详解spring security四种实现方式

2023-07-12 14:24:14 81

springsecurity实现方式大致可以分为这几种：

1.配置文件实现，只需要在配置文件中指定拦截的url所需要权限、配置userDetailsService指定用户名、密码、对应权限，就可以实现。

2.实现UserDetailsService，loadUserByUsername(StringuserName)方法，根据userName来实现自己的业务逻辑返回UserDetails的实现类，需要自定义User类实现UserDetails，比较重要的方法是getAuthorities()，用来返回该用户所拥有的权限。

3.通过自定义filter重写springsecurity拦截器，实现动态过滤用户权限。

4.通过自定义filter重写springsecurity拦截器，实现自定义参数来检验用户，并且过滤权限。

1.最简单配置spring-security.xml，实现1

2.实现UserDetailsService

先整理下springsecruity验证流程：

springSecurity的登录验证是由org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter这个过滤器来完成的,在该类的父类AbstractAuthenticationProcessingFilter中有一个AuthenticationManager接口属性,验证工作主要是通过这个AuthenticationManager接口的实例来完成的。在默认情况下，springSecurity框架会把org.springframework.security.authentication.ProviderManager类的实例注入到该属性

UsernamePasswordAuthenticationFilter的验证过程如下：

1.首先过滤器会调用自身的attemptAuthentication方法，从request中取出authentication,authentication是在org.springframework.security.web.context.SecurityContextPersistenceFilter过滤器中通过捕获用户提交的登录表单中的内容生成的一个org.springframework.security.core.Authentication接口实例.

2.拿到authentication对象后，过滤器会调用ProviderManager类的authenticate方法，并传入该对象

3.ProviderManager类的authenticate方法中会调用类中的Listproviders集合中的各个AuthenticationProvider接口实现类中的authenticate(Authenticationauthentication)方法进行验证，由此可见，真正的验证逻辑是由各个AuthenticationProvider接口实现类来完成的。DaoAuthenticationProvider类是默认情况下注入的一个AuthenticationProvider接口实现类

4.provider的实现类在验证用户时，会调用userDetailsService的实现类的loadUserByUsername方法来获取用户信息，

首先spring-security配置文件

userDetailsService实现：

/**
*
*/
packagecom.ultrapower.me.util.security.support;

importjava.util.ArrayList;
importjava.util.HashMap;
importjava.util.HashSet;
importjava.util.List;
importjava.util.Map;
importjava.util.Set;

importorg.apache.commons.logging.Log;
importorg.apache.commons.logging.LogFactory;
importorg.springframework.dao.DataAccessException;
importorg.springframework.jdbc.core.JdbcTemplate;
importorg.springframework.security.core.userdetails.UserDetails;
importorg.springframework.security.core.userdetails.UserDetailsService;
importorg.springframework.security.core.userdetails.UsernameNotFoundException;

importcom.ultrapower.me.util.Constants;
importcom.ultrapower.me.util.dbDao.SpringBeanUtil;
importcom.ultrapower.me.util.security.SecurityManager;
importcom.ultrapower.me.util.security.entity.Resource;
importcom.ultrapower.me.util.security.entity.Role;
importcom.ultrapower.me.util.security.entity.User;
importcom.ultrapower.me.util.task.PasswordUtils;


publicclassSecurityManagerSupportimplementsUserDetailsService{
privateLoglog=LogFactory.getLog(this.getClass().getName());


publicUserDetailsloadUserByUsername(StringuserName)throwsUsernameNotFoundException,DataAccessException{
//Listusers=getHibernateTemplate().find("FROMUseruserWHEREuser.name=?ANDuser.disabled=false",userName);
log.info("SecurityManagerSupport.loadUserByUsername.userName:"+userName);

Useruser=null;
if("admin".equals(userName)){
Setroles=newHashSet();
Rolerole=newRole();
role.setRoleid("ROLE_USER");
role.setRoleName("ROLE_USER");

Setresources=newHashSet();

Resourceres=newResource();
res.setResid("ME001");
res.setResName("首页");
res.setResUrl("/jsp/index/main.jsp");
res.setType("ROLE_USER");
res.setRoles(roles);
resources.add(res);

role.setResources(resources);

roles.add(role);
user=newUser();
user.setAccount("admin");
user.setDisabled(false);
user.setPassword(PasswordUtils.entryptPassword(Constants.securityKey));
log.info(user.getPassword());
user.setRoles(roles);
}
returnuser;//返回UserDetails的实现user不为空，则验证通过
}

