前端页面表单

 <input type="checkbox" name="remember-me"  value="true"/> Remember me <!-- _spring_security_remember_me 远古版本 -->
 <input type="checkbox" name="_spring_security_remember_me"  value="true"/> Remember me

配置(基于xml)

<http auto-config="false" access-denied-page="/login.htm"
		entry-point-ref="authenticationEntryPoint">
    <intercept-url pattern="/images/*" filters="none"/>.......        <!-- 插入 过滤链-->
        <custom-filter ref="rememberMeFilter" position="REMEMBER_ME_FILTER" /> -->        <custom-filter ref="captchaAuthenticaionFilter" position="FORM_LOGIN_FILTER" />
        .......</http>
 <!-- dv2它其实是继承UsernamePasswordAuthenticationFilter(捕获用户密码 填充Authentication 见上认证流程) --><beans:bean id="captchaAuthenticaionFilter" class="net.jk.auth.service.CaptchaAuthenticationFilter">
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="authenticationFailureHandler" ref="authenticationFailureHandler" />
    <beans:property name="authenticationSuccessHandler" ref="authenticationSuccessHandler" />
     <!-- rememberMeServices (生成cookie的入口)
     RememberMeAuthenticationFilter是排在UsernamePasswordAuthenticationFilter之后的. 在第一次登录时(如果勾选了remember me), 在验证信息正确后, AbstractAuthenticationProcessingFilter(UsernamePasswordAuthenticationFilter的父类)最后会调用一个叫successfulAuthentication()的方法 -->
    <beans:property name="rememberMeServices" ref="tokenBasedRememberMeServices" />
    <beans:property name="filterProcessesUrl" value="/j_spring_security_check" /></beans:bean>
 <!-- 需要一个过滤器, (这应该是 认证的入口)插入到过滤链中 --><beans:bean id="rememberMeFilter" class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">
	<beans:property name="authenticationManager" ref="authenticationManager" />
	<beans:property name="rememberMeServices" ref="tokenBasedRememberMeServices" /></beans:bean><!-- 认证提供器(认证) --><beans:bean id="rememberMeAuthenticationProvider" class="org.springframework.security.authentication.RememberMeAuthenticationProvider">
	<beans:property name="key" value="1C6D97ACA4924F81926E7B302D14DB6D"/></beans:bean>
 <!-- RememberMeServices (生成cookie) --><beans:bean id="tokenBasedRememberMeServices" class="org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
	<beans:property name="key" value="1C6D97ACA4924F81926E7B302D14DB6D" />
	<beans:property name="userDetailsService" ref="userDetailsService" /></beans:bean>

登陆后 , 默认应该会有一个 SPRING_SECURITY_REMEMBER_ME_COOKIE 名字的cookie

• remember-me属性详解
  remember-me属性是spring security命名空间中实现自动登录的专属配置项,它有如下属性

1. key: 这个"key"属性用来辨别分辨不同项目的cookie
2. authentication-success-handler-ref 指向一个AuthenticationSuccessHandler
3. data-source-ref 指向一个DataSource数据源
4. remember-me-cookie: cookie存放的名称.默认为’remember-me’.
5. remember-me-parameter: 触发自动登录的请求参数名称.默认为’remember-me’.
6. services-alias: 声明一个内部定义的RememberMeServices的bean的别名,提供给程序的其他bean使用
7. services-ref: 指向一个RememberMeServices,可以自定义实现自己的自动登录逻辑
8. token-repository-ref: 指向一个PersistentTokenRepository bean,用来实现持久化令牌的自动登录
9. token-validity-seconds: cookie存在的时间周期,单位为秒
10. use-secure-cookie: 是否设置"secure"标志,具体使用不详
11. user-service-ref: 指向一个UserDetailsService的bean

spring-security 3.0.8 远古版本文档
参考spring-security 文档: Remember-Me Authentication 章节

在代码中设置 SecurityContextHolder 为登陆状态

///load userDetails ...UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authentication);

