Spring Security 集成实践

🎯 快速集成

Maven 依赖

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
    <version>3.2.6</version> <!-- 与项目版本一致 -->
</dependency>

⚙️ 基础配置示例

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .permitAll()
            )
            .logout(logout -> logout.permitAll());
        
        return http.build();
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

🔐 用户详情实现

@Service
public class UserDetailsServiceImpl implements UserDetailsService {
    
    @Autowired
    private UserService userService;
    
    @Override
    public UserDetails loadUserByUsername(String username) 
            throws UsernameNotFoundException {
        
        User user = userService.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("用户不存在");
        }
        
        return User.withUsername(user.getUsername())
                  .password(passwordEncoder().encode(user.getPassword()))
                  .authorities(user.getRoles())
                  .accountExpired(false)
                  .accountLocked(false)
                  .credentialsExpired(false)
                  .disabled(false)
                  .build();
    }
}

💡 安全建议

密码加密：使用 BCrypt 强加密算法
CSRF 保护：默认开启，REST API 可禁用
CORS 配置：跨域场景需显式配置
会话管理：生产环境建议使用无状态 JWT

安全提醒

切勿将明文密码硬编码在代码中！所有敏感配置应通过环境变量或配置文件管理。