SpringSecurity请求授权规则配置与注解详解

protected void configure(HttpSecurity http) throws Exception {
     this.logger.debug("Using default configure(HttpSecurity). If subclassed this will potentially override subclass configure(HttpSecurity).");
     ((HttpSecurity)((HttpSecurity)((AuthorizedUrl)http.
	     authorizeRequests()
	     .anyRequest())
	     .authenticated()
	     .and())
	     .formLogin()
	     .and())
	     .httpBasic();
 }

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.formLogin()
            .loginPage("/login.html") //登录页面
            .loginProcessingUrl("/user/login") // 默认处理登录的请求
            .successForwardUrl("/success")  //登录成功后跳转到哪个URL
            .defaultSuccessUrl("/index",true)// 登录成功后跳转路径
            .failureForwardUrl("/fail") //登录失败后跳转到哪个URL
            .permitAll();

}

.usernameParameter("userName")  //自定义获取用户登录名
.passwordParameter("password")  //自定义获取用户登录密码

 http.authorizeRequests()
               .antMatchers("/static/**","/images/**","/css/**","/js/**")//可以直接放行
               .permitAll()//匹配上述请求的直接放行
               .anyRequest().authenticated();//其他请求都需要认证

http.authorizeRequests()
     .antMatchers("/static/**","/images/**","/css/**","/js/**")//可以直接放行
     .permitAll()
     .antMatchers("/findAll").hasAuthority("admin") // 用户访问findAll 必须有 admin 权限
     .anyRequest().authenticated();//其他请求都需要认证

http.authorizeRequests()
    .antMatchers("/static/**","/images/**","/css/**","/js/**")//可以直接放行
    .permitAll()
    .antMatchers("/findAll").hasAuthority("admin") // 用户访问findAll 必须有 admin 权限
    .antMatchers("/find").hasAnyAuthority("admin","sale") // 用户访问 find ,拥有admin或者sale之一即可
    .anyRequest().authenticated();//其他请求都需要认证

http.authorizeRequests()
     .antMatchers("/static/**","/images/**","/css/**","/js/**")//可以直接放行
     .permitAll()
     .antMatchers("/findAll").hasAuthority("admin") // 用户访问findAll 必须有 admin 权限
     .antMatchers("/find").hasAnyAuthority("admin","sale") // 用户访问 find ,拥有admin或者sale之一即可
     .antMatchers("/sale/**").hasRole("sale") // 需要用户具有sale角色
     .anyRequest().authenticated();//其他请求都需要认证

http.authorizeRequests()
     .antMatchers("/static/**","/images/**","/css/**","/js/**")//可以直接放行
     .permitAll()
     .antMatchers("/findAll").hasAuthority("admin") // 用户访问findAll 必须有 admin 权限
     .antMatchers("/find").hasAnyAuthority("admin","sale") // 用户访问 find ,拥有admin或者sale之一即可
     .antMatchers("/sale/**").hasRole("sale") // 需要用户具有sale角色
     .antMatchers("/product/**").hasAnyRole("admin","product") //用户具有admin或者product角色之一即可
     .anyRequest().authenticated();//其他请求都需要认证

 http.exceptionHandling().accessDeniedPage("/unauth.html");

http.logout().logoutUrl("/logout")  //退出登录请求
			.logoutSuccessUrl("/index") //注销成功后跳转地址
			.permitAll();

.deleteCookies("remember-me","sign")
.invalidateHttpSession(true)

@SpringBootApplication
@MapperScan("com.jane.mapper")
@EnableGlobalMethodSecurity(securedEnabled=true,prePostEnabled = true)
public class Securitydemo1Application {
    public static void main(String[] args) {
        SpringApplication.run(Securitydemo1Application.class, args);
    }
}

// 测试注解： 
@RequestMapping("testSecured") 
@ResponseBody 
@Secured({"ROLE_normal","ROLE_admin"}) 
public String helloUser() { 
	return "hello,user"; 
}

@RequestMapping("/preAuthorize") 
@ResponseBody 
//@PreAuthorize("hasRole('ROLE_admin')") 
@PreAuthorize("hasAnyAuthority('menu:system')") 
public String preAuthorize(){ 
	System.out.println("preAuthorize"); 
	return "preAuthorize"; 
}

@RequestMapping("/testPostAuthorize") 
@ResponseBody 
@PostAuthorize("hasAnyAuthority('menu:system')") 
public String preAuthorize(){ 
	System.out.println("test--PostAuthorize"); 
	return "PostAuthorize"; 
}

@RequestMapping("getAll") 
@PreAuthorize("hasRole('ROLE_admin')") 
@PostFilter("filterObject.username == 'admin1'") 
@ResponseBody public List<UserInfo> getAllUser(){ 
	ArrayList<UserInfo> list = new ArrayList<>(); 
	list.add(new UserInfo(1l,"admin1","6666")); 
	list.add(new UserInfo(2l,"admin2","888")); 
	return list; 
}

@RequestMapping("getTestPreFilter") 
@PreAuthorize("hasRole('ROLE_admin')") 
@PreFilter(value = "filterObject.id%2==0") 
@ResponseBody public List<UserInfo> getTestPreFilter(@RequestBody List<UserInfo> list){ 
	list.forEach(t-> { System.out.println(t.getId()+"\t"+t.getUsername()); }); 
	return list; 
}