spring Scurity终于测试OK了，复杂的功能还待深入研究！发布出来一起探讨吧！
就是因 为研究它，我的个天啦！头都大了一圈！还待修改完整版！我的目标不是每个项目拿到它就能使用！到时再说啦。。。
虽然只是一个登陆，但里面的知识真是太广了！什么md5 盐值 加密 生成,cookie 生成序列保存数据库，
sessionID防护的一大堆安全，资源权限分配和保护 等。。。值得一学的框架!
sql 脚本也在项目一起
项目源码下载：http://download.csdn.net/detail/liangrui1988/5916359
官方文档：http://static.springsource.org/spring-security/site/docs/3.0.x/reference/springsecurity.html
jar 下载 http://www.springsource.org/download/community
项目图片：
部分代码：
applicationContext-security2.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans
xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security.xsd">
<!-- 使用security="none"忽略所有过滤器会提升性能，而是用匿名登录功能可以实现权限操作的一致性，
具体应用时还需要大家根据实际情况自行选择了。
<http pattern="/" security="none"/> -->
<http pattern="/image" security="none"/>
<!--entry-point-ref="" 未登录的切入点
servlet-api-provision="true" 默认启用 保存没有登录之前的请求
access-denied-page="" 被拦截之后的页面-->
<http auto-config="true" entry-point-ref="myAuthenticationEntryPoint"
access-denied-page="/error/page403.jsp" >
<!-- 在配置文件中使用auto-config="true"就会启用匿名登录功能。在启用匿名登录之后，
如果我们希望允许未登录就可以访问一些资源，可以在进行如下配置。 IS_AUTHENTICATED_ANONYMOUSLY=ROLE_ANONYMOUS-->
<intercept-url pattern="/" access="ROLE_ANONYMOUS"/>
<anonymous username="游客"/>
<!-- 只要登 陆的用户都可以访问项目资源 除了受保护的次源 -->
<intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
<!-- 自定义过滤器 在之前执行 -->
<custom-filter ref="filterSecurityInterceptor" before="FILTER_SECURITY_INTERCEPTOR" />
<!-- 切换用户 -->
<custom-filter position="SWITCH_USER_FILTER" ref="switchUserProcessingFilter" />
<!-- 获取 ip -->
<custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrentSessionFilter"/>
<!-- 用户退出 session无效 -->
<logout invalidate-session="true"
logout-url="/j_spring_security_logout" />
<!-- 保存cookie 保存用户名密码多长时间-->
<!--60*60*24*7=604800= 一个星期的秒数 -->
<remember-me key="myApp" token-validity-seconds="604800" data-source-ref="authoritiesData" />
<!-- 用户登陆 默认跳转页面 and 失败面页 -->
<form-login default-target-url="/index.jsp" authentication-failure-url="/login.jsp?error=true"/>
<!-- 防御会话伪造 none，migrateSession和newSession。默认使用的是migrationSession，
<session-management session-fixation-protection="migrateSession"/>-->
<!-- 会话管理 默认30分钟 ，空闲30分钟后，自动销毁
session-authentication-strategy 会话认证策略 session-authentication-strategy-ref="currentControllerStrategy" -->
<session-management invalid-session-url="/login.jsp"
session-authentication-strategy-ref="currentControllerStrategy"/>
<!-- <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
</session-management> -->
<!-- 允许同时登陆几个，如果溢出这个数则报异常 -->
<!-- error-if-maximum-exceeded="true"=不允许把在线用户踢出去-->
</http>
<!--注意必须放在用来验证权限的FilterSecurityInterceptor之后，这样可以控制当前用户是否拥有切换用户的权限 -->
<beans:bean id="switchUserProcessingFilter"
class="org.springframework.security.web.authentication.switchuser.SwitchUserFilter" autowire="byType">
<beans:property name="targetUrl" value="/manager.jsp"/>
</beans:bean>
<!-- 未登录的切入点 -->
<beans:bean id="myAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<beans:property name="loginFormUrl" value="/login.jsp"></beans:property>
</beans:bean>
<!-- 认证管理 -->
<authentication-manager>
<authentication-provider>
<!-- md5加密 -->
<password-encoder hash="md5">
<!-- 盐值加密 -->
<salt-source user-property="username"/>
</password-encoder>
<!-- 数据库是自定义的，所以要修改sql查询语句 用户信息 和 权限信息 -->
<jdbc-user-service data-source-ref="authoritiesData"
users-by-username-query="select username,password,status as enabled
from user
where username=?"