}

UserDetails实现：

/**
*
*/
packagecom.ultrapower.me.util.security.entity;

importjava.util.ArrayList;
importjava.util.Collection;
importjava.util.HashMap;
importjava.util.List;
importjava.util.Map;
importjava.util.Set;

importorg.apache.commons.lang.StringUtils;
importorg.springframework.security.core.GrantedAuthority;
importorg.springframework.security.core.authority.SimpleGrantedAuthority;
importorg.springframework.security.core.userdetails.UserDetails;


publicclassUserimplementsUserDetails{

privatestaticfinallongserialVersionUID=8026813053768023527L;


privateStringaccount;

privateStringname;

privateStringpassword;

privatebooleandisabled;

privateSetroles;


privateMap>roleResources;

/**
*Thedefaultconstructor
*/
publicUser(){

}

/**
*Returnstheauthoritesstring
*
*eg.
*downpour---ROLE_ADMIN,ROLE_USER
*robbin---ROLE_ADMIN
*
*@return
*/
publicStringgetAuthoritiesString(){
Listauthorities=newArrayList();
for(GrantedAuthorityauthority:this.getAuthorities()){
authorities.add(authority.getAuthority());
}
returnStringUtils.join(authorities,",");
}

@Override
publicCollectiongetAuthorities(){
//根据自定义逻辑来返回用户权限，如果用户权限返回空或者和拦截路径对应权限不同，验证不通过
if(!roles.isEmpty()){
Listlist=newArrayList();
GrantedAuthorityau=newSimpleGrantedAuthority("ROLE_USER");
list.add(au);
returnlist;
}
returnnull;
}

/*
*密码
*/
publicStringgetPassword(){
returnpassword;
}

/*
*用户名
*/
publicStringgetUsername(){
returnname;
}

/*
*帐号是否不过期，false则验证不通过
*/
publicbooleanisAccountNonExpired(){
returntrue;
}

/*
*帐号是否不锁定，false则验证不通过
*/
publicbooleanisAccountNonLocked(){
returntrue;
}

/*
*凭证是否不过期，false则验证不通过
*/
publicbooleanisCredentialsNonExpired(){
returntrue;
}

/*
*该帐号是否启用，false则验证不通过
*/
publicbooleanisEnabled(){
return!disabled;
}



/**
*@returnthename
*/
publicStringgetName(){
returnname;
}

/**
*@returnthedisabled
*/
publicbooleanisDisabled(){
returndisabled;
}

/**
*@returntheroles
*/
publicSetgetRoles(){
returnroles;
}

/**
*@returntheroleResources
*/
publicMap>getRoleResources(){
//initroleResourcesforthefirsttime
System.out.println("---------------------------------------------------");
if(this.roleResources==null){

this.roleResources=newHashMap>();

for(Rolerole:this.roles){
StringroleName=role.getRoleName();
Setresources=role.getResources();
for(Resourceresource:resources){
Stringkey=roleName+"_"+resource.getType();
if(!this.roleResources.containsKey(key)){
this.roleResources.put(key,newArrayList());
}
this.roleResources.get(key).add(resource);
}
}

}
returnthis.roleResources;
}


/**
*@paramnamethenametoset
*/
publicvoidsetName(Stringname){
this.name=name;
}

/**
*@parampasswordthepasswordtoset
*/
publicvoidsetPassword(Stringpassword){
this.password=password;
}

/**
*@paramdisabledthedisabledtoset
*/
publicvoidsetDisabled(booleandisabled){
this.disabled=disabled;
}

/**
*@paramrolestherolestoset
*/
publicvoidsetRoles(Setroles){
this.roles=roles;
}

publicStringgetAccount(){
returnaccount;
}

publicvoidsetAccount(Stringaccount){
this.account=account;
}

publicvoidsetRoleResources(Map>roleResources){
this.roleResources=roleResources;
}

