springsecurity轻松实现角色权限的示例代码

CREATE TABLE `user` (
 `Id` int NOT NULL AUTO_INCREMENT,
 `UserName` varchar(255) NOT NULL,
 `CreatedDT` datetime DEFAULT NULL,
 `Age` int DEFAULT NULL,
 `Gender` int DEFAULT NULL,
 `Password` varchar(255) NOT NULL,
 PRIMARY KEY (`Id`)
) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8;

CREATE TABLE `role` (
 `Id` int NOT NULL AUTO_INCREMENT,
 `UserId` int DEFAULT NULL,
 `Role` varchar(255) DEFAULT NULL,
 `CreatedDT` datetime DEFAULT NULL,
 PRIMARY KEY (`Id`)
) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8;

   
      org.projectlombok
      lombok
      true
    
    
    
      org.springframework.boot
      spring-boot-starter-security
    
    
    
      cn.hutool
      hutool-all
      4.5.7
    

@Data 
public class User implements UserDetails { 
​ 
 public User() { 
 } 
​ 
 private static final long serialVersionUID = 1L; 
  
 private Integer id; 
​ 
 private String userName; 
​ 
 private Date createdDT; 
​ 
 private Integer age; 
​ 
 private Integer gender; 
​ 
 private String passWord; 
​ 
 private String role; 
​ 
 private List authorities; 
​ 
 public User(String userName, String passWord, List authorities) { 
 this.userName = userName; 
 this.passWord = passWord; 
 this.authorities = authorities; 
 } 
​ 
 @Override 
 public Collection<? extends GrantedAuthority> getAuthorities() { 
 return authorities; 
 } 
​ 
 @Override 
 public String getPassword() { 
 return this.passWord; 
 } 
​ 
 @Override 
 public String getUsername() { 
 return this.userName; 
 } 
​ 
 @Override 
 public boolean isAccountNonExpired() { 
 return true; 
 } 
​ 
 @Override 
 public boolean isAccountNonLocked() { 
 return true; 
 } 
​ 
 @Override 
 public boolean isCredentialsNonExpired() { 
 return true; 
 } 
​ 
 @Override 
 public boolean isEnabled() { 
 return true; 
 } 
} 

@Data 
public class Role implements Serializable { 
 private Integer id; 
​ 
 private String role; 
​ 
 private Date createdDT; 
​ 
 private Integer userId; 
} 

@Mapper 
public interface UserMapper{ 
 User selectOneByName(User user); 
}

public interface UserService{ 
 User selectOneByName(User user) throws ServiceException; 
}

@Service 
public class UserServiceImpl implements UserService { 
 @Autowired 
 private UserMapper mapper; 
​ 
 @Override 
 public User selectOneByName(User user) throws ServiceException { 
 return mapper.selectOneByName(user); 
 } 
}

<?xml version="1.0" encoding="UTF-8"?> 
 
 
  
  
  
  
  
  
  
  
​ 
  
 Id, UserName, CreatedDT, Age, Gender,Password 
  
  
  
 SELECT u.*,r.role FROM `user` u LEFT JOIN role r on u.Id = r.UserId 
 where u.UserName = #{userName,jdbcType=VARCHAR} 
  
​ 
 

@Component 
public class CustomUserDetailsService implements UserDetailsService { 
 @Autowired 
 private UserService userService; 
​ 
 @Autowired 
 private HttpServletRequest request; 
​ 
 @Override 
 public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { 
 // 通过用户名从数据库获取用户信息 
 User user = userService.selectOneByName(new User(){ 
 { 
 setUserName(username); 
 } 
 }); 
 if (user == null) { 
 throw new UsernameNotFoundException("用户不存在"); 
 } 
​ 
 HttpSession session = request.getSession(); 
 session.setAttribute(session.getId(),user); 
​ 
 // 得到用户角色 
 String role = user.getRole(); 
​ 
 // 角色集合 
 List authorities = new ArrayList<>(); 
 // 角色必须以`ROLE_`开头，数据库中没有，则在这里加 
 authorities.add(new SimpleGrantedAuthority("ROLE_" + role)); 
​ 
 return new User( 
 user.getUsername(), 
 user.getPassword(), 
 authorities 
 ); 
 } 
}

@Component 
public class MyAccessDeniedHandler implements AccessDeniedHandler { 
 @Override 
 public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException { 
 response.setCharacterEncoding("UTF-8"); 
 response.setContentType("application/json"); 
 response.getWriter().println("{'code':'403','message':'没有访问权限'}"); 
 response.getWriter().flush(); 
 } 
}

@EnableWebSecurity 
@EnableGlobalMethodSecurity(prePostEnabled = true) 
public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 
 @Autowired 
 private CustomUserDetailsService userDatailService; 
​ 
 @Autowired 
 private MyAccessDeniedHandler accessDeniedHandler; 
​ 
 @Bean 
 public PasswordEncoder passwordEncoder(){ 
 return new BCryptPasswordEncoder(); 
 } 
​ 
 @Override 
 protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
 auth 
 .userDetailsService(userDatailService) 
 .passwordEncoder(passwordEncoder()); 
 } 
​ 
​ 
 @Override 
 protected void configure(HttpSecurity http) throws Exception { 
 http 
 .headers().frameOptions().disable() 
 .and() 
 .authorizeRequests() 
 .antMatchers("不限制访问的路径，如：'/user/*'").permitAll() 
 .antMatchers("用户拥有规定角色才允许访问的路径，如：'/user/delte'").hasRole("admin") 
 .antMatchers("规定ip才允许访问的路径，如：'/*'").hasIpAddress("192.168.1.1/24"); 
 .anyRequest().authenticated() // 所有请求都需要验证 
 .and() 
 // 跳转自定义成功页 
 .formLogin().defaultSuccessUrl("/html/index.html") 
 .and() 
 .exceptionHandling() 
 //用户无权限访问链接，给出友好提示 
 .accessDeniedHandler(accessDeniedHandler) 
 .and() 
 .csrf().disable();// post请求要关闭csrf验证,不然访问报错；实际开发中要开启。 
 } 
}

 @PreAuthorize("hasRole('admin')") 
 @RequestMapping(value = "/delete") 
 public CommonResult delete(@RequestBody int id) { 
   int i = userService.delete(new User() { 
   { 
    setId(id); 
   } 
   }); 
   return i > 0 ? processSuccess("删除成功") : processFailure("删除失败"); 
 }