank(permission.getPath()) && StringUtils.isNotBlank(permission.getCode())){
                http.authorizeRequests().antMatchers(permission.getPath()).hasAuthority(permission.getCode());
            }
        }
```

```java
package com.ljaer.jlazy.security;

import com.ljaer.jlazy.entity.Permission;
import com.ljaer.jlazy.jwt.JWTAuthorizationFilter;
import com.ljaer.jlazy.service.IPermissionService;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

import java.util.List;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)  //  启用方法级别的权限认证
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
    private CustomUserDetailsService userDetailsService;

@Autowired
    private CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler;

@Autowired
    private CustomAuthenticationFailureHandler customAuthenticationFailureHandler;

@Autowired
    private AuthenticationProvider authenticationProvider;

@Autowired
    private IPermissionService iPermissionService;

@Value("${spring.security.login.page}")
    private String loginPage;

@Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

/*@Bean
    public static NoOpPasswordEncoder passwordEncoder() {
        return (NoOpPasswordEncoder) NoOpPasswordEncoder.getInstance();
    }*/

@Bean
    public static PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

@Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setUserDetailsService(userDetailsService);
        provider.setPasswordEncoder(passwordEncoder());
        return provider;
    }

@Override
    protected void configure(AuthenticationManagerBuilder auth) {
        auth.authenticationProvider(authenticationProvider);
    }

@Override
    protected void configure(HttpSecurity http) throws Exception {
        // 查询数据库获取权限列表
        List<Permission> listPermission = iPermissionService.list();

for (Permission permission : listPermission) {
            if(StringUtils.isNotBlank(permission.getPath()) && StringUtils.isNotBlank(permission.getCode())){
                http.authorizeRequests().antMatchers(permission.getPath()).hasAuthority(permission.getCode());
            }
        }

//开启跨域
        http.authorizeRequests()
                .antMatchers("/login").permitAll()
                .antMatchers("/logout").permitAll()
                .anyRequest().authenticated()
                .and().formLogin()
                .successHandler(customAuthenticationSuccessHandler)
                .failureHandler(customAuthenticationFailureHandler)
                .and()
                .addFilter(new JWTAuthorizationFilter(authenticationManager()))
                // 不需要session
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                // 关闭CSRF跨域
                .and().cors().and().csrf().disable()
                //添加自定义异常入口，处理accessdeine异常
                .exceptionHandling().authenticationEntryPoint(new CustomAuthenticationEntryPoint())
                .accessDeniedHandler(new CustomAccessDeineHandler());
    }

@Override
    public void configure(WebSecurity web) {
        // 设置拦截忽略文件夹，可以对静态资源放行
        web.ignoring().antMatchers("/css/**", "/js/**");
    }

@Bean
    CorsConfigurationSource corsConfigurationSource() {
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
        return source;
    }

}
```

自定义认证过的用户访问无权限资源时的异常

```java
package com.ljaer.jlazy.security;

import com.ljaer.jlazy.utils.http.Result;
import com.ljaer.jlazy.utils.http.ResultUtils;
import com.ljaer.jlazy.utils.json.FastJsonUtil;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * 认证过的用户访问无权限资源时的异常
 */
public class CustomAccessDeineHandler implements AccessDeniedHandler {

@Override
    public void handle(HttpServletRequest request, HttpServletResponse response,
                       AccessDeniedException accessDeniedException) throws IOException{
        Result result = ResultUtils.errorResult("权限不足");
        response.setContentType("application/json;charset=utf-8");
        response.getWriter().write(FastJsonUtil.obj2json(result));
        response.getWriter().close();
    }

}
```

自定义匿名用户访问无权限资源时的异常

```java
package com.ljaer.jlazy.security;

import com.ljaer.jlazy.utils.exception.BusinessException;
import com.ljaer.jlazy.utils.http.Result;
import com.ljaer.jlazy.utils.http.ResultUtils;
import com.ljaer.jlazy.utils.json.FastJsonUtil;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * 匿名用户访问无权限资源时的异常
 */
public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint {

@Override
    public void commence(HttpServletRequest request, HttpServletResponse response,
                         AuthenticationException authException) throws IOException{
        Result result = ResultUtils.errorResult(1004,"用户未登陆");
        response.setContentType("application/json;charset=utf-8");
        response.getWriter().write(FastJsonUtil.obj2json(result));
        response.getWriter().close();
    }

