SpringBoot Web开发

import org.springframework.web.servlet.HandlerInterceptor;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class LoginHandlerInterceptor implements HandlerInterceptor {
  @Override
  public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

    //登录成功 有用户的session
    Object loginUser = request.getSession().getAttribute("loginUser");
    //没有登录
    if (loginUser==null){ 
      request.setAttribute("msg","没有权限，请先登录");
      request.getRequestDispatcher("/index.html").forward(request,response);
      return false;
    }else {
      return true;
    }
  }
}

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
//@Configuration标注在类上，相当于把该类作为spring的xml配置文件中的<beans>，作用为：配置spring容器(应用上下文)
@Configuration  
public class MyMvcConfig implements WebMvcConfigurer {

  @Override
  public void addInterceptors(InterceptorRegistry registry) {
    registry.addInterceptor(new LoginHandlerInterceptor());
  }
}

registry.addInterceptor(new LoginHandlerInterceptor())
        .addPathPatterns("/**")
        .excludePathPatterns("/index.html","/","/user/login");

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;


@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
  //链式编程
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    //首页所有人可以访问 ,功能也只有对应有权限的人才能反应

    //请求授权的规则
    http.authorizeRequests().antMatchers("/").permitAll()
      .antMatchers("/level1/**").hasRole("vip1")
      .antMatchers("/level2/**").hasRole("vip2")
      .antMatchers("/level3/**").hasRole("vip3");

    //没有权限默认到登录页面   需要开启登录的页面
    http.formLogin().loginPage("/toLogin");

    //防止网站攻击  get post
    //http.csrf().disable();  //关闭请求跨站攻击

    //注销 注销完成跳转到首页
    http.logout().logoutSuccessUrl("/");

    //开启记住我功能  cookie 自定义接收前端的参数
    http.rememberMe().rememberMeParameter("remember");
  }

  //认证
  //密码编码：passwordEncoder
  //springSecurity 5.0+ 新增了很多加密方法
  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
      .withUser("bobo").password(new BCryptPasswordEncoder().encode("123456")).roles("vip2","vip3")
      .and()
      .withUser("root").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2","vip3")
      .and()
      .withUser("guest").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1");
  }
}

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.*;
import org.apache.shiro.ini.IniSecurityManagerFactory;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.lang.util.Factory;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;


/**
 * Simple Quickstart application showing how to use Shiro's API.
 *
 * @since 0.9 RC2
 */
public class Quickstart {

  private static final transient Logger log = LoggerFactory.getLogger(Quickstart.class);

  public static void main(String[] args) {
    
    
    Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
    SecurityManager securityManager = factory.getInstance();
    SecurityUtils.setSecurityManager(securityManager);

    // get the currently executing user:
    //获取当前的用户对象：Subject
    Subject currentUser = SecurityUtils.getSubject();

    //通过当前对象拿到Session
    Session session = currentUser.getSession();
    
    session.setAttribute("someKey", "aValue");
    String value = (String) session.getAttribute("someKey");
    if (value.equals("aValue")) {
      log.info("Retrieved the correct value! [" + value + "]");
    }

    // 测试当前用户是否被认证
    if (!currentUser.isAuthenticated()) {
      
      //Token 令牌
      UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");
      //设置记住我
      token.setRememberMe(true);
      try {
        //执行登陆操作
        currentUser.login(token);
      } catch (UnknownAccountException uae) {
        log.info("There is no user with username of " + token.getPrincipal());
      } catch (IncorrectCredentialsException ice) {
        log.info("Password for account " + token.getPrincipal() + " was incorrect!");
      } catch (LockedAccountException lae) {
        log.info("The account for username " + token.getPrincipal() + " is locked.  " +
                 "Please contact your administrator to unlock it.");
      }
      // ... catch more exceptions here (maybe custom ones specific to your application?
      catch (AuthenticationException ae) {
        //认证异常
        //unexpected condition?  error?
      }
    }

    //say who they are:
    //print their identifying principal (in this case, a username):
    log.info("User [" + currentUser.getPrincipal() + "] logged in successfully.");

    //test a role:
    if (currentUser.hasRole("schwartz")) {
      log.info("May the Schwartz be with you!");
    } else {
      log.info("Hello, mere mortal.");
    }

    //粗粒度
    //test a typed permission (not instance-level)
    if (currentUser.isPermitted("lightsaber:wield")) {
      log.info("You may use a lightsaber ring.  Use it wisely.");
    } else {
      log.info("Sorry, lightsaber rings are for schwartz masters only.");
    }

    //细粒度
    //a (very powerful) Instance Level permission:
    if (currentUser.isPermitted("winnebago:drive:eagle5")) {
      log.info("You are permitted to 'drive' the winnebago with license plate (id) 'eagle5'.  " +
               "Here are the keys - have fun!");
    } else {
      log.info("Sorry, you aren't allowed to drive the 'eagle5' winnebago!");
    }

