摘要：返回總共需要處理個地方，一個是異常的處理，需要兼容請求，一個是成功返回的處理，一個是失敗返回的處理。這里就是攔截，獲取提交的參數，然后交給去認證。之后就是走后續的，如果成功，則會進行相應的配置。動態配置權限筆記自定義

本文講述一下如何自定義spring security的登錄頁，網上給的資料大多過時，而且是基于后端模板技術的，講的不是太清晰，本文給出一個采用ajax的登錄及返回的前后端分離方式。

總共需要處理3個地方，一個是異常的處理，需要兼容ajax請求，一個是成功返回的處理，一個是失敗返回的處理。

public class UnauthorizedEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        if(isAjaxRequest(request)){
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED,authException.getMessage());
        }else{
            response.sendRedirect("/login.html");
        }

    }

    public static boolean isAjaxRequest(HttpServletRequest request) {
        String ajaxFlag = request.getHeader("X-Requested-With");
        return ajaxFlag != null && "XMLHttpRequest".equals(ajaxFlag);
    }
}

這里我們自定義成功及失敗的ajax返回，當然這里我們簡單處理，只返回statusCode

public class AjaxAuthSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        response.setStatus(HttpServletResponse.SC_OK);
    }
}

public class AjaxAuthFailHandler extends SimpleUrlAuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Authentication failed");
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .exceptionHandling().authenticationEntryPoint(new UnauthorizedEntryPoint())
                .and()
                .csrf().disable()
                .authorizeRequests()
                .antMatchers("/login","/css/**", "/js/**","/fonts/**").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login.html")
                .loginProcessingUrl("/login")
                .usernameParameter("name")
                .passwordParameter("password")
                .successHandler(new AjaxAuthSuccessHandler())
                .failureHandler(new AjaxAuthFailHandler())
                .permitAll()
                .and()
                .logout()
                .logoutUrl("/logout")
                .permitAll();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .inMemoryAuthentication()
                .withUser("admin").password("admin").roles("USER");
    }
}

這里有幾個要注意的點：

permitAll

這里要添加前端資源路徑，以及登陸表單請求的接口地址/login

loginPage

這里設置登錄頁面的地址，這里我們用靜態頁面，即static目錄下的login.html

ajax配置

將authenticationEntryPoint，successHandler，failureHandler設置為上面自定義的ajax處理類

就是一個純粹的html頁面，其中登錄按鈕的ajax請求如下：

$.ajax({
            url: "/login",
            type: "POST",
            data: "name="+name+"&password="+password,
            success: function (res, status) {
                window.location.href="/ok.html"
            },
            error: function (res, status) {
                dangerDialog(res.statusText);
            }
        });

這里是請求/login，也就是spring security會默認攔截的路徑，不了解spring security的人可能會納悶，我請求這個路徑，但是工程里頭沒有定義/login的request mapping，不要緊么。下面來剖析一下。

這里我們要關注的就是這個UsernamePasswordAuthenticationFilter，顧名思義，它是filter，在執行/login請求的時候攔截，因而是不需要工程里頭去定義login的request mapping的。

spring-security-web-4.2.3.RELEASE-sources.jar!/org/springframework/security/web/authentication/UsernamePasswordAuthenticationFilter.java

public class UsernamePasswordAuthenticationFilter extends
        AbstractAuthenticationProcessingFilter {

public Authentication attemptAuthentication(HttpServletRequest request,
            HttpServletResponse response) throws AuthenticationException {
        if (postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException(
                    "Authentication method not supported: " + request.getMethod());
        }

        String username = obtainUsername(request);
        String password = obtainPassword(request);

        if (username == null) {
            username = "";
        }

        if (password == null) {
            password = "";
        }

        username = username.trim();

        UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
                username, password);

        // Allow subclasses to set the "details" property
        setDetails(request, authRequest);

        return this.getAuthenticationManager().authenticate(authRequest);
    }
    //......
}

這里就是攔截，獲取login.html提交的參數，然后交給authenticationManager去認證。之后就是走后續的filter，如果成功，則會進行相應的session配置。

spring security動態配置url權限

Spring Security筆記：自定義Login/Logout Filter、AuthenticationProvider、AuthenticationToken