}
```

自定义登陆失败处理逻辑

```java
package com.ljaer.jlazy.security;

import com.ljaer.jlazy.utils.http.Result;
import com.ljaer.jlazy.utils.http.ResultUtils;
import com.ljaer.jlazy.utils.json.FastJsonUtil;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.stereotype.Component;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * 自定义登陆失败处理逻辑
 */
@Component
public class CustomAuthenticationFailureHandler implements AuthenticationFailureHandler {

@Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        Result result = ResultUtils.errorResult("用户名或密码错误");
        response.setContentType("application/json;charset=utf-8");
        response.getWriter().write(FastJsonUtil.obj2json(result));
        response.getWriter().close();
    }
}
```

自定义登陆成功后处理逻辑

```java
package com.ljaer.jlazy.security;

import com.alibaba.fastjson.JSONObject;
import com.ljaer.jlazy.entity.User;
import com.ljaer.jlazy.jwt.JwtService;
import com.ljaer.jlazy.utils.http.Result;
import com.ljaer.jlazy.utils.http.ResultUtils;
import com.ljaer.jlazy.utils.json.FastJsonUtil;
import com.ljaer.jlazy.utils.redis.RedisUtil;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.stereotype.Component;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * 自定义登陆成功后处理逻辑
 */
@Component
public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

@Autowired
    private RedisUtil redisUtil;

@Autowired
    private JwtService jwtService;

/**
     * @param request
     * @param response
     * @param authentication ：代表认证成功后的信息
     * @throws IOException
     * @throws ServletException
     */
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        User user = (User) authentication.getPrincipal();
        //生成token
        JSONObject json = new JSONObject();
        String uuid = jwtService.generatorToken(user);
        json.put("access_token", uuid);
        Result result = ResultUtils.objectResult(json);
        response.setContentType("application/json;charset=utf-8");
        response.getWriter().write(FastJsonUtil.obj2json(result));
        response.getWriter().close();
    }
}
```

自定义userDetailsService

```java
package com.ljaer.jlazy.security;

import com.ljaer.jlazy.entity.Permission;
import com.ljaer.jlazy.entity.User;
import com.ljaer.jlazy.service.IPermissionService;
import com.ljaer.jlazy.service.IRoleService;
import com.ljaer.jlazy.service.IUserRoleService;
import com.ljaer.jlazy.service.IUserService;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import java.util.ArrayList;
import java.util.List;

/**
 * 自定义userDetailsService
 *
 * @author LJaer
 * @since 2019-08-05
 */
@Service("userDetailsService")
public class CustomUserDetailsService implements UserDetailsService {
    @Autowired
    private IUserService iUserService;

@Autowired
    private IRoleService iRoleService;

@Autowired
    private IUserRoleService iUserRoleService;

@Autowired
    private IPermissionService iPermissionService;

@Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 从数据库中取出用户信息
        User user = iUserService.selectByName(username);

// 判断用户是否存在
        if (user == null) {
            throw new UsernameNotFoundException("用户名不存在");
        }

List<Permission> permissions = iPermissionService.getPerByUserId(user.getId());

//authorities：存放所有用户权限
        List<GrantedAuthority> authorities = new ArrayList<>();

for (Permission perm : permissions) {
            if(StringUtils.isNotBlank(perm.getCode())){
                GrantedAuthority authority = new SimpleGrantedAuthority(perm.getCode());
                authorities.add(authority);
            }
        }
        //把所有权限赋值给user
        user.setAuthorities(authorities);

// 返回UserDetails实现类
        return user;
    }
}
```

### jwt 配置

```java
package com.ljaer.jlazy.jwt;

import com.ljaer.jlazy.entity.User;
import com.ljaer.jlazy.utils.exception.BusinessException;
import com.ljaer.jlazy.utils.http.Result;
import com.ljaer.jlazy.utils.http.ResultUtils;
import com.ljaer.jlazy.utils.json.FastJsonUtil;
import com.ljaer.jlazy.utils.spring.SpringUtil;
import org.apache.commons.lang3.StringUtils;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.stereotype.Component;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@Component
public class JWTAuthorizationFilter extends BasicAuthenticationFilter {

public JWTAuthorizationFilter(AuthenticationManager authenticationManager) {
        super(authenticationManager);
    }

@Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain) throws IOException, ServletException {

String tokenUuid = request.getHeader("access_token");
        // 如果请求头中没有token信息则直接放行了
        if (tokenUuid == null) {
            chain.doFilter(request, response);
            return;
        }
        // 如果请求头中有token，则进行解析，并且设置认证信息
        JwtService jwtService = (JwtService) SpringUtil.getBean("jwtService");
        String token = null;
        try {
            token = jwtService.getTokenFromTokenUuid(tokenUuid);
            if (!StringUtils.isNotBlank(token)) {
                chain.doFilter(request, response);
                return;
            }
            SecurityContextHolder.getContext().setAuthentication(getAuthentication(token));
            super.doFilterInternal(request, response, chain);
        } catch (BusinessException e) {
            Result result = ResultUtils.errorResult(Integer.valueOf(e.getErrorCode()), e.getMessage());
            response.setContentType("application/json;charset=utf-8");
            response.getWriter().write(FastJsonUtil.obj2json(result));
            response.getWriter().close();
        }
    }

// 这里从token中获取用户信息
    private Authentication getAuthentication(String token) throws BusinessException {
        User user = JwtTokenUtils.getInfoFromToken(token);
        return new UsernamePasswordAuthenticationToken(user.getUsername(), null, user.getAuthorities());
    }
}
```

token刷新以及存储

```java
package com.ljaer.jlazy.jwt;

import com.ljaer.jlazy.constant.RedisKeyConstant;
import com.ljaer.jlazy.entity.User;
import com.ljaer.jlazy.utils.exception.BusinessException;
import com.ljaer.jlazy.utils.json.FastJsonUtil;
import com.ljaer.jlazy.utils.redis.RedisUtil;
import com.ljaer.jlazy.utils.spring.SpringUtil;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;

import java.text.MessageFormat;
import java.util.UUID;

@Service
public class JwtService {

@Value("${jwt.client.expire}")
    private Integer tokenExpireTime;

@Autowired
    private RedisUtil redisUtil;

/**
     * 此处使用uuid代替大长串token
     * 第一次生成token时生成uuid，后面更新
     * 利于刷新token
     * @param user
     * @return 返回 tokenUuid
     */
    public String generatorToken(User user){
        String token = JwtTokenUtils.generateToken(user);
        String uuid = UUID.randomUUID().toString().replace("-", "");
        setRedisToken(uuid,token);
        return uuid;
    }

/**
     * 从tokenuuid获取token
     * 并判断是否刷新token
     * @param tokenUuid
     * @return token
     */
    public String getTokenFromTokenUuid(String tokenUuid) throws BusinessException {
        String tokenKey = getRedisTokenKey(tokenUuid);
        RedisUtil redisUtil = (RedisUtil) SpringUtil.getBean("redisUtil");
        String token = (String) redisUtil.get(tokenKey);
        if(null==token){
            return null;
        }
        //刷新token
        boolean shouldRefresh = JwtTokenUtils.shouldTokenRefresh(JwtTokenUtils.getIssuedAt(token));
        if(shouldRefresh){
            //刷新token，刷新redis过期时间
            User user = JwtTokenUtils.getInfoFromToken(token);
            token = generatorToken(user);
            setRedisToken(tokenUuid,token);
        }
        return token;
    }

/**
     * 获取 redis 存储的 token key
     * @param tokenUuid
     * @return
     */
    public String getRedisTokenKey(String tokenUuid){
        String tokenKey = MessageFormat.format(RedisKeyConstant.USER_TOKEN_KEY, tokenUuid);
        return tokenKey;
    }

/**
     * 设置 redis 的 token
     * @param tokenUuid
     * @param token
     */
    public void setRedisToken(String tokenUuid,String token){
        String tokenKey = getRedisTokenKey(tokenUuid);
        redisUtil.set(tokenKey, token, tokenExpireTime*2);
    }
}
```

本实例支付的费用只是购买源码的费用，如有疑问欢迎在文末留言交流，如需作者在线代码指导、定制等，在作者开启付费服务后，可以点击“购买服务”进行实时联系，请知悉，谢谢

感谢

手机上随时阅读、收藏该文章？请扫下方二维码

基于SpringSecurity、Springboot的前后端权限管理

概述

详细

相似例子推荐

评论

作者

评分详细

作者例子