Spring Security 权限控制与认证流程 (全网最权威教程)

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity // 启用Spring Security的Web安全功能
public class SecurityConfig {

    // 1. 配置密码编码器
    @Bean
    public PasswordEncoder passwordEncoder() {
        // BCrypt 是目前推荐的密码哈希算法
        return new BCryptPasswordEncoder();
    }

    // 2. 配置用户详情服务 (这里使用内存用户，实际应用会连接数据库)
    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
        UserDetails user = User.withUsername("user")
                .password(passwordEncoder.encode("password")) // 密码需要编码
                .roles("USER") // 赋予USER角色
                .build();

        UserDetails admin = User.withUsername("admin")
                .password(passwordEncoder.encode("adminpass"))
                .roles("ADMIN", "USER") // 赋予ADMIN和USER角色
                .build();

        return new InMemoryUserDetailsManager(user, admin);
    }

    // 3. 配置安全过滤器链
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/public/**").permitAll() // 允许所有用户访问 /public/** 路径
                .requestMatchers("/admin/**").hasRole("ADMIN") // 只有ADMIN角色可以访问 /admin/**
                .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN") // USER或ADMIN角色可以访问 /user/**
                .anyRequest().authenticated() // 其他所有请求都需要认证
            )
            .formLogin(form -> form
                .loginPage("/login") // 自定义登录页面的URL
                .defaultSuccessUrl("/dashboard", true) // 登录成功后跳转的URL，true表示总是跳转
                .permitAll() // 登录相关的页面和请求允许所有用户访问
            )
            .logout(logout -> logout
                .logoutUrl("/logout") // 登出URL
                .logoutSuccessUrl("/login?logout") // 登出成功后跳转的URL
                .permitAll()
            )
            .csrf(csrf -> csrf.disable()); // 禁用CSRF保护，仅为简化示例，生产环境不推荐

        return http.build();
    }
}

import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;

// 假设这是一个用户仓库接口
interface UserRepository {
    // 模拟从数据库查找用户
    UserEntity findByUsername(String username);
}

// 模拟用户实体
class UserEntity {
    private String username;
    private String password; // 存储的是BCrypt加密后的密码
    private List<String> roles; // 例如 "ROLE_ADMIN", "ROLE_USER"

    // 构造函数、getter、setter省略
    public UserEntity(String username, String password, String... roles) {
        this.username = username;
        this.password = password;
        this.roles = Arrays.asList(roles);
    }

    public String getUsername() { return username; }
    public String getPassword() { return password; }
    public List<String> getRoles() { return roles; }
}


@Service // 标记为Spring组件
public class MyUserDetailsService implements UserDetailsService {

    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder; // 注入密码编码器

    public MyUserDetailsService(UserRepository userRepository, PasswordEncoder passwordEncoder) {
        this.userRepository = userRepository;
        this.passwordEncoder = passwordEncoder;
        // 实际项目中，userRepository 会通过Spring Data JPA等注入
        // 这里简单模拟一个用户
        // 生产环境不应该这样初始化用户，应该通过注册等方式
        if (this.userRepository instanceof MockUserRepository) {
            ((MockUserRepository) this.userRepository).addUser(
                new UserEntity("dev", passwordEncoder.encode("devpass"), "ROLE_DEVELOPER", "ROLE_USER"),
                new UserEntity("manager", passwordEncoder.encode("mgrpass"), "ROLE_MANAGER")
            );
        }
    }

    // 模拟一个简单的UserRepository实现
    @Service
    static class MockUserRepository implements UserRepository {
        private final List<UserEntity> users = new ArrayList<>();

        public void addUser(UserEntity... userEntities) {
            users.addAll(Arrays.asList(userEntities));
        }

        @Override
        public UserEntity findByUsername(String username) {
            return users.stream()
                        .filter(u -> u.getUsername().equals(username))
                        .findFirst()
                        .orElse(null);
        }
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        UserEntity userEntity = userRepository.findByUsername(username);

        if (userEntity == null) {
            throw new UsernameNotFoundException("用户 '" + username + "' 未找到");
        }

        // 构建Spring Security的UserDetails对象
        // 注意：这里的roles需要转换为GrantedAuthority
        return User.builder()
                .username(userEntity.getUsername())
                .password(userEntity.getPassword()) // 数据库中已加密的密码
                .roles(userEntity.getRoles().toArray(new String[0])) // 传入角色名
                .build();
    }
}

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; // 5.6+

@SpringBootApplication
@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true) // 启用方法安全
public class YourApplication {
    public static void main(String[] args) {
        SpringApplication.run(YourApplication.class, args);
    }
}

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;

@Service
public class ProductService {

    @PreAuthorize("hasRole('ADMIN')")
    public String createProduct(String productName) {
        // 只有管理员才能创建产品
        return "Product '" + productName + "' created by Admin.";
    }

    @PreAuthorize("hasAuthority('product:read') or hasRole('MANAGER')")
    public String getProductDetails(Long productId) {
        // 拥有 'product:read' 权限或 MANAGER 角色才能查看产品详情
        return "Details for product ID: " + productId;
    }

    @PreAuthorize("#ownerId == authentication.principal.id")
    public String updateProduct(Long productId, Long ownerId, String newName) {
        // 只有产品所有者才能更新产品
        // 假设 authentication.principal 是你的自定义 UserDetails 实例，其中有getId()方法
        return "Product " + productId + " updated by owner " + ownerId + " to " + newName;
    }
}

# application.properties
logging.level.org.springframework.security=DEBUG

# application.yml
logging:
  level:
    org.springframework.security: DEBUG