Springboot security (1) - 기본적인 인증과정

Application Structure

pom.xml

<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>
<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-security</artifactId>
</dependency>

WebMvcConfigurer.java

package com.security_blog.yg1110.config;

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class MvcConfig implements WebMvcConfigurer {

	public void addViewControllers(ViewControllerRegistry registry) {
		registry.addViewController("/").setViewName("home");
		registry.addViewController("/home").setViewName("home");
		registry.addViewController("/hello").setViewName("hello");
		registry.addViewController("/login").setViewName("login");
	}

}

WebSecurityConfig.java

package com.security_blog.yg1110.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.authorizeRequests()
				// 루트와 home요청에 대해서는 요청을 허용한다.
				.antMatchers("/", "/home").permitAll()
				// 나머지 경로는 사용자 인증이 된 요청에 대해서만 요청을 허용한다.
				.anyRequest().authenticated()
				.and()
			.formLogin()
				// 로그인폼 변경
				.loginPage("/login")
				.permitAll()
				.and()
			.logout()
				.permitAll();
	}

	@Bean
	@Override
	public UserDetailsService userDetailsService() {
		// 인메모리 테스트 DB
		UserDetails user =
			 User.withDefaultPasswordEncoder()
				.username("user")
				.password("password")
				.roles("USER")
				.build();

		return new InMemoryUserDetailsManager(user);
	}
}

기본적으로 경로에 대한 필터만 되어있는 상태입니다.

루트경로와 home경로로 요청이 들어왔을경우 화면은 그대로 보여주게됩니다.

hello로 요청을 했을경우 로그인 인증이 되어있을경우 이동할수 있지만,

인증이 되어있지 않을경우 login페이지로 이동하게됩니다.

현재 DB를 적용시키지 않았기때문에 withDefaultPasswordEncoder를 이용하여 인메모리로 DB를 넣어 테스트 하였습니다.

home.html

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="https://www.thymeleaf.org" xmlns:sec="https://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
    <head>
        <title>Spring Security Example</title>
    </head>
    <body>
        <h1>Welcome!</h1>

        <p>Click <a th:href="@{/hello}">here</a> to see a greeting.</p>
    </body>
</html>

hello.html

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="https://www.thymeleaf.org"
      xmlns:sec="https://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
    <head>
        <title>Hello World!</title>
    </head>
    <body>
        <h1 th:inline="text">Hello [[${#httpServletRequest.remoteUser}]]!</h1>
        <form th:action="@{/logout}" method="post">
            <input type="submit" value="Sign Out"/>
        </form>
    </body>
</html>

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="https://www.thymeleaf.org"
      xmlns:sec="https://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
    <head>
        <title>Spring Security Example </title>
    </head>
    <body>
        <div th:if="${param.error}">
            Invalid username and password.
        </div>
        <div th:if="${param.logout}">
            You have been logged out.
        </div>
        <form th:action="@{/login}" method="post">
            <div><label> User Name : <input type="text" name="username"/> </label></div>
            <div><label> Password: <input type="password" name="password"/> </label></div>
            <div><input type="submit" value="Sign In"/></div>
        </form>
    </body>
</html>

결과화면

참고사이트 : https://spring.io/guides/gs/securing-web/

'Springboot' 카테고리의 다른 글

Springboot security (6) - Oauth2.0 (Google, facebook) 적용 (0)	2020.03.07
Springboot security (5) - jwt 적용 (0)	2020.03.03
Springboot security (4) - Oauth2.0 (google) 적용 (0)	2020.02.28
Springboot security (3) - 권한설정 (0)	2020.02.26
Springboot security (2) - mysql 연동 (0)	2020.02.26

Springboot security (1) - 기본적인 인증과정

'Springboot' 카테고리의 다른 글

'Springboot' Related Articles

티스토리툴바