    //all done - log out!
    currentUser.logout();

    System.exit(0);
  }
}

package com.bobo.config; 
import org.springframework.context.annotation.Configuration; 
//声明为配置类 
@Configuration 
public class ShiroConfig { 
  
  //创建 ShiroFilterFactoryBean 
  @Bean 
  public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager")DefaultWebSecurityMan ager securityManager){ 
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean(); 
    //设置安全管理器 
    shiroFilterFactoryBean.setSecurityManager(securityManager); 、
    /* 添加Shiro内置过滤器，常用的有如下过滤器： 
      anon： 无需认证就可以访问 
      authc： 必须认证才可以访问 
      user： 如果使用了记住我功能就可以直接访问 
      perms: 拥有某个资源权限才可以访问 
      role： 拥有某个角色权限才可以访问 
    */
    Map<String,String> filterMap = new LinkedHashMap<String, String>();
    //"跳转目标","权限"
    filterMap.put("/user/add","authc"); 
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
    return shiroFilterFactoryBean; 
  }
  
  //创建 DefaultWebSecurityManager 
  @Bean(name = "securityManager") 
  public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm")UserRealm userRealm){ 
    DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); 
    //关联Realm 
    securityManager.setRealm(userRealm); 
    return securityManager; 
  }
  
  //创建 realm 对象 
  @Bean 
  public UserRealm userRealm(){ 
    return new UserRealm(); 
  }
}

package com.bobo.config; 
import org.apache.shiro.authc.AuthenticationException; 
import org.apache.shiro.authc.AuthenticationInfo; 
import org.apache.shiro.authc.AuthenticationToken; 
import org.apache.shiro.authz.AuthorizationInfo; 
import org.apache.shiro.realm.AuthorizingRealm; 
import org.apache.shiro.subject.PrincipalCollection; 
//自定义Realm 
public class UserRealm extends AuthorizingRealm { 
  //执行授权逻辑 
  @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { 
    System.out.println("执行了=>授权逻辑PrincipalCollection"); 
    return null; 
  }
  //执行认证逻辑 
  @Override 
  protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { 
    System.out.println("执行了=>认证逻辑AuthenticationToken"); 
    return null;
  } 
}

package com.bobo.swagger.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import springfox.documentation.oas.annotations.EnableOpenApi;
import springfox.documentation.service.ApiInfo;
import springfox.documentation.service.Contact;
import springfox.documentation.spi.DocumentationType;
import springfox.documentation.spring.web.plugins.Docket;

/**
 * @author renbo
 * EnableOpenApi 开启Swagger2
 */
@Configuration
@EnableOpenApi
public class SwaggerConfig {
  /**
     *  配置Swagger 的 Docket的 Bean实例
     */
  @Bean
  public Docket docket(){
    return new Docket(DocumentationType.SWAGGER_2)
      .apiInfo(apiInfo());
  }

  //    //配置Swagger信息 apiInfo
  private ApiInfo apiInfo(){
    Contact contact = new Contact("Bobo", "https://boyolo.github.io", "beau_renbo@163.com");
    return new ApiInfo(
      "BoBo Api Documentation",
      "Boyolo Api Documentation",
      "1.0",
      "https://boyolo.github.io",
      contact,
      "Apache 2.0",
      "http://www.apache.org/licenses/LICENSE-2.0",
      new ArrayList());
  }
}

/**
 *  配置Swagger 的 Docket的 Bean实例
 */
@Bean
public Docket docket(){
  return new Docket(DocumentationType.SWAGGER_2)
    .apiInfo(apiInfo())
    //是否启动swagger ，如果为false，则swagger不能再浏览器中访问
    .enable(false)
    .select()
    //RequestHandlerSelectors 配置要扫描接口的方式
    //basePackage 指定要扫描的包  RequestHandlerSelectors.basePackage("com.bobo.swagger.controller")
    //RequestHandlerSelectors.any()  扫描全部
    //RequestHandlerSelectors.none() 都不扫描
    //RequestHandlerSelectors.withClassAnnotation() 扫描类上的注解   参数是一个注解的反射对象
    //RequestHandlerSelectors.withMethodAnnotation()  扫描方法上的注解
    .apis(RequestHandlerSelectors.withMethodAnnotation(GetMapping.class))
    //过滤什么路径
    .paths(PathSelectors.ant("bobo/**"))
    .build();
}

@Bean
public Docket docketA(){
  return new Docket(DocumentationType.SWAGGER_2).groupName("A");
}
@Bean
public Docket docketB(){
  return new Docket(DocumentationType.SWAGGER_2).groupName("B");
}