Spring Security JSP标签库

<sec:authorize access="hasRole('ADMIN')">
It will display only is user is admin
</sec:authorize>

<sec:authentication property="principal.username">

<sec:accesscontrollist hasPermission="1,2" domainObject="${someObject}">
 if user has all the permissions represented by the values "1" or "2" on the given object.
</sec:accesscontrollist>

<form method="post" action="/some/action">
                <sec:csrfInput />
                Name:<br />
                <input type="text" name="username" />
                ...
        </form>

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-taglibs</artifactId>
    <version>5.0.4.RELEASE</version>
</dependency>

<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>

package com.nhooo;
import org.springframework.context.annotation.Bean;  
import org.springframework.context.annotation.ComponentScan;  
import org.springframework.context.annotation.Configuration;  
import org.springframework.web.servlet.config.annotation.EnableWebMvc;  
import org.springframework.web.servlet.view.InternalResourceViewResolver;  
import org.springframework.web.servlet.view.JstlView;  
  
@EnableWebMvc  
@Configuration  
@ComponentScan({ "com.nhooo.controller.*" })  
public class AppConfig {  
    @Bean  
    public InternalResourceViewResolver viewResolver() {  
        InternalResourceViewResolver viewResolver  
                          = new InternalResourceViewResolver();  
        viewResolver.setViewClass(JstlView.class);  
        viewResolver.setPrefix("/WEB-INF/views/");  
        viewResolver.setSuffix(".jsp");  
        return viewResolver;  
    }  
}

package com.nhooo;
import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;  
public class MvcWebApplicationInitializer extends  
        AbstractAnnotationConfigDispatcherServletInitializer {  
    @Override  
    protected Class<?>[] getRootConfigClasses() {  
        return new Class[] { WebSecurityConfig.class };  
    }  
    @Override  
    protected Class<?>[] getServletConfigClasses() {  
        // TOdo Auto-generated method stub  
        return null;  
    }  
    @Override  
    protected String[] getServletMappings() {  
        return new String[] { "/" };  
    }  
}

package com.nhooo;
import org.springframework.security.web.context.*;  
public class SecurityWebApplicationInitializer  
    extends AbstractSecurityWebApplicationInitializer {  
  
}

package com.nhooo;
import org.springframework.context.annotation.*;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;  
import org.springframework.security.config.annotation.web.configuration.*;  
import org.springframework.security.core.userdetails.*;
import org.springframework.security.core.userdetails.User.UserBuilder;  
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
@EnableWebSecurity  
@ComponentScan("com.nhooo")  
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {  
  
@Bean  
public UserDetailsService userDetailsService() {
    // ensure the passwords are encoded properly
     UserBuilder users = User.withDefaultPasswordEncoder();
     InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
     manager.createUser(users.username("mohan").password("1mohan23").roles("USER").build());
     manager.createUser(users.username("admin").password("admin123").roles("ADMIN").build());
     return manager;
    } 
  
@Override  
protected void configure(HttpSecurity http) throws Exception {  
      
      http.authorizeRequests().
      antMatchers("/index","/").permitAll()
      .antMatchers("/admin","/user").authenticated()
      .and()
      .formLogin()
      .and()
      .logout()
      .logoutRequestMatcher(new AntPathRequestMatcher("/logout"));
        
}  
}

package com.nhooo.controller;
import org.springframework.stereotype.Controller;  
import org.springframework.web.bind.annotation.RequestMapping;  
import org.springframework.web.bind.annotation.RequestMethod;
@Controller  
public class HomeController {  
    @RequestMapping(value="/", method=RequestMethod.GET)  
    public String index() {  
        return "index";  
    }  
    @RequestMapping(value="/user", method=RequestMethod.GET)  
    public String user() {  
       return "admin";
    }  
    @RequestMapping(value="/admin", method=RequestMethod.GET)  
    public String admin() {  
          
        return "admin";  
    }
}