1
SpringBoot 3.3+
2
Java 17+
3
SpringSecurity 6
4
Maven
5
Vue3

1
pom.xml
2
<dependency>
3
<groupId>org.springframework.boot</groupId>
4
<artifactId>spring-boot-starter-security</artifactId>
5
</dependency>
6
<dependency>
7
<groupId>org.springframework.boot</groupId>
8
<artifactId>spring-boot-starter-web</artifactId>
9
</dependency>

1
@RestController
2
@RequestMapping("/user")
3
public class UserController {
4

5
@GetMapping("/hello")
6
public String hello(){
7
return "hello security";
8
}
9
}

1
访问：http://localhost:8080/user/hello

1
username: user

1
application.yml
2
spring:
3
security:
4
user:
5
name: admin
6
password: 123456

1
UsernamePasswordAuthenticationToken
2
{
3
username:"admin",
4
password:"123456",
5
authenticated:false
6
}

1
UsernamePasswordAuthenticationToken
2
{
3
username:"admin",
4
authorities:[
5
ROLE_ADMIN
6
],
7
authenticated:true
8
}

1
@Service
2
public class UserService implements UserDetailsService {
3
@Override
4
public UserDetails loadUserByUsername(String username){
5
User user=userMapper.findByUsername(username);
6

7
return User.builder()
8
.username(user.getUsername())
9
.password(user.getPassword())
10
.roles("USER")
11
.build();
12
}
13
}

1
-- ----------------------------
2
-- Table structure for t_menu

1
-- ----------------------------
2
DROP TABLE IF EXISTS `t_menu`;
3
CREATE TABLE `t_menu` (
4
`id` bigint(20) NOT NULL AUTO_INCREMENT COMMENT '主键',
5
`name` varchar(255) DEFAULT NULL COMMENT '菜单名称',
6
`icon` varchar(255) DEFAULT NULL COMMENT '菜单图标',
7
`url` varchar(255) DEFAULT NULL COMMENT '菜单url',
8
`pid` bigint(20) DEFAULT NULL COMMENT '菜单父id',
9
`remark` varchar(255) DEFAULT NULL COMMENT '菜单备注',
10
`level` varchar(255) DEFAULT NULL COMMENT '菜单等级',
11
`is_link` int(255) DEFAULT NULL COMMENT '是否有链接',
12
PRIMARY KEY (`id`),
13
UNIQUE KEY `id_index` (`id`) USING BTREE
14
) ENGINE=InnoDB AUTO_INCREMENT=42 DEFAULT CHARSET=utf8;
15

16
-- ----------------------------
17
-- Records of t_menu
18
-- ----------------------------
19
BEGIN;
20
INSERT INTO `t_menu` VALUES (1, '系统设置', 'layui-icon-fire', '123', -1, 'sdf', NULL, 0);
21
INSERT INTO `t_menu` VALUES (2, '分类管理', 'layui-icon-name', 'category/list', 1, '', NULL, 1);
22

23
INSERT INTO `t_menu` VALUES (3, '商品管理', 'layui-icon-service', NULL, -1, '', NULL, 0);
24
INSERT INTO `t_menu` VALUES (4, '商品管理', 'layui-icon-rate', 'asset-info/list', 3, '', NULL, 1);
25

26
-- ----------------------------
27
-- Table structure for t_menu_role
28
-- ----------------------------
29
DROP TABLE IF EXISTS `t_menu_role`;
30
CREATE TABLE `t_menu_role` (
31
`id` bigint(20) NOT NULL AUTO_INCREMENT COMMENT '主键',
32
`menu_id` bigint(20) DEFAULT NULL COMMENT '菜单id',
33
`role_id` bigint(20) DEFAULT NULL COMMENT '角色id',
34
PRIMARY KEY (`id`),
35
UNIQUE KEY `id_index` (`id`) USING BTREE
36
) ENGINE=InnoDB AUTO_INCREMENT=495 DEFAULT CHARSET=utf8;
37

38
-- ----------------------------
39
-- Records of t_menu_role
40
-- ----------------------------
41
BEGIN;
42
INSERT INTO `t_menu_role` VALUES (1, 1, 1);
43
INSERT INTO `t_menu_role` VALUES (2, 2, 1);
44
INSERT INTO `t_menu_role` VALUES (3, 3, 1);
45
INSERT INTO `t_menu_role` VALUES (4, 4, 1);
46
INSERT INTO `t_menu_role` VALUES (5, 3, 2);
47
INSERT INTO `t_menu_role` VALUES (6, 4, 2);
48

49
-- ----------------------------
50
-- Table structure for t_permission
51
-- ----------------------------
52
DROP TABLE IF EXISTS `t_permission`;
53
CREATE TABLE `t_permission` (