}

3.实现动态过滤用户权限

在spring-security配置文件的http标签中添加如下配置

在spring-security配置文件中添加如下配置

securityInterceptor继承AbstractSecurityInterceptor过滤器，实现Filter过滤器

packagecom.ultrapower.me.util.security.interceptor;

importjava.io.IOException;

importjavax.servlet.Filter;
importjavax.servlet.FilterChain;
importjavax.servlet.FilterConfig;
importjavax.servlet.ServletException;
importjavax.servlet.ServletRequest;
importjavax.servlet.ServletResponse;

importorg.springframework.security.access.SecurityMetadataSource;
importorg.springframework.security.access.intercept.AbstractSecurityInterceptor;
importorg.springframework.security.access.intercept.InterceptorStatusToken;
importorg.springframework.security.web.FilterInvocation;
importorg.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;

publicclassSecurityInterceptorextendsAbstractSecurityInterceptorimplementsFilter{

//配置文件注入
privateFilterInvocationSecurityMetadataSourcesecurityMetadataSource;

publicFilterInvocationSecurityMetadataSourcegetSecurityMetadataSource(){
returnsecurityMetadataSource;
}

publicvoidsetSecurityMetadataSource(
FilterInvocationSecurityMetadataSourcesecurityMetadataSource){
this.securityMetadataSource=securityMetadataSource;
}

@Override
publicvoiddoFilter(ServletRequestrequest,ServletResponseresponse,
FilterChainchain)throwsIOException,ServletException{
//TODOAuto-generatedmethodstub\

FilterInvocationfi=newFilterInvocation(request,response,chain);
//fi里面有一个被拦截的url
//里面调用MyInvocationSecurityMetadataSource的getAttributes(Objectobject)这个方法获取fi对应的所有权限
//再调用MyAccessDecisionManager的decide方法来校验用户的权限是否足够
InterceptorStatusTokentoken=super.beforeInvocation(fi);
try{
//执行下一个拦截器
fi.getChain().doFilter(fi.getRequest(),fi.getResponse());
}finally{
super.afterInvocation(token,null);
}

}

@Override
publicvoidinit(FilterConfigarg0)throwsServletException{
//TODOAuto-generatedmethodstub

}

@Override
publicClassgetSecureObjectClass(){
//TODOAuto-generatedmethodstub
returnFilterInvocation.class;
}

@Override
publicSecurityMetadataSourceobtainSecurityMetadataSource(){
//TODOAuto-generatedmethodstub
returnthis.securityMetadataSource;
}

@Override
publicvoiddestroy(){
//TODOAuto-generatedmethodstub
}
}

登陆后，每次访问资源都会被这个拦截器拦截，会执行doFilter这个方法，这个方法调用了invoke方法，其中fi断点显示是一个url（可能重写了toString方法吧，但是里面还有一些方法的），最重要的是beforeInvocation这个方法，它首先会调用MyInvocationSecurityMetadataSource类的getAttributes方法获取被拦截url所需的权限，在调用MyAccessDecisionManager类decide方法判断用户是否够权限。弄完这一切就会执行下一个拦截器。

secureResourceFilterInvocationDefinitionSource实现

/**
*
*/
packagecom.ultrapower.me.util.security.interceptor;

importjava.util.ArrayList;
importjava.util.Collection;
importjava.util.HashMap;
importjava.util.Iterator;
importjava.util.Map;

importjavax.servlet.ServletContext;

importorg.springframework.beans.factory.InitializingBean;
importorg.springframework.security.access.ConfigAttribute;
importorg.springframework.security.access.SecurityConfig;
importorg.springframework.security.web.FilterInvocation;
importorg.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
importorg.springframework.util.AntPathMatcher;
importorg.springframework.util.PathMatcher;


publicclassSecureResourceFilterInvocationDefinitionSourceimplementsFilterInvocationSecurityMetadataSource,InitializingBean{

privatePathMatchermatcher;

privatestaticMap>map=newHashMap>();

/*
*初始化用户权限，为了简便操作没有从数据库获取
*实际操作可以从数据库中获取所有资源路径url所对应的权限
*/
publicvoidafterPropertiesSet()throwsException{
this.matcher=newAntPathMatcher();//用来匹配访问资源路径
Collectionatts=newArrayList();
ConfigAttributeca=newSecurityConfig("ROLE_USER");
atts.add(ca);
map.put("/jsp/index/main.jsp",atts);
Collectionattsno=newArrayList();
ConfigAttributecano=newSecurityConfig("ROLE_NO");
attsno.add(cano);
map.put("/http://blog.csdn.net/u012367513/article/details/other.jsp",attsno);
}



