开发者学堂课程【Java Spring Boot 2.6.0开发实战-1024程序员节创造营公益课： SpringBoot2.6 安全机制与实战开发（二）】学习笔记，与课程紧密联系，让用户快速学习知识。
课程地址：https://developer.aliyun.com/learning/course/903/detail/14343
SpringBoot2.6 安全机制与实战开发（二）
八，实战代码展示：
用户登录接口代码：
@RequestMapping(value = "/login", method = RequestMethod.POST)
public ModelAndView login(String username，string password，HttpServletRequest
request,HttpServletResponse response) {
system.out.print1n(username) ;
system. out.print1n(password);
ModelAndview mv = new ModelAndView("redirect:/Home/index" );try
//Hash 密码加密，
//SQL 注入，防止 SQL 注入
Users user = userServiceImpl.getUserByNameAndPassword(username,passwcif (user != null)
request.getsession().setAttribute("UserName",username);}else {
mv.setviewName( "redirect: ./ login");
}
catch (Exception e) {
System.out.println(e.getMessage());
}
raturn mv；
注：Redis 可用于防止数据丢失。抖音及微信都存在大数据的相关技术，应用的比较多的就是行为大数据。
WebSecurityConfig 代码展示：
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders
import org.springframework.security.config.annotation.web.builders.HttpSecuri
import org.springframework.security.config.annotation.web.configuration.Enabl
import org.springframework.security.config.annotation.web.configuration.webSc
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
@Configuration
@EnablewebSecurity
public class webSecurityConfig extends webSecurityConfigurerAdapter {
@override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/","/Home" ).permitAl1().antMatchers("/Users/**")I
.access( "hasRole( 'ROLE_ADMIN')").anyRequest().authenticated().and()
.formLogin();
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exc
auth
.inMemoryAuthentication()
.withUser( "frankxu" )
.password( "1234qwer")
.roles( "ADMIN");
}
@Bean
public static PasswordEncoder passwordEncoder(){
return NoOpPasswordEncoder.getInstance();
}
AccountController 层代码展示：
@Controller
@RequestMapping( "/Account")
public class AccountController {
@Autowired
private UserserviceImpluserServiceImpl;
@RequestMapping(value = "/login", method = RequestMethod.GET)public string login() {
system.out.println("打开登录页面");return "Account/ login";
}
@RequestMapping(value = "/login", method = RequestMethod.PoST)
public ModelAndView login(String username，String password，HttpServletRe
request, HttpservletResponse response) {
System.out.println(username );
system.out.println(password);
ModelAndview mV = new ModelAndView("redirect:/Home/index");try i
//Hash 密码加密﹐
/ /SQL ，防止 sQL 注入
Users user = userServiceImpl.getUserByNameAndPassword(username,if (user != nul1) {
request.getsession( ).setAttribute("UserName", username);} else {
mv.setviewName( "redirect: ./ login");
}
}
catch (Exception e) {
System.out.println(e.getMessage());
}
return mv;
}
}
@RequestMapping(value = "/logout", method = RequestMethod.PoST)public int logout(String username) {
/ / redis 缓存删除状态信息，
// Redis缓存更新一个 status 01，下线 offline。return 1;
}
@RequestMapping(value = "/login", method = RequestMethod.pOST)
public Integer login(string username，string password，HttpServletRequest
request, HttpservletResponse response) i
//Redis缓存更新一个 status 1，在线 online。@RequestMapping(value = "/logout", method = RequestMethod.PoST)public int logout(String username) {
/ / redis 缓存删除状态信息，
// Redis 缓存更新一个 status 01，下线 offline。return 1;
}
@RequestMapping(value = "/login", method = RequestMethod.pOST)
public Integer login(string username，string password，HttpServletRequest
request, HttpservletResponse response) i
//Redis 缓存更新一个 status 1，在线 online。
}
@RequestMapping(value = "/login", method = RequestMethod.POST)
public Integer login(String username，String password，HttpServletRequest
request, HttpservletResponse response) {
// Redis 缓存更新一个 status 1，在线 online。
@RequestMapping(value = "/logout" , method = RequestMethod.POST)public int logout(String username) {
//redis 缓存删除状态信息，
//Redis 缓存更新一个 status 01，下线 offline。return 1;
}
@RequestMapping(value = "/login",method = RequestMethod.POST)
public Integer login(string username，String password，HttpServletRequest
request, HttpservletResponse response) {
// Redis 缓存更新一个 status 1，在线 online。
* try { //Hash 密码加密，//SQL注入，防止 SQL 注入//Users user:
@Controller
@RequestMapping( "/Account")
public class AccountController {
@Autowired
private UserserviceImpluserServiceImpl;
@RequestMapping(value = "/login", method = RequestMethod.GET)public string login() {
system.out.println("打开登录页面");return "Account/ login";
}
@RequestMapping(value = "/login", method = RequestMethod.PoST)
public ModelAndView login(String username，String password，HttpServletRe
request, HttpservletResponse response) {
System.out.println(username );
system.out.println(password);
ModelAndviewmV=new ModelAndView("redirect:/Home/index");try i
//Hash 密码加密﹐
/ /SQL 注入，防止 sQL 注入
Usersuser= userServiceImpl.getUserByNameAndPassword(username,if (user != nul1) {
request.getsession( ).setAttribute("UserName", username);} else {
mv.setviewName( "redirect: ./ login");
}
}
catch (Exception e) {
System.out.println(e.getMessage());
}
return m1;
}
}
UserController 层代码展示：
UsersRepository;
@Autowired
Userservice;
@RequestMapping( "/getAl1/{name} ")
public List<Users> getAll(@Pathvariable( "name") String name){
/ / string name ="java" ;
return userService.getAl1(name);
}
//查询所有的用户数据
@RequestMapping( "/getAll")public List<Users> getAl1(){
List<Users> listusers = (List<Users>) usersRepository.findAll();return listUsers;
}
}
九，Java 面试题
1. 本质:URL，拦截请求，验证，放行或者拒绝
2. Java Spring Security 安全机制
3. 如何扩展使用 Token 令牌验证
4. JWT 开源安全令牌组件
5. 如何支持 X509正式验证
6. 自定义实现 Spring Boot 2.5.x 身份验证
7. API 安全如何实现
8. SSO 单点登录怎么实现?
9．微服务 Spring Cloud 安全体系
10．前后端分离架构，JSON 数据，调用后端 API
11.Filter 过滤器，拦截所有请求,http 请求，请求头 token
//在移动互联网时代，前后端分离应用时 token 应用的非常广泛。
12．转 Java，跳槽一线互联网公司