1
`id` bigint(20) NOT NULL AUTO_INCREMENT,
2
`permission_name` varchar(255) DEFAULT NULL,
3
`permission_key` varchar(255) DEFAULT NULL,
4
PRIMARY KEY (`id`)
5
) ENGINE=InnoDB AUTO_INCREMENT=11 DEFAULT CHARSET=utf8;
6

7
-- ----------------------------
8
-- Records of t_permission
9
-- ----------------------------
10
BEGIN;
11
INSERT INTO `t_permission` VALUES (1, '查询', 'permission:query');
12
INSERT INTO `t_permission` VALUES (2, '新增', 'permission:insert');
13
INSERT INTO `t_permission` VALUES (3, '修改', 'permission:update');
14
INSERT INTO `t_permission` VALUES (4, '删除', 'permission:delete');
15
-- ----------------------------
16
-- Table structure for t_role
17
-- ----------------------------
18
DROP TABLE IF EXISTS `t_role`;
19
CREATE TABLE `t_role` (
20
`id` bigint(20) NOT NULL AUTO_INCREMENT,
21
`role_name` varchar(255) DEFAULT NULL,
22
PRIMARY KEY (`id`)
23
) ENGINE=InnoDB AUTO_INCREMENT=18 DEFAULT CHARSET=utf8;
24

25
-- ----------------------------
26
-- Records of t_role
27
-- ----------------------------
28
BEGIN;
29
INSERT INTO `t_role` VALUES (1, '系统管理员');
30
INSERT INTO `t_role` VALUES (2, '普通用户');

1
-- ----------------------------
2
-- Table structure for t_user
3
-- ----------------------------
4
DROP TABLE IF EXISTS `t_role_permission`;
5
CREATE TABLE `t_role_permission` (
6
`id` bigint(20) NOT NULL AUTO_INCREMENT,
7
`role_id` bigint(20) DEFAULT NULL,
8
`permission_id` bigint(20) DEFAULT NULL,
9
PRIMARY KEY (`id`)
10
) ENGINE=InnoDB AUTO_INCREMENT=66 DEFAULT CHARSET=utf8;
11

12
-- ----------------------------
13
-- Records of t_role_permission
14
-- ----------------------------
15

16
INSERT INTO `t_role_permission` VALUES (50, 1, 1);
17
INSERT INTO `t_role_permission` VALUES (51, 1, 2);
18
INSERT INTO `t_role_permission` VALUES (52, 1, 3);
19
INSERT INTO `t_role_permission` VALUES (53, 1, 4);
20
INSERT INTO `t_role_permission` VALUES (61, 2, 1);

1
DROP TABLE IF EXISTS `t_user`;
2
CREATE TABLE `t_user` (
3
`id` bigint(20) NOT NULL AUTO_INCREMENT,
4
`username` varchar(255) DEFAULT NULL,
5
`password` varchar(255) DEFAULT NULL,
6
`role_id` bigint(20) DEFAULT NULL,
7
`nickname` varchar(255) DEFAULT NULL,
8
`email` varchar(255) DEFAULT NULL,
9
`phone` varchar(255) DEFAULT NULL,
10
`freeze` int(255) DEFAULT NULL,
11
`dept_id` bigint(20) DEFAULT NULL,
12
`remark` varchar(255) DEFAULT NULL,
13
`insert_time` datetime DEFAULT NULL,
14
PRIMARY KEY (`id`)
15
) ENGINE=InnoDB AUTO_INCREMENT=8 DEFAULT CHARSET=utf8;
16

17
-- ----------------------------
18
-- Records of t_user
19
-- ----------------------------
20

21
INSERT INTO `t_user` VALUES (1, 'admin',
22
'$2a$10$t9BSP6hInmZm5RJocXVMdOLXzVXh4wgiBaYrM6iUslsrb.5z.eYce', 1, '超级管理员', NULL, NULL, NULL, 9,
23
'', '2021-05-26 14:41:06');
24
INSERT INTO `t_user` VALUES (2, 'normal',
25
'$2a$10$Mv1ruD0gHy9Uq73SbfH80ep1McuJNZiJCjM3BpxAJVr9pt34iwWlS', 2, '普通用户', NULL, NULL, NULL, 4,
26
'', NULL);

1
<dependencies>
2
<dependency>
3
<groupId>org.springframework.boot</groupId>
4
<artifactId>spring-boot-starter-web</artifactId>
5
</dependency>
6
<dependency>
7
<groupId>com.baomidou</groupId>
8
<artifactId>mybatis-plus-spring-boot3-starter</artifactId>
9
<version>3.5.6</version>
10
</dependency>
11
<dependency>
12
<groupId>com.mysql</groupId>
13
<artifactId>mysql-connector-j</artifactId>
14
<scope>runtime</scope>
15
</dependency>
16
<dependency>
17
<groupId>org.projectlombok</groupId>
18
<artifactId>lombok</artifactId>
19
<optional>true</optional>
20
</dependency>

