spring/spring-security.xml

这里只显示每个文件的开头 60 行。登录后可以解锁完整代码。

微信扫码关注公众号，代码整理好后第一时间通知你。

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:security="http://www.springframework.org/schema/security"
    xsi:schemaLocation="
    	http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
    	http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

        
        <!-- 配置不拦截的静态资源和登录相关页面 -->
        <security:http pattern="/login.jsp" security="none"></security:http>      
        <security:http pattern="/css/**" security="none"></security:http>      
        <security:http pattern="/images/**" security="none"></security:http>      
        <security:http pattern="/js/**" security="none"></security:http>      
        <security:http pattern="/font/**" security="none"></security:http> 
        <security:http pattern="/failer.jsp" security="none" ></security:http>
        
        <!-- 打开hsr250注解   jsr250-annotations="enabled"  第一种角色管理
        			secured-annotations="enabled"    第二种角色管理
        			pre-post-annotations="enabled"   第三种角色管理  表达式
        -->
        <security:global-method-security jsr250-annotations="enabled" secured-annotations="enabled" pre-post-annotations="enabled">
        </security:global-method-security>
        
        <!-- 不使用框架提供的页面，使用自己编写的页面   SPEL表达式不支持(改为true)-->
        <security:http auto-config="false" use-expressions="true">
        
        	<!-- 主页面嵌套才需要配置 -->
	        <security:headers>
	        	<security:frame-options policy="SAMEORIGIN"></security:frame-options>
	        </security:headers>	
	        
	        <!-- 只有具有这两个角色的用户进入系统 -->
	        <!-- <security:intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN"></security:intercept-url> -->
	        <!-- 第三种 -->
	        <security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')"></security:intercept-url>
	        
	        <!-- 关闭跨域请求 -->
	        <security:csrf disabled="true"></security:csrf>
	        
	        <!--安全退出-->
        	<security:logout invalidate-session="true" logout-url="/user/logout.action" logout-success-url="/login.jsp"/>
	        
	        <!-- 配置登录相关的页面和请求 
	        
	        	login-processing-url  与登录页面的跳转路径 相同
	        	authentication-failure-url   登录失败跳转到 /路径
	        	default-target-url  登录成功跳转到 /路径
	        	
	        -->
	        <security:form-login
	        	login-page="/login.jsp"
	        	login-processing-url="/user/login.action"
	        	username-parameter="username"
	        	password-parameter="password"
	        	authentication-failure-url="/failer.jsp"
	        	default-target-url="/index.jsp" />