authorities-by-username-query="select u.username,r.name as authority
from user u
join user_role ur
on u.id=ur.user_id
join role r
on r.id=ur.role_id
where u.username=?"/>
</authentication-provider>
</authentication-manager>
<!-- 过虑拦截器 作用:就是把自定义的数据库查询字段 封装成security规范 的字段-->
<beans:bean id="filterSecurityInterceptor"
class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor" autowire="byType">
<beans:property name="securityMetadataSource" ref="filterInvocationSecurityMetadataSource" />
<beans:property name="authenticationManager" ref="org.springframework.security.authenticationManager"/>
</beans:bean>
<!-- 替换原有功能的切入点 从数据库里查询出数据 资源==角色 注入数据库源 和查询结果的sql语句
把受保护的资源(jsp页面)写入到数据库中 需要这样的配置-->
<beans:bean id="filterInvocationSecurityMetadataSource"
class="accp.util.JdbcFilterInvocationDefinitionSourceFactoryBean">
<beans:property name="dataSource" ref="authoritiesData"/>
<beans:property name="resourceQuery" value="
select re.res_string,r.name
from role r
join resc_role rr
on r.id=rr.role_id
join resc re
on re.id=rr.resc_id
order by re.priority
"/>
</beans:bean>
<!-- 提示信息 国际化-->
<beans:bean id="messageSource" class="org.springframework.context.support.ReloadableResourceBundleMessageSource">
<beans:property name="basename" value="classpath:messages_zh_CN"/>
</beans:bean>
<!-- 获取用户 ip 和用户绑定，（如是果设了最大会话为1，不用担心没注销用户，无法再登陆！）
这样在同一个电脑是可以重复登陆， -->
<beans:bean id="concurrentSessionFilter"
class="org.springframework.security.web.session.ConcurrentSessionFilter">
<beans:property name="sessionRegistry" ref="sessionRegistry"/>
</beans:bean>
<beans:bean id="sessionRegistry"
class="accp.myFilter.SmartSessionRegistry"/>
<beans:bean id="currentControllerStrategy"
class="accp.myFilter.SmartConcurrentSessionControlStrategy">
<beans:constructor-arg ref="sessionRegistry"/>
<!-- 允许同时登陆几个，如果溢出这个数则报异常 -->
<!-- error-if-maximum-exceeded="true"=不允许把在线用户踢出去 -->
<beans:property name="exceptionIfMaximumExceeded" value="true"/>
<beans:property name="maximumSessions" value="1"/>
</beans:bean>
<!-- 记录日志 -->
<beans:bean class="accp.myFilter.AuditListener"/>
</beans:beans>
applicationContext-action.xml
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd "> <!--*************************注入services层接口到action******************************--> <!-- 用户action 注入services接口 --> <bean id="userAction" class="accp.action.UserAction"> <property name="services" ref="userServices"/> <property name="baseUserServices" ref="baseServices"/> <property name="baseRoleServices" ref="baseServices"/> </bean> <!-- registerAction 注入services接口 --> <bean id="userRegisterAction" class="accp.action.RegisterAction"> <property name="services" ref="userServices"/> <property name="baseUserServices" ref="baseServices"/> <property name="baseRoleServices" ref="baseServices"/> </bean> <!-- resc action --> <bean id="rescAction" class="accp.action.RescAction"> <property name="rescServices" ref="rescServices"/> <property name="baseRescServices" ref="baseServices"/> <property name="baseRoleServices" ref="baseServices"/> </bean> <!-- role action --> <bean id="roleAction" class="accp.action.RoleAction"> <property name="roleServices" ref="roleServices"/> <property name="baseRoleServices" ref="baseServices"/> <property name="baseRescServices" ref="baseServices"/> </bean> </beans>
applicationContext-service.xml
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd "> <!--*************************hibernateTemplate******************************--> <!-- BaseDaoImpl注入 hibernateTemplate--> <bean id="baseDao" class="accp.dao.imple.BaseDaoImpl"> <property name="hibernateTemplate" ref="hibernateTemplate"/> </bean> <!-- RescDaoImpl注入 hibernateTemplate || parent父类是谁 同样实现的继承关系--> <bean id="rescDao" class="accp.dao.imple.RescDaoImpl" parent="baseDao"> <!-- <property name="hibernateTemplate" ref="hibernateTemplate" /> --> </bean> <!-- RoleDaoImpl注入 hibernateTemplate--> <bean id="roleDao" class="accp.dao.imple.RoleDaoImpl" parent="baseDao"> </bean> <!