1
<dependency>
2
<groupId>org.springframework.boot</groupId>
3
<artifactId>spring-boot-starter-test</artifactId>
4
<scope>test</scope>
5
</dependency>
6
<dependency>
7
<groupId>io.jsonwebtoken</groupId>
8
<artifactId>jjwt-api</artifactId>
9
<version>0.12.5</version>
10
</dependency>
11
<dependency>
12
<groupId>io.jsonwebtoken</groupId>
13
<artifactId>jjwt-impl</artifactId>
14
<version>0.12.5</version>
15
<scope>runtime</scope>
16
</dependency>
17
<dependency>
18
<groupId>io.jsonwebtoken</groupId>
19
<artifactId>jjwt-jackson</artifactId>
20
<version>0.12.5</version>
21
<scope>runtime</scope>
22
</dependency>
23
<!-- SpringSecurity 核心依赖 -->
24
<dependency>
25
<groupId>org.springframework.boot</groupId>
26
<artifactId>spring-boot-starter-security</artifactId>
27
</dependency>
28
</dependencies>

1
return config
2
},
3
error => Promise.reject(error)
4
)
5

6
// 响应拦截：统一处理权限错误
7
service.interceptors.response.use(
8
res => res.data,
9
error => {
10
const code = error.response.data.code
11
// 未登录/Token失效
12
if (code === 401) {
13
localStorage.removeItem('token')
14
window.location.href = '/login'
15
}
16
return Promise.reject(error)
17
}
18
)
19

20
export default service

1
@Configuration
2
@EnableWebSecurity
3
public class SecurityConfig {
4
private static final String[] WHITE_LIST = {
5
"/login",
6
"/doc.html",
7
"/webjars/**",
8
"/favicon.ico",
9
"/druid/**",
10
"/public/**"
11
};
12
@Bean
13
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
14
http
15
// 关闭CSRF（前后端分离无Cookie，无需防护）
16
.csrf(AbstractHttpConfigurer::disable)
17
// 开启跨域
18
.cors(cors -> cors.configurationSource(corsConfigurationSource()))
19
// 无状态认证：不创建、不使用Session（核心！前后端分离必备）
20
.sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
21
/*.exceptionHandling(ex -> ex
22
.authenticationEntryPoint(authenticationEntryPoint)
23
.accessDeniedHandler(accessDeniedHandler))*/
24
//接口放行规则
25
.authorizeHttpRequests(auth -> auth
26
.requestMatchers(WHITE_LIST).permitAll()
27
.anyRequest().authenticated());
28
//.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
29
return http.build();

1
}
2
@Bean
3
public CorsConfigurationSource corsConfigurationSource() {
4
CorsConfiguration config = new CorsConfiguration();
5
config.setAllowedOriginPatterns(List.of("*"));
6
config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
7
config.setAllowedHeaders(List.of("*"));
8
config.setAllowCredentials(true);
9
config.setExposedHeaders(List.of("Authorization"));
10
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
11
source.registerCorsConfiguration("/**", config);
12
return source;
13
}
14
@Bean
15
public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration)
16
throws Exception {
17
return configuration.getAuthenticationManager();
18
}
19
}

1
@Data
2
public class UserItem implements UserDetails {
3
private final User user;
4
private final List<String> permissions;
5
private final Collection<? extends GrantedAuthority> authorities;
6

7
public UserItem(User user, List<String> permissions) {
8
this.user = user;
9
this.permissions = permissions;
10
// ROLE_ 前缀用于角色认证，权限 key 直接作为 authority
11
this.authorities = Stream.concat(
12
Stream.of(new SimpleGrantedAuthority("ROLE_" + user.getRoleId())),
13
permissions.stream().map(SimpleGrantedAuthority::new)
14
).collect(Collectors.toList());
15
}
16

17
@Override
18
public Collection<? extends GrantedAuthority> getAuthorities() {
19
return authorities;
20
}
21

22
@Override
23
public String getPassword() {
24
return user.getPassword();
25
}

1
@Override
2
public String getUsername() {
3
return user.getUsername();
4
}
5

6
@Override
7
public boolean isAccountNonExpired() {
8
return true;
9
}
10

11
@Override
12
public boolean isAccountNonLocked() {
13
return user.getFreeze() == null || user.getFreeze() == 0;
14
}
15

16
@Override
17
public boolean isCredentialsNonExpired() {
18
return true;
19
}
20

21
@Override
22
public boolean isEnabled() {
23
return true;
24
}
25
}

1
@Service
2
@RequiredArgsConstructor
3
public class UserDetailsServiceImpl implements UserDetailsService {
4

