Spring Security

配置类

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    /**
     * 定义认证用户信息获取来源，密码校验规则
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //inMemoryAuthentication从内存中获取
        auth.inMemoryAuthentication().withUser("admin").password("admin").roles("ADMIN")
                .and().withUser("zhangyaxing").password("123456").roles("USER");
    }

    /**
     * 定义安全策略
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()//配置安全策略
                .antMatchers("/", "/hello").permitAll()//配置不需要验证的请求url
                .anyRequest().authenticated()//配置其余所有的请求都需要验证
                .and()
                .logout().permitAll()//定义logout不需要验证
                .and()
                .formLogin();//使用form表单登录

        http.csrf().disable();
    }
}

注解