-- UserDaoImpl注入 hibernateTemplate --> <bean id="userDao" class="accp.dao.imple.UserDaoImpl" parent="baseDao"> <!-- <property name="hibernateTemplate" ref="hibernateTemplate" /> --> </bean> <!--*************************注入dao层接口到services层******************************--> <!-- baseDao到业务层 parent="baseDao"--> <bean id="baseServices" class="accp.services.imple.BaseServicesImple" > <property name="basedao" ref="baseDao"/> </bean> <!-- user 方便真接调用基本操作类 hibernateTemplate--> <bean id="userServices" class="accp.services.imple.UserServicesImple"> <property name="userDao" ref="userDao"/> </bean> <!-- 角色 --> <bean id="roleServices" class="accp.services.imple.RoleServicesImple"> <property name="roleDao" ref="roleDao"/> </bean> <!-- 资源 --> <bean id="rescServices" class="accp.services.imple.RescServicesImple"> <property name="rescDao" ref="rescDao"/> </bean> </beans>
UserAction.java
package accp.action;
import java.io.PrintWriter;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Set;
import javax.servlet.http.HttpServletResponse;
import org.apache.struts2.ServletActionContext;
import org.springframework.security.authentication.encoding.Md5PasswordEncoder;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import accp.bean.Role;
import accp.bean.User;
import accp.services.BaseServices;
import accp.services.RoleServices;
import accp.services.UserServices;
import com.opensymphony.xwork2.ActionSupport;
/**
* 用户管理Action
* @author liangrui
* @qq382453602
*
*/
public class UserAction extends ActionSupport {
private User user;
private List<User> listUser;//用户集合
private List<Role> roleList;//角色集合
private UserServices services;//用户接口
private BaseServices<User,Long> baseUserServices;//基本user业务
private BaseServices<Role,Long> baseRoleServices;//基本role业务
private String enabled;//是否生效
public List<Role> getRoleList() {
return roleList;
}
public void setRoleList(List<Role> roleList) {
this.roleList = roleList;
}
public void setBaseUserServices(BaseServices<User, Long> baseUserServices) {
this.baseUserServices = baseUserServices;
}
public void setBaseRoleServices(BaseServices<Role, Long> baseRoleServices) {
this.baseRoleServices = baseRoleServices;
}
public String getEnabled() {
return enabled;
}
public void setEnabled(String enabled) {
this.enabled = enabled;
}
public UserServices getServices() {
return services;
}
public List<User> getListUser() {
return listUser;
}
public void setListUser(List<User> listUser) {
this.listUser = listUser;
}
public User getUser() {
return user;
}
public void setUser(User user) {
this.user = user;
}
public void setServices(UserServices services) {
this.services = services;
}
/*************************login*********************************/
public String logins() throws Exception {
System.out.println("login:"+user.getUsername());
User user2=services.getLogin(user);
if(null==user2){
return "notUser";
}
if("admin".equals(user2.getUsername())){
return "adminPage";
}
System.out.println(user2.getUsername());
return SUCCESS;
}
/************************连接到admin.jsp页面***********************************/
public String fowaredAdmin() throws Exception {
System.out.println("获取u p中-------....");
printUserInfo();
System.out.println("转到admin.jsp面面");
return "adminPage";
}
/************************打印信息：用户名***********************************/
public void printUserInfo(){
System.out.println("获取principal 中");
String userName="";
//获取安全上下文内容
/*SecurityContext sc=SecurityContextHolder.getContext();
Authentication atc=sc.getAuthentication();//获取认证对象
//获取主体对象
Object obj=atc.getPrincipal();
if(obj instanceof UserDetails){
//获取用户详细内容对象
UserDetails ud=(UserDetails)obj;
userName=ud.getUsername();
}else{
userName=obj.toString();
}*/
//api 原代码
Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
if (principal instanceof UserDetails) {
userName = ((UserDetails)principal).getUsername();
} else {
userName = principal.toString();
}
System.out.println("u: "+userName);
}
/************************hello***********************************/
public String hello() throws Exception {