@Override
publicCollectiongetAttributes(Objectobject)
throwsIllegalArgumentException{
//TODOAuto-generatedmethodstub
FilterInvocationfilterInvocation=(FilterInvocation)object;

StringrequestURI=filterInvocation.getRequestUrl();
//循环资源路径，当访问的Url和资源路径url匹配时，返回该Url所需要的权限
for(Iterator>>iter=map.entrySet().iterator();iter.hasNext();){
Map.Entry>entry=iter.next();
Stringurl=entry.getKey();

if(matcher.match(url,requestURI)){
returnmap.get(requestURI);
}
}

returnnull;
}

@Override
publicCollectiongetAllConfigAttributes(){
//TODOAuto-generatedmethodstub
returnnull;
}

/*(non-Javadoc)
*@seeorg.springframework.security.intercept.ObjectDefinitionSource#getConfigAttributeDefinitions()
*/
@SuppressWarnings("rawtypes")
publicCollectiongetConfigAttributeDefinitions(){
returnnull;
}

/*(non-Javadoc)
*@seeorg.springframework.security.intercept.ObjectDefinitionSource#supports(java.lang.Class)
*/
publicbooleansupports(@SuppressWarnings("rawtypes")Classclazz){
returntrue;
}

/**
*
*@paramfilterInvocation
*@return
*/
@SuppressWarnings("unchecked")
privateMapgetUrlAuthorities(org.springframework.security.web.FilterInvocationfilterInvocation){
ServletContextservletContext=filterInvocation.getHttpRequest().getSession().getServletContext();
return(Map)servletContext.getAttribute("urlAuthorities");
}

}

mesecurityAccessDecisionManager实现

packagecom.ultrapower.me.util.security.interceptor;

importjava.util.Collection;
importjava.util.Iterator;

importorg.springframework.security.access.AccessDecisionManager;
importorg.springframework.security.access.AccessDeniedException;
importorg.springframework.security.access.ConfigAttribute;
importorg.springframework.security.access.SecurityConfig;
importorg.springframework.security.authentication.InsufficientAuthenticationException;
importorg.springframework.security.core.Authentication;
importorg.springframework.security.core.GrantedAuthority;

publicclassSecurityAccessDecisionManagerimplementsAccessDecisionManager{

/**
*检查用户是否够权限访问资源
*authentication是从spring的全局缓存SecurityContextHolder中拿到的，里面是用户的权限信息
*object是url
*configAttributes所需的权限
*@seeorg.springframework.security.access.AccessDecisionManager#decide(org.springframework.security.core.Authentication,java.lang.Object,java.util.Collection)
*/
@Override
publicvoiddecide(Authenticationauthentication,Objectobject,
CollectionconfigAttributes)
throwsAccessDeniedException,InsufficientAuthenticationException{
//对应url没有权限时，直接跳出方法
if(configAttributes==null){
return;
}

Iteratorite=configAttributes.iterator();
//判断用户所拥有的权限，是否符合对应的Url权限，如果实现了UserDetailsService，则用户权限是loadUserByUsername返回用户所对应的权限
while(ite.hasNext()){
ConfigAttributeca=ite.next();
StringneedRole=((SecurityConfig)ca).getAttribute();
for(GrantedAuthorityga:authentication.getAuthorities()){
System.out.println(":::::::::::::"+ga.getAuthority());
if(needRole.equals(ga.getAuthority())){
return;
}
}
}
//注意：执行这里，后台是会抛异常的，但是界面会跳转到所配的access-denied-page页面
thrownewAccessDeniedException("noright");
}
@Override
publicbooleansupports(ConfigAttributeattribute){
returntrue;
}
@Override
publicbooleansupports(Classclazz){
returntrue;
}

}

4.实现AuthenticationProvider，自定义参数验证

这种验证以前项目用过，现在没有写示例代码，先写下大概流程和需要用到的类

这种验证的好处：可以在自定义登录界面添加登录时需要的参数，如多个验证码等、可以修改默认登录名称和密码的参数名

整体流程：

1.用户登录时，先经过自定义的passcard_filter过滤器，该过滤器继承了AbstractAuthenticationProcessingFilter，并且绑定了登录失败和成功时需要的处理器(跳转页面使用)

