摘要：框架入門簡介是一個能夠為基于的企業應用系統提供聲明式的安全訪問控制解決方案的安全框架。

Spring Security是一個能夠為基于Spring的企業應用系統提供聲明式的安全訪問控制解決方案的安全框架。它提供了一組可以在Spring應用上下文中配置的Bean，充分利用了Spring IoC，DI（控制反轉Inversion of Control ,DI:Dependency Injection 依賴注入）和AOP（面向切面編程）功能，為應用系統提供聲明式的安全訪問控制功能，減少了為企業系統安全控制編寫大量重復代碼的工作。

（1）創建工程spring_security_demo ,pom.xml內容

    4.0.0
    cn.itcast.demo
    spring-security-demo
    war
    0.0.1-SNAPSHOT
    
        4.2.4.RELEASE
    
    
        
            org.springframework
            spring-core
            ${spring.version}
        
        
            org.springframework
            spring-web
            ${spring.version}
        
        
            org.springframework
            spring-webmvc
            ${spring.version}
        
        
            org.springframework
            spring-context-support
            ${spring.version}
        
        
            org.springframework
            spring-test
            ${spring.version}
        
        
            org.springframework
            spring-jdbc
            ${spring.version}
        
        
            org.springframework.security
            spring-security-web
            4.1.0.RELEASE
        
        
            org.springframework.security
            spring-security-config
            4.1.0.RELEASE
        
        
            javax.servlet
            servlet-api
            2.5
            provided
        
    
    
              
          
          
                org.apache.maven.plugins
                maven-compiler-plugin
                3.2
                
                    1.7
                    1.7
                    UTF-8
                
                
          
                org.apache.tomcat.maven
                tomcat7-maven-plugin
                
                    
                    9090
                    
                    /
                
            
         
    

（2）創建web.xml 

        
       
        contextConfigLocation
        classpath:spring-security.xml
     
     
        
            org.springframework.web.context.ContextLoaderListener
        
         
       
        springSecurityFilterChain           org.springframework.web.filter.DelegatingFilterProxy  
       
       
        springSecurityFilterChain  
        /*  
         

（3）創建index.html   內容略（IDEA的index.jsp也可用）

（4）創建spring 配置文件spring-security.xml

**配置說明**：
    intercept-url 表示攔截頁面   
    //  表示的是該目錄下的資源，只包括本級目錄不包括下級目錄
    // 表示的是該目錄以及該目錄下所有級別子目錄的資源
    form-login  為開啟表單登陸

use-expressions 為是否使用使用 Spring 表達式語言（ SpEL ），默認為true ,如果開啟，則攔截的配置寫成以下形式

此時啟動localhost:9090就能看到登陸頁面

pom.xml

    
        
        
            com.yh
            yh_common
            1.0-SNAPSHOT
        
        
        
            org.springframework
            spring-context
        
        
            org.springframework
            spring-beans
        
        
            org.springframework
            spring-webmvc
        
        
            org.springframework
            spring-jdbc
        
        
            org.springframework
            spring-aspects
        
        
            org.springframework
            spring-jms
        
        
            org.springframework
            spring-context-support
        
        
            org.springframework
            spring-test
        
        
        
            org.springframework.security
            spring-security-web
        
        
            org.springframework.security
            spring-security-config
        
        
        
            com.alibaba
            dubbo
        
        
            org.apache.zookeeper
            zookeeper
        
        
            com.github.sgroschupf
            zkclient
        
        
            junit
            junit
        
        
            com.alibaba
            fastjson
        
        
            org.javassist
            javassist
            3.23.1-GA
        
        
            commons-codec
            commons-codec
        
        
            javax.servlet
            servlet-api
            provided
        
        
            com.yh
            yh_sellergoods_interface
            1.0-SNAPSHOT
        

        
        
            org.csource.fastdfs
            fastdfs
        
        
            commons-fileupload
            commons-fileupload
        
    

    
        
            
                org.apache.tomcat.maven
                tomcat7-maven-plugin
                2.2
                
                    
                    9102
                    
                    /
                
            
        
    

web.xml

    
    
        CharacterEncodingFilter
        org.springframework.web.filter.CharacterEncodingFilter
        
            encoding
            utf-8
        
        
            forceEncoding
            true
        
    
    
