springSecurity用户认证和授权的实现

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

package com.demo.config;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

@EnableWebSecurity
public class Security extends WebSecurityConfiguration {
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/public/**").permitAll() // 允许访问公开路径
                .antMatchers("/public/index").hasRole("vip") // 需要指定用户在可以使用
                .antMatchers("/admin/**").hasRole("admin") // 需要指定用户在可以使用
                .anyRequest().authenticated() // 其他请求需要认证
                .and()
                .formLogin() // 使用表单登录
                .loginPage("/login") // 指定登录页面
                .permitAll() // 允许所有用户访问登录页面
                .and()
                .logout() // 配置注销
                .logoutUrl("/logout") // 注销路径
                .logoutSuccessUrl("/login?logout") // 注销成功后跳转的页面
                .permitAll();

    }
    //缓存中
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                //添加  名字为 admin  密码 为 admin123 的用户 基于权限 ADMIN
                .withUser("admin").password("admin123").roles("ADMIN")
                .and()
                .withUser("user").password("user123").roles("USER");
    }
    //从数据库中
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 从数据库或其他数据源加载用户信息
        // 这里简单起见，直接使用内存中的用户信息
        if ("admin".equals(username)) {
            return org.springframework.security.core.userdetails.User.builder()
                    .username("admin")
                    .password("{noop}admin") // {noop}表示不加密，实际项目中应该使用加密的密码
                    .roles("ADMIN")
                    .build();
        } else if ("user".equals(username)) {
            return org.springframework.security.core.userdetails.User.builder()
                    .username("user")
                    .password("{noop}user")
                    .roles("USER")
                    .build();
        } else {
            throw new UsernameNotFoundException("User not found");
        }
    }
}

import org.springframework.security.access.annotation.Secured;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;

@Controller
public class MyController {

    @GetMapping("/user")
    @Secured("ROLE_USER") // 要求用户具有ROLE_USER角色才能访问
    public String userPage() {
        return "user";
    }
}

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;

@Controller
public class MyController {

    @GetMapping("/admin")
    @PreAuthorize("hasRole('ADMIN')") // 要求用户具有ROLE_ADMIN角色才能访问
    public String adminPage() {
        return "admin";
    }

    @GetMapping("/user")
    @PreAuthorize("hasRole('USER')") // 要求用户具有ROLE_USER角色才能访问
    public String userPage() {
        return "user";
    }
}