Java框架之SpringSecurity-权限系统

    <!-- 安全框架中的jar包 -->
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
      <version>4.2.10.RELEASE</version>
    <https://img.qb5200.com/download-x/dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
      <version>4.2.10.RELEASE</version>
    <https://img.qb5200.com/download-x/dependency>
    <!-- 标签库 -->
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-taglibs</artifactId>
      <version>4.2.10.RELEASE</version>
    <https://img.qb5200.com/download-x/dependency>

  <!-- 核心控制器，注意需将spring及springmvc配置文件都由Web容器装载 -->
  <servlet>
    <servlet-name>springDispatcherServlet</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>
        classpath*:/spring/springmvc.xml
        classpath*:/spring/spring-*.xml
      </param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
  </servlet>
<!--代理管理所有 SpringSecurity 过滤器-->
  <filter>
    <filter-name>springSecurityFilterChain</filter-name><!--名称固定,不能变-->
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

/**
 * @Configuration   管理程序中的组件(扫描)
 * @EnableWebSecurity   安全框架支持注解的形式             基础注解
 * @EnableGlobalMethodSecurity　开启使用表达式方法验证安全性
 */
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class AppWebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override    //认证
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    }
    @Override    //授权
    protected void configure(HttpSecurity http) throws Exception {
    }
}

    @Autowired
    private UserDetailsService  userDetailsService;
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //从数据库中查询数据        
    　　auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder());
    }

    @Autowired //用户
    private TAdminMapper adminMapper;
    @Autowired //角色
    private TRoleMapper roleMapper;
    @Autowired //权限
    private TPermissionMapper permissionMapper;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        TAdminExample example = new TAdminExample();
        TAdminExample.Criteria criteria = example.createCriteria();
        criteria.andLoginacctEqualTo(username);
        List<TAdmin> admins = adminMapper.selectByExample(example);
        //从数据库中查出该用户
        TAdmin admin = admins.get(0);
        //该集合用来存放角色和权限
        HashSet<GrantedAuthority> authorities = new HashSet<>();
        //从数据库中查出该用户所对应的角色
        List<TRole> roles = roleMapper.listRole(admin.getId());
        //从数据库中查出该用户所对应的权限
        List<TPermission> permissions = permissionMapper.listPermission(admin.getId());
        //分别将角色和权限添加到 authorities 集合中
        for (TRole role : roles) {
            String name = role.getName();
            authorities.add(new SimpleGrantedAuthority("ROLE_" + name));//注意角色需加上 "ROLE_"
        }
        permissions.forEach((p) -> {
            String name = p.getName();
            authorities.add(new SimpleGrantedAuthority(name));
        });
        //通过该用户名和密码以及权限集合创建User对象并返回
        User user = new User(admin.getLoginacct().toString(), admin.getUserpswd().toString(), authorities);
        return user;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //基于httpRequest对指定antMatchers资源permitAll放行,对于其他请求anyRequest必须通过认证authenticated
        http.authorizeRequests().antMatchers("/welcome.jsp","/static/**")
                .permitAll().anyRequest().authenticated();
        //跳转到默认登录界面
        http.formLogin().loginPage("/welcome.jsp");
        //登录时指定的控制器/login,并验证用户名和密码,成功验证后跳转到控制器/main
        http.formLogin().loginProcessingUrl("/login")
                .usernameParameter("loginacct")
                .passwordParameter("userpswd")
                .defaultSuccessUrl("/main");
        //取消csrf令牌值验证
        http.csrf().disable();
        //退出时指定的控制器,并指定成功退出后登录界面
        http.logout().logoutUrl("/exit").logoutSuccessUrl("/welcome.jsp");
        //记住我功能.需在前端复选框中指定 value 值为 remember-me
        http.rememberMe();
        //自定义的异常处理器
        http.exceptionHandling().accessDeniedHandler(new AccessDeniedHandler() {
            @Override
            public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
                //判断是否为异步请求
                if("XMLHttpRequest".equals(request.getHeader("X-Requested-With"))){
                    response.getWriter().write("403");
                }else {
                    request.setAttribute("msg",accessDeniedException.getMessage());
                    request.getRequestDispatcher("/WEB-INF/views/unauth.jsp")
                            .forward(request,response);
                }
            }
        });
    }

<%@taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
 　<sec:authentication property="name"/> //在需要位置显示用户登录名, 属性 property 必须是 name
   <sec:authorize access="hasRole('PM - 项目经理')">//非此角色用户隐藏下面的标签
       <button type="button" id="deleteBath" class="btn btn-danger" style="float:right;margin-left:10px;">删除</button>
   </sec:authorize>