Java 框架的安全性特征：如何保障应用程序安全？

@PostMapping("/register") 内容来自samhan666

public String register(@Valid @ModelAttribute User user) {

if (bindingResult.hasErrors()) {

return "register"; 本文来自zvvq

}

内容来自zvvq

// 保存用户

zvvq

return "redirect:/home"; zvvq好，好zvvq

} 内容来自samhan666

// 使用 Spring Security 内置的 XSS 防护 本文来自zvvq

@Configuration zvvq.cn

public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 本文来自zvvq

@Override 内容来自samhan666

protected void configure(HttpSecurity http) throws Exception { copyright zvvq

http.headers().contentSecurityPolicy(stdCsp -> stdCsp.xssProtection().block(ContentSecurityPolicy.BlockDirective.ALL)); 内容来自zvvq，别采集哟

} 内容来自zvvq，别采集哟

} zvvq好，好zvvq

// 使用 Spring Security CSRF 保护 zvvq好，好zvvq

@Configuration 内容来自zvvq，别采集哟

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

本文来自zvvq

@Override

protected void configure(HttpSecurity http) throws Exception {

http.csrf().

csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());

} zvvq

}

// 使用 Spring Security 定义方法级安全 内容来自samhan

@PreAuthorize("hasRole(ADMIN)")

public String deleteUser(Long id) { zvvq.cn

// 删除用户

return "redirect:/users";

}

内容来自zvvq，别采集哟

import org.springframework.beans.factory.annotation.Autowired; zvvq.cn

import org.springframework.security.<a style=color:f60; text-decoration:underline; href="https://www.php.cn/zt/16380.html" target="_blank">access</a>.annotation.Secured; 内容来自zvvq，别采集哟

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

内容来自samhan

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.core.userdetails.UserDetailsService; zvvq

import org.springframework.security.crypto.password.PasswordEncoder; zvvq.cn

import org.springframework.stereotype.Controller; 本文来自zvvq

import org.springframework.web.bind.annotation.GetMapping;

zvvq.cn

// Spring Security 配置类 本文来自zvvq

public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 内容来自zvvq

@Autowired

内容来自samhan

private UserDetailsService userDetailsService;

zvvq

@Autowired 内容来自samhan

private PasswordEncoder passwordEncoder; zvvq好，好zvvq

@Override

内容来自samhan

protected void configure(AuthenticationManagerBuilder auth) throws Exception {

auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder);

zvvq好，好zvvq

}

} 本文来自zvvq

// 用户控制器

@Controller

public class UserController {

zvvq好，好zvvq

@GetMapping("/user") 内容来自samhan666

@Secured("ROLE_USER") 内容来自zvvq

public String user() { zvvq

return "user"; zvvq好，好zvvq

}

@GetMapping("/admin")

@Secured("ROLE_ADMIN")

public String admin() {

zvvq好，好zvvq

return "admin"; zvvq好，好zvvq

}

zvvq好，好zvvq

} zvvq.cn