2.执行attemptAuthentication方法，可以通过request获取登录页面传递的参数，实现自己的逻辑，并且把对应参数set到AbstractAuthenticationToken的实现类中

3.验证逻辑走完后，调用this.getAuthenticationManager().authenticate(token);方法，执行AuthenticationProvider的实现类的supports方法

4.如果返回true则继续执行authenticate方法

5.在authenticate方法中，首先可以根据用户名获取到用户信息，再者可以拿自定义参数和用户信息做逻辑验证，如密码的验证

6.自定义验证通过以后，获取用户权限set到User中，用于springSecurity做权限验证

7.this.getAuthenticationManager().authenticate(token)方法执行完后，会返回Authentication，如果不为空，则说明验证通过

8.验证通过后，可实现自定义逻辑操作，如记录cookie信息

9.attemptAuthentication方法执行完成后，由springSecuriy来进行对应权限验证，成功于否会跳转到相对应处理器设置的界面。

1.自定义PassCardAuthenticationToken类，继承AbstractAuthenticationToken类，用于定义参数，需要实现的方法

/**
*凭证，用户密码
*/
@Override
publicObjectgetCredentials(){
returnpassword;
}

/**
*当事人，登录名用户Id
*/
@Override
publicObjectgetPrincipal(){
returnuserID;
}

2.User类要实现Authentication，需要实现的方法

/**
*返回用户所属权限
*/
@Override
publicCollectiongetAuthorities(){
returnthis.accesses;
}

@Override
publicObjectgetCredentials(){
returnnull;
}
@Override
publicObjectgetDetails(){
returnnull;
}
/**
*登录名称
*/
@Override
publicObjectgetPrincipal(){
returnloginName;
}
/**
*是否认证
*/
@Override
publicbooleanisAuthenticated(){
returnthis.authenticated;
}
/**
*设置是否认证字段
*/
@Override
publicvoidsetAuthenticated(booleanisAuthenticated)
throwsIllegalArgumentException{
this.authenticated=isAuthenticated;
}

3.需要userService实现AuthenticationProvider的authenticate(Authenticationauthentication)方法

@SuppressWarnings("unchecked")
@Override
publicAuthenticationauthenticate(Authenticationauthentication)
throwsAuthenticationException{
PassCardAuthenticationTokentoken=(PassCardAuthenticationToken)authentication;
/*
*这里进行逻辑认证操作，可以获取token中的属性来自定义验证逻辑，代码验证逻辑可以不用管
*如果使用UserDetailsService的实现类来验证，就只能获取userName，不够灵活
*/
if(token.getUserID()!=null&&token.getPassword()!=null){
Useruser=(User)this.getDao().executeQueryUnique("User.loadByLoginName",QueryCmdType.QUERY_NAME,token.getUserID());

Stringpassword=token.getPassword();
if(this.passwordEncoder!=null){
password=this.passwordEncoder.encodePassword(password,null);
}

if(!password.equalsIgnoreCase(user.getPassword())){

token.setErrCode("2");
returnnull;
}

if(token.isEnablePasscard()&&usePassCard){//token中激活密码卡且系统使用密码卡

intposition1=((token.getRow1()-1)*7)+token.getColumn1();
intposition2=((token.getRow2()-1)*7)+token.getColumn2();
//System.out.println("---pos:"+position1+"---"+position2);

if(user.getPassCardId()==null){
token.setErrCode("10");
returnnull;
}
PassCardpasscard=this.passCardDao.findById(user.getPassCardId(),false);

if(passcard==null||passcard.getStatus()==PassCardHelper.STATUS_CANCEL){
token.setErrCode("10");
returnnull;
}
if(passcard.getConfusedContent()==null||passcard.getConfusedContent().length()<7*7*32){
token.setErrCode("10");
returnnull;
}