//printUserInfo();
System.out.println("开始调用方法....");
String moedth=services.sayHello("刘备");
System.out.println(moedth);
return "indexs";
}
/************************bye***********************************/
public String bye() throws Exception {
//printUserInfo();
System.out.println("开始调用方法..");
String moedth=services.sayBye("张飞");
System.out.println(moedth);
return "indexs";
}
/************************ajax判断是否有用户名**********************************/
public String ajaxIsUser() throws Exception {
// TODO Auto-generated method stub
System.out.println("ajax来了！开始行动...........: "+user.getUsername());
boolean b=services.getAjaxIsUserName(user.getUsername());
//获取响应对象
HttpServletResponse response=ServletActionContext.getResponse();
PrintWriter out = response.getWriter();
String bb="";
if(b)bb="true";else bb="false";
System.out.println("b: "+bb);
out.print(bb);
return null;
}
/************************显示所有用户信息**********************************/
public String showUserInfo() throws Exception {
listUser=baseUserServices.getAll(new User());
return "showUser";
}
/**************************删除用户****************************************/
public String deleteUser() throws Exception {
try {
System.out.println("du: id "+user.getId());
baseUserServices.delete(user);
} catch (Exception e) {
e.printStackTrace();
return "error";
}
return "deleteUserOK";
}
/**************************修改用户 查询信息 并显示************************************/
public String updateUser() throws Exception {
try {
user=baseUserServices.getTInId(user,user.getId());
//查询角色
System.out.println("开始查询role----");
roleList=baseRoleServices.getAll(new Role());
} catch (Exception e) {
return "error";
}
return "updateEidt";
}
/**************************保存修改后的用户************************************/
public String updateSave() throws Exception {
try {
Md5PasswordEncoder md5 = new Md5PasswordEncoder();
String passwordMD5=md5.encodePassword(user.getPassword(), user.getUsername());
user.setPassword(passwordMD5);
//封装角色集合
Set<Role> rolesSet=new HashSet<Role>();
//取到权限的对象
Set set=user.getRoles();
Iterator it=set.iterator();
while(it.hasNext()){
//根据id查询对象
Long roleID=Long.valueOf(it.next().toString());
//System.out.println(roleID);
Role role=baseRoleServices.getTInId(new Role(),roleID);
rolesSet.add(role);
}
user.setRoles(rolesSet);//将角色加入用户对象里
//是否生效
if(null==enabled){
user.setStatus(0);
}else{
user.setStatus(1);
}
System.out.println(user.getId()+user.getUsername()+user.getPassword());
//通过传过来的角色id获取角色对象
baseUserServices.update(user);
} catch (Exception e) {
return "error";
}
return "updateOk";
}
/*********************通对对象条件查询****************************/
public String searchUser() throws Exception {
if(null!=user){
listUser=baseUserServices.getTInName(user);
}
return "showUser";
}
/*************************显示所有角色*************************/
public String displayRole() throws Exception {
System.out.println("开始查询role----");
roleList=baseRoleServices.getAll(new Role());
return "addUsersAndShowRole";
}
}
BaseServices.java
package accp.services;
import java.io.Serializable;
import java.util.List;
import accp.dao.BaseDao;
import accp.dao.imple.BaseDaoImpl;
/**
*
* @author liangrui
* @qq 382453602
* @param <T> 泛型类
* @param <PK> 主健
* 基本数据操作 业务层
* 都 可以来这时调用 增、删、改、查
*/
public interface BaseServices<T,PK extends Serializable > /* extends BaseDao<T,PK>*/{
public PK save(T t);
public void delete(T t);
public void update(T t);
/***根据对象 获取对象集合**/
public List<T> getAll(T t);
/***通过id 获取对象集合**/
public T getTInId(T t,PK pk);
/***根据名称 获取对象集合**/
public List<T> getTInName(T t) throws Exception;
}
BaseDao.java
package accp.dao;
import java.io.Serializable;
import java.util.List;
/**
*
* @author liangrui
* @qq 382453602
* @param <T> 泛型类
* @param <PK> 主健
* 基本数据操作 代业务层 数据层 什么层层的
* 都 可以来这时调用 增、删、改、查
*/
public interface BaseDao<T,PK extends Serializable> {
public PK save(T t);
public void delete(T t);
public void update(T t);
/***根据对象 获取对象集合**/
public List<T> getAll(T t);
/***通过