        CharacterEncodingFilter
        /*
    


    
        springmvc
        org.springframework.web.servlet.DispatcherServlet
        
        
            contextConfigLocation
            classpath:spring/spring*.xml
        
        2
    

    
        springmvc
        *.do
    

    
        contextConfigLocation
        
        classpath:spring/spring*.xml,classpath*:spring/applicationContext*.xml
    
    
        
            org.springframework.web.context.ContextLoaderListener
        
    


    
        springSecurityFilterChain
        org.springframework.web.filter.DelegatingFilterProxy
    
    
        springSecurityFilterChain
        /*
    

pringmvc.xml

    

    
    
        
        
        
    

    
        
            
                
                
                    
                        WriteMapNullValue
                        WriteDateUseDateFormat
                    
                
            
        
    

    
    
    
    

Spring-secuity.xml

com.yh.service.UserDetailServiceImpl.java

package com.yh.page.service;

import com.alibaba.dubbo.config.annotation.Reference;
import com.yh.pojo.TbSeller;
import com.yh.sellergoods.service.SellerService;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Component;

import java.util.ArrayList;

/
  實現userdetail接口 用于驗證前臺輸入用戶信息匹配
  

  需要讓接口掃描到這個類
 /
@Component
public class UserDetailServiceImpl implements UserDetailsService {
    //遠程調用dubbo提供的服務 但是此時還沒有
    @Reference
    public SellerService sellerService;
    
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        TbSeller seller = sellerService.findOne(username);
        System.out.println(seller);
        //沒找到用戶  或者用戶沒有通過審核
        if (seller == null || !"1".equals(seller.getStatus())) {
            return null;
        }
        ArrayList list = new ArrayList<>();
        list.add(new SimpleGrantedAuthority("ROLE_SELLER"));
        
        return new User(username, seller.getPassword(), list);
    }
}

config/fdfs_client.conf

# connect timeout in seconds
# default value is 30s
connect_timeout=30

# network timeout in seconds
# default value is 30s
network_timeout=60

# the base path to store log files
base_path=/home/fastdfs

# tracker_server can ocur more than once, and tracker_server format is
#  "host:port", host can be hostname or ip address
tracker_server=172.16.224.128:22122

#standard log level as syslog, case insensitive, value list:
### emerg for emergency
### alert
### crit for critical
### error
### warn for warning
### notice
### info
### debug
log_level=info

# if use connection pool
# default value is false
# since V4.05
use_connection_pool = false

# connections whose the idle time exceeds this time will be closed
# unit: second
# default value is 3600
# since V4.05
connection_pool_max_idle_time = 3600

# if load FastDFS parameters from tracker server
# since V4.05
# default value is false
load_fdfs_parameters_from_tracker=false

# if use storage ID instead of IP address
# same as tracker.conf
# valid only when load_fdfs_parameters_from_tracker is false
# default value is false
# since V4.05
use_storage_id = false

# specify storage ids filename, can use relative or absolute path
# same as tracker.conf
# valid only when load_fdfs_parameters_from_tracker is false
# since V4.05
storage_ids_filename = storage_ids.conf


#HTTP settings
http.tracker_server_port=80

#use "#include" directive to include HTTP other settiongs
##include http.conf

com.yh.shop.controller.UploadController

package com.yh.shop.controller;
import entity.Result;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.multipart.MultipartFile;
import utils.FastDFSClient;
//  文件上傳controller
@RestController
 public class UploadController {
  @Value("${FILE_SERVER_URL}")
  public String FILE_SERVER_URL;
   
    @RequestMapping("upload")
    public Result upload(MultipartFile file) {
        //文件名稱
        //String originalFilename = file.getOriginalFilename();
        //獲取擴展名稱
        //String extName = originalFilename.substring(originalFilename.lastIndexOf(".") + 1);
    
        String extName = file.getOriginalFilename().substring(file.getOriginalFilename().lastIndexOf(".")+1);
        try {
            //創建fastdfs客戶端
            FastDFSClient fastDFSClient = new FastDFSClient("classpath:config/fdfs_client.conf");
            //返回圖片路徑
            String path = fastDFSClient.uploadFile(file.getBytes(), extName);
            System.out.println(path);
            return new Result(true, FILE_SERVER_URL + path);
        } catch (Exception e) {
            e.printStackTrace();
            return new Result(false, "上傳失敗");
        }
        
    }
    
}