Stringcontent=passcard.getConfusedContent();
intperLen=content.length()/49;
Stringstr1=content.substring((position1-1)*perLen,position1*perLen);
Stringstr2=content.substring((position2-1)*perLen,position2*perLen);
StringinputStr1=token.getCard1();
StringinputStr2=token.getCard2();
if(this.passwordEncoder!=null){
inputStr1=md5.getMD5ofStr(md5.getMD5ofStr(inputStr1));
inputStr2=md5.getMD5ofStr(md5.getMD5ofStr(inputStr2));
}

if((!str1.equalsIgnoreCase(inputStr1))||(!str2.equalsIgnoreCase(inputStr2))){
token.setErrCode("10");
returnnull;
}
}
user.setLastIp(token.getIp());
user.setLastLogin(newDate());
this.getDao().saveOrUpdate(user);
user.setAuthenticated(true);
/*
*导入一次角色权限，并且把权限set到User中，用于spring验证用户权限(getAuthorities方法)
*/
ListuserRoles=(List)this.getDao().executeQueryList("UserRole.listRoleByUserID",QueryCmdType.QUERY_NAME,-1,-1,user.getId());
Setaccesses=newHashSet();
for(UserRoleur:userRoles){
accesses.add(ur.getRole());
}
user.getOrg().getOrgName();
if(user.getOrg().getCertTypes()!=null)user.getOrg().getCertTypes().size();//延迟载入一下
user.setAccesses(accesses);
returnuser;
}
returnnull;
}

重写supports(Classauthentication)方法，authentication要

/**
*如果此处验证不通过，是不会执行authentication方法的
*/
@Override
publicbooleansupports(Classauthentication){
returnauthentication.equals(PassCardAuthenticationToken.class);
}

4.定义filter，实现AbstractAuthenticationProcessingFilter的attemptAuthentication方法，用于获取在登录页面传递过来的参数，spring默认只获取userName(j_username)，password(j_username)，而且实现UserDetailsService时只传递username

importjava.io.IOException;
importjava.util.Date;

importjavax.servlet.ServletException;
importjavax.servlet.http.Cookie;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
importjavax.servlet.http.HttpSession;

importorg.apache.log4j.Logger;
importorg.springframework.security.core.Authentication;
importorg.springframework.security.core.AuthenticationException;
importorg.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
importorg.springframework.util.StringUtils;

importcn.edu.jszg.cert.user.UserLog;
importcn.edu.jszg.cert.user.UserLogService;
importcn.edu.jszg.cert.web.WebApplicationConfiguration;
importcn.edu.jszg.cert.web.controller.portal.auth.RemoteDataValidator;

importcom.google.code.kaptcha.servlet.KaptchaServlet;

publicclassPasscardAuthenticationProcessingFilterextends
AbstractAuthenticationProcessingFilter{
privateStringsuccessPage="/home/admin/index";
privateStringfailurePage="/public/adminLoginEntry";
privatebooleanforward=false;
privatebooleanuseVerifyCode=true;
privateStringcertLoginUrl;

staticLoggerlogger=Logger.getLogger(PasscardAuthenticationProcessingFilter.class);

privateWebApplicationConfigurationconfig;
privateUserLogServiceuserLogService;

publicvoidsetConfig(WebApplicationConfigurationconfig){
this.config=config;
}

/**
*实现AbstractAuthenticationProcessingFilter的有参构造
*没记错的话，相当于该filter的访问路径
*/
protectedPasscardAuthenticationProcessingFilter(){
super("/adminLoginCheck");
}

publicvoidsetUseVerifyCode(booleanuseVerifyCode){
this.useVerifyCode=useVerifyCode;
}

publicvoidsetUserLogService(UserLogServiceuserLogService){
this.userLogService=userLogService;
}

publicbooleanvalidate(HttpServletRequestrequest){
StringuserId=request.getParameter("username");
Stringmd2=request.getParameter("m");
Stringl=request.getParameter("l");
if(userId==null||md2==null||l==null){
returnfalse;
}
longlongTime=Long.parseLong(l);
if(longTime
最后为spring-security配置文件中的配置，需要添加authentication-provider的引用，和filter的配置


















还要在http中添加
到此这篇关于详解springsecurity四种实现方式的文章就介绍到这了,更多相关springsecurity实现方式内容请搜索毛票票以前的文章或继续浏览下面的相关文章希望大家以后多多支持毛票票！

详解spring security四种实现方式

热门推荐

随机推荐