1.配置檔案中的http標籤變為security:http

需要使用hasRole來包裹角色名.加上這個屬性就可以直接寫角色名了.

官方文件:

use-expressions Spring Security will then expect the access attributes of the <intercept-url> elements to contain Spring EL expressions. The expressions should evaluate to a Boolean, defining whether access should be allowed or not

所以,如果不寫這個,預設use-expressions="true",那麼允許匿名登陸,直接寫access="true"就可以了,如果寫IS_AUTHENTICATED_ANONYMOUSLY,肯定出問題咯.

警告: Anonymous access to the login page doesn't appear to be enabled. This is almost certainly an error. Please check your configuration allows unauthenticated access to the configured login page. (Simulated access was rejected: org.springframework.security.access.AccessDeniedException: Access is denied)

這是因為spring security為了防止跨站請求做的.如果需要關閉那麼在security:http下新增一個子標籤<security:csrf disabled="true" />

或者保持配置不變在登入的表單中新增驗證資訊

<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>

一個梨子:

 <security:http auto-config="true" use-expressions="false">
              <!-- 表示匿名使用者可以訪問-->
              <security:intercept-url pattern="/go/logon" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
              <security:intercept-url pattern="/admin/*" access="ROLE_ADMIN"/>
              <security:intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN"/>
              <security:form-login login-page="/go/logon"
                                   login-processing-url="/login" username-parameter="username"
                                   password-parameter="password" />
              <security:csrf disabled="true" />
</security:http>

另一個梨子:

<security:http auto-config="true">
              <security:intercept-url pattern="/go/logon" access="true"/>
              <security:intercept-url pattern="/admin/*" access="hasRole('ROLE_ADMIN')"/>
              <security:intercept-url pattern="/**" access="hasRole('ROLE_USER') or hasRole('ROLE_ADMIN')"/>
              <security:form-login login-page="/go/logon"
                                   login-processing-url="/login" username-parameter="username"
                                   password-parameter="password" />
              <security:csrf disabled="true" />
       </security:http>

預設開啟這個功能後在,我們使用退出登入配置的時又出現問題.

<security:logout logout-url="/logout" />

http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#csrf-logout
我們需要通過POST方式才能退出登入咯.

點選退出時,用一個ajax去請求/logout,同時帶上csrf的值就可以了,否則會403.

function logout(){
        var val = $("#logoutParam").val();
        var name = $("#logoutParam").attr("name");
        var csrfData = {};
        csrfData[name] = val;
        $.ajax("/logout", {
            type:"POST",
            data:csrfData,
            success: function (data) {
                if(data.success){
                    goIndex();
                }
            },
            error:function () {
                alert1("退出失敗");
            }
        });
    }

5.使用Spring提供的使用者資料庫驗證時.那些sql語句,需要改改.MySQL的如下(注意一下順序就可以了,有一些外來鍵)

DROP TABLE IF EXISTS `users`;
CREATE TABLE  `users` (
  `username` varchar(50) NOT NULL,
  `password` varchar(50) NOT NULL,
  `enabled` tinyint(1) NOT NULL,
  PRIMARY KEY (`username`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

DROP TABLE IF EXISTS `groups`;
CREATE TABLE  `groups` (
  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
  `group_name` varchar(45) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8;

DROP TABLE IF EXISTS `blog`.`group_members`;
CREATE TABLE  `blog`.`group_members` (
  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
  `username` varchar(50) NOT NULL,
  `group_id` int(10) unsigned NOT NULL,
  PRIMARY KEY (`id`),
  KEY `fk_group_members_group` (`group_id`),
  CONSTRAINT `fk_group_members_group` FOREIGN KEY (`group_id`) REFERENCES `groups` (`id`) ON DELETE NO ACTION ON UPDATE NO ACTION
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

DROP TABLE IF EXISTS `blog`.`group_authorities`;
CREATE TABLE  `blog`.`group_authorities` (
  `group_id` int(10) unsigned NOT NULL,
  `authority` varchar(50) NOT NULL,
  PRIMARY KEY (`group_id`),
  CONSTRAINT `fk_group_authorities_group` FOREIGN KEY (`group_id`) REFERENCES `groups` (`id`) ON DELETE NO ACTION ON UPDATE NO ACTION
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

DROP TABLE IF EXISTS `authorities`;
CREATE TABLE  `authorities` (
  `username` varchar(50) NOT NULL,
  `authority` varchar(50) NOT NULL,
  KEY `ix_auth_username` (`username`,`authority`),
  CONSTRAINT `fk_authorities_users` FOREIGN KEY (`username`) REFERENCES `users` (`username`) ON DELETE NO ACTION ON UPDATE NO ACTION
) ENGINE=InnoDB DEFAULT CHARSET=utf8;