<!-- 安全框架中的jar包 -->
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
      <version>4.2.10.RELEASE</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
      <version>4.2.10.RELEASE</version>
    </dependency>
    <!-- 标签库 -->
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-taglibs</artifactId>
      <version>4.2.10.RELEASE</version>
    </dependency>

  <!-- 核心控制器，注意需将spring及springmvc配置文件都由Web容器装载 -->
  <servlet>
    <servlet-name>springDispatcherServlet</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
      <param-name>contextConfigLocation</param-name>
      <param-value> classpath*:/spring/springmvc.xml classpath*:/spring/spring-*.xml </param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
  </servlet>
<!--代理管理所有 SpringSecurity 过滤器-->
  <filter>
    <filter-name>springSecurityFilterChain</filter-name><!--名称固定,不能变-->
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

/** * @Configuration 管理程序中的组件(扫描) * @EnableWebSecurity 安全框架支持注解的形式 基础注解 * @EnableGlobalMethodSecurity　开启使用表达式方法验证安全性 */ @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(prePostEnabled = true) public class AppWebSecurityConfig extends WebSecurityConfigurerAdapter { @Override //认证
    protected void configure(AuthenticationManagerBuilder auth) throws Exception { } @Override //授权
    protected void configure(HttpSecurity http) throws Exception { } }

 @Autowired private UserDetailsService userDetailsService; @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { //从数据库中查询数据 
    　　auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder()); }

    @Autowired //用户
    private TAdminMapper adminMapper; @Autowired //角色
    private TRoleMapper roleMapper; @Autowired //权限
    private TPermissionMapper permissionMapper; @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { TAdminExample example = new TAdminExample(); TAdminExample.Criteria criteria = example.createCriteria(); criteria.andLoginacctEqualTo(username); List<TAdmin> admins = adminMapper.selectByExample(example); //从数据库中查出该用户
        TAdmin admin = admins.get(0); //该集合用来存放角色和权限
        HashSet<GrantedAuthority> authorities = new HashSet<>(); //从数据库中查出该用户所对应的角色
        List<TRole> roles = roleMapper.listRole(admin.getId()); //从数据库中查出该用户所对应的权限
        List<TPermission> permissions = permissionMapper.listPermission(admin.getId()); //分别将角色和权限添加到 authorities 集合中
        for (TRole role : roles) { String name = role.getName(); authorities.add(new SimpleGrantedAuthority("ROLE_" + name));//注意角色需加上 "ROLE_"
 } permissions.forEach((p) -> { String name = p.getName(); authorities.add(new SimpleGrantedAuthority(name)); }); //通过该用户名和密码以及权限集合创建User对象并返回
        User user = new User(admin.getLoginacct().toString(), admin.getUserpswd().toString(), authorities); return user; }

 @Override protected void configure(HttpSecurity http) throws Exception { //基于httpRequest对指定antMatchers资源permitAll放行,对于其他请求anyRequest必须通过认证authenticated
        http.authorizeRequests().antMatchers("/welcome.jsp","/static/**") .permitAll().anyRequest().authenticated(); //跳转到默认登录界面
        http.formLogin().loginPage("/welcome.jsp"); //登录时指定的控制器/login,并验证用户名和密码,成功验证后跳转到控制器/main
        http.formLogin().loginProcessingUrl("/login") .usernameParameter("loginacct") .passwordParameter("userpswd") .defaultSuccessUrl("/main"); //取消csrf令牌值验证
 http.csrf().disable(); //退出时指定的控制器,并指定成功退出后登录界面
        http.logout().logoutUrl("/exit").logoutSuccessUrl("/welcome.jsp"); //记住我功能.需在前端复选框中指定 value 值为 remember-me
 http.rememberMe(); //自定义的异常处理器
        http.exceptionHandling().accessDeniedHandler(new AccessDeniedHandler() { @Override public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException { //判断是否为异步请求
                if("XMLHttpRequest".equals(request.getHeader("X-Requested-With"))){ response.getWriter().write("403"); }else { request.setAttribute("msg",accessDeniedException.getMessage()); request.getRequestDispatcher("/WEB-INF/views/unauth.jsp") .forward(request,response); } } }); }

@PreAuthorize 在方法执行之前检查,基于表达式的计算结果来限制对方法的访问 　　//@PreAuthorize("hasRole('软件工程师')")
@PostAuthorize 在方法执行后检查,但是如果表达式计算结果为false,将抛出一个安全性异常
@PostFilter 允许方法调用,但必须按照表达式来过滤方法的结果
@PreFilter 允许方法调用,但必须在进入方法之前过滤输入值

<%@taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
 　<sec:authentication property="name"/> //在需要位置显示用户登录名, 属性 property 必须是 name <sec:authorize access="hasRole('PM - 项目经理')">//非此角色用户隐藏下面的标签 <button type="button" id="deleteBath" class="btn btn-danger" style="float:right;margin-left:10px;">删除</button>
   </sec:authorize>