SecurityContextHolder 的原理

SecurityContextHolder 用于存储安全上下文(security context)的信息，即一个存储身份信息，认证信息等的容器。
SecurityContextHolde 默认使用  ThreadLocal 策略来存储认证信息，即一种与线程绑定的策略，每个线程执行时都可以获取该线程中的安全上下文(security context)，各个线程中的安全上下文互不影响。

Sectrity 配置 (Java Bean形式)

@Configurationpublic class DefaultSecurityConfig extends WebSecurityConfigurerAdapter {    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
    log.info("当前使用安全配置是: default");
    httpSecurity.headers(mip.fovkj.com).frameOptions().disable();//iframe 
    ExpressionInterceptUrlRegistry eiur=httpSecurity        // 禁用 CSRF
        .csrf().disable()        // 授权异常
        .exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint() ).and()
        .addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)        // 不创建会话
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()        // 过滤请求
        .authorizeRequests()
        .antMatchers(
                HttpMethod.GET,                "/*.html",                "/**/*.html",                "/**/*.css",                "/**/*.js"
        ).anonymous()        // 支付宝回调
        .antMatchers("/api/aliPay/return").anonymous()
        .antMatchers("/api/aliPay/notify").anonymous()        //微信公众号回调
        .antMatchers("/api/wechat/core").permitAll()        
        //登陆接口
        .antMatchers("/auth/**").permitAll()        
        // swagger start
        .antMatchers("/swagger-ui.html").anonymous()
        .antMatchers("/swagger-resources/**").anonymous()
        .antMatchers("/webjars/**").anonymous()
        .antMatchers("/*/api-docs").anonymous()
        .antMatchers("/*/api-docs-ext").anonymous()        // swagger end
        // 接口限流测试
        .antMatchers("/test/**").anonymous()
        .antMatchers(HttpMethod.OPTIONS, "/**").anonymous()
        .antMatchers("/druid/**").anonymous()        //rest接口
        .antMatchers("/api/rest/**").anonymous();        //除此之外所有地址都需要验证
        httpSecurity.authorizeRequests().anyRequest().authenticated();
    }
    ...
}

一个简单内存认证

@Configuration@Order(1)public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {    @Bean
    public UserDetailsService userDetailsService()  {        // ensure the passwords are encoded properly
        User.UserBuilder users = User.withDefaultPasswordEncoder();        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(users.username("yang").password("123..").roles("USER").build());        //manager.createUser(users.username("admin").password("dfgddd").roles("USER","ADMIN").build());
        return manager;
    }    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin()
                .successForwardUrl("/index.html")
                .and(soccer.zu.zuq8.info)
                .authorizeRequests().anyRequest().authenticated();
    }

• 找到./WEB-INF/deployerConfigContext.xml 文件,修改

1. 注释

    <bean id="primaryAuthenticationHandler"
          class="org.jasig.cas.authentication.AcceptUsersAuthenticationHandler">
        <property name="users">
            <map>
                <entry key="casuser" value="Mellon"/>
            </map>
        </property>
    </bean>

1. 增加

<!-- from 数据库 --><bean id="dataSource"
        class="org.springframework.jdbc.datasource.DriverManagerDataSource">
        <property name="driverClassName" value="net.sourceforge.jtds.jdbc.Driver" />
        <property name="url"
            value="jdbc.url=jdbc:jtds:sqlserver://127.0.0.1:1433/asp-gdagri-auth;useUnicode=true;charset=GB2312" />
        <property name="username" value="user_dev" />
        <property name="password" value="user@dev" />
    </bean>
    
    <bean id="primaryAuthenticationHandler"
          class="org.jasig.cas.adaptors.jdbc.QueryDatabaseAuthenticationHandler"
          p:dataSource-ref="dataSource"
          p:passwordEncoder-ref="MD5PasswordEncoder"
          p:sql="select password from bs_role where name=?" />
          
    <bean id="MD5PasswordEncoder"gov.mx.zuzb.info class="org.jasig.cas.authentication.handler.DefaultPasswordEncoder">
        <constructor-arg index="0">
            <value>MD5</value>
        </constructor-arg>
    </bean>