5
private final UserMapper userMapper;
6
private final PermissionMapper permissionMapper;
7

8
@Override
9
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
10
User user = userMapper.selectOne(new LambdaQueryWrapper<User>()
11
.eq(User::getUsername, username)
12
.last("limit 1"));
13
if (user == null) {
14
throw new UsernameNotFoundException("账号不存在");
15
}
16
List<String> permissions = permissionMapper.selectPermissionListByRoleId(user.getRoleId())
17
.stream()
18
.map(Permission::getPermissionKey)
19
.collect(Collectors.toList());
20
return new UserItem(user, permissions);
21
}
22
}

1
@Test
2
public void testPassword(){
3
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
4
// 加密明文密码
5
String encode = encoder.encode("123456");
6
System.out.println(encode);
7
// 密码校验
8
boolean matches = encoder.matches("123456", encode);
9
System.out.println(matches); // true
10
}
11
@Bean
12
public BCryptPasswordEncoder getPasswordEncoder(){
13
return new BCryptPasswordEncoder();
14
}

1
@Data
2
public class Result {
3

4
private int code;
5
private Object data;
6
private String msg;
7
private long count;
8

9
public Result(int code, Object data, String msg, long count) {
10
this.code = code;
11
this.data = data;
12
this.msg = msg;
13
this.count = count;
14
}
15

16
public static Result end(int code, Object data, String msg, long count) {
17
return new Result(code, data, msg, count);
18
}
19

20
public static Result ok(Object data, String msg) {
21
return new Result(200, data, msg, 0);
22
}
23

24
public static Result ok(String msg) {
25
return new Result(200, null, msg, 0);

1
}
2

3
public static Result fail(String msg) {
4
return new Result(500, null, msg, 0);
5
}
6

7
public static Result fail(int code, String msg) {
8
return new Result(code, null, msg, 0);
9
}
10
}

1
@RestController
2
public class LoginController {
3
@Autowired
4
private AuthenticationManager authenticationManager;
5
@Autowired
6
private MenuService menuService;
7
@Autowired
8
private JwtUtil jwtUtil;
9
@PostMapping("/login")
10
public Result login(String username, String password) {
11
try {
12
Authentication authentication;
13
try {
14
authentication = authenticationManager.authenticate(
15
new UsernamePasswordAuthenticationToken(username, password));
16
} catch (BadCredentialsException e) {
17
throw new BadCredentialsException("用户名或密码错误");
18
} catch (DisabledException e) {
19
throw new DisabledException("账号已被冻结");
20
}
21
UserItem userItem = (UserItem) authentication.getPrincipal();
22
User user = userItem.getUser();
23
//测试数据，实质应该是通过userid查询的角色的权限
24
List<String> permissions = new ArrayList<>();
25
Collections.addAll(permissions,"ROLE:admin_permission:query","ROLE:normal_permission:insert");
26
//测试数据，实质应该是通过userid查询的菜单
27
List<Menu> menuList = menuService.list();
28
String token = jwtUtil.createToken(user.getId(), user.getUsername(), user.getRoleId(), permissions);
29
//返回响应数据
30
Map<String, Object> map = new HashMap<>();
31
map.put("token",token);
32
map.put("user",user);
33
map.put("menuList",menuList);
34
map.put("permissions",permissions);
35
return Result.ok(map, "登陆成功");
36
} catch (BadCredentialsException e) {
37
return Result.fail(400, "用户名或密码错误");
38
} catch (Exception e) {
39
return Result.fail(e.getMessage() != null ? e.getMessage() : "登录失败");

1
}
2
}
3
}

1
import org.springframework.boot.SpringApplication;
2
import org.springframework.boot.autoconfigure.SpringBootApplication;
3
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
4

5
@SpringBootApplication
6
@EnableMethodSecurity // 开启权限注解
7
public class SecurityApplication {
8
public static void main(String[] args) {
9
SpringApplication.run(SecurityApplication.class, args);
10
}
11
}

1
import org.springframework.security.access.prepost.PreAuthorize;
2
import org.springframework.web.bind.annotation.GetMapping;
3
import org.springframework.web.bind.annotation.RestController;
4

5
@RestController
6
public class PermissionController {
7

8
// 拥有admin角色才能访问
9
@PreAuthorize("hasRole('admin')")
10
@GetMapping("/admin")
11
public String admin() {
12
return "管理员接口访问成功";
13
}
14

15
// 拥有user权限才能访问
16
@PreAuthorize("hasAuthority('system:user:list')")
17
@GetMapping("/user/list")
18
public String userList() {
19
return "用户列表接口访问成功";
20
}
21

22
// 多权限满足其一即可
23
@PreAuthorize("hasAnyRole('admin','user')")
24
@GetMapping("/common")
25
public String common() {
26
return "通用接口访问成功";
27
}
28
}