1
<!--设置可以用spring的el表达式配置Spring Security并自动生成对应配置组件（过滤器）-->
2
<security:http auto-config="true" use-expressions="true">
3
    <!--省略其余配置-->
4
    <!--开启remember me过滤器，设置token存储时间为60秒-->
5
    <security:remember-me token-validity-seconds="60"/>
6
</security:http>

1
CREATE TABLE `persistent_logins` (
2
`username` varchar(64) NOT NULL,
3
`series` varchar(64) NOT NULL,
4
`token` varchar(64) NOT NULL,
5
`last_used` timestamp NOT NULL,
6
PRIMARY KEY (`series`)
7
) ENGINE=InnoDB DEFAULT CHARSET=utf8

1
<!--
2
开启remember me过滤器，
3
data-source-ref="dataSource" 指定数据库连接池
4
token-validity-seconds="60" 设置token存储时间为60秒 可省略
5
remember-me-parameter="remember-me" 指定记住的参数名 可省略
6
-->
7
<security:remember-me data-source-ref="dataSource"
8
token-validity-seconds="60" remember-me-parameter="remember-me"/>

1
<!--
2
开启权限控制注解支持
3
jsr250-annotations="enabled"    表示支持jsr250-api的注解，需要jsr250-api的jar包
4
pre-post-annotations="enabled"  表示支持spring表达式注解
5
secured-annotations="enabled"   这才是SpringSecurity提供的注解
6
-->
7
<security:global-method-security jsr250-annotations="enabled"
8
pre-post-annotations="enabled"
9
secured-annotations="enabled"/>

1
@Controller
2
@RequestMapping("/product")
3
public class ProductController {
4

5
    //@Secured({"ROLE_PRODUCT","ROLE_ADMIN"})//springSecurity内部制定的注解
6
    //@RolesAllowed({"ROLE_PRODUCT","ROLE_ADMIN"})//jsr250注解
7
    @PreAuthorize("hasAnyAuthority('ROLE_PRODUCT','ROLE_ADMIN')")//spring的el表达式注解
8
    @RequestMapping("/findAll")
9
    public String findAll(){
10
        return "product-list";
11
    }
12
}

1
<!--设置可以用spring的el表达式配置Spring Security并自动生成对应配置组件（过滤器）-->
2
<security:http auto-config="true" use-expressions="true">
3
<!--省略其它配置-->
4
<!--403异常处理-->
5
<security:access-denied-handler error-page="/403.jsp"/>
6
</security:http>

1
@Component
2
public class HandlerControllerException implements HandlerExceptionResolver {
3
    /**
4
     * @param httpServletRequest
5
     * @param httpServletResponse
6
     * @param o  出现异常的对象
7
     * @param e  出现的异常信息
8
     * @return   ModelAndView
9
     */
10
    @Override
11
    public ModelAndView resolveException(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) {
12
        ModelAndView mv = new ModelAndView();
13
        //将异常信息放入request域中，基本不用
14
        mv.addObject("errorMsg", e.getMessage());
15
        //指定不同异常跳转的页面
16
        if(e instanceof AccessDeniedException){
17
            mv.setViewName("redirect:/403.jsp");
18
        }else {
19
            mv.setViewName("redirect:/500.jsp");
20
        }
21
        return mv;
22
    }
23
}

1
@ControllerAdvice
2
public class HandlerControllerAdvice{
3

4
    @ExceptionHandler(AccessDeniedException.class)
5
    public String handlerException(){
6
        return "redirect:/403.jsp";
7
    }
8

9
    @ExceptionHandler(RuntimeException.class)
10
    public String runtimeHandlerException(){
11
        return "redirect:/500.jsp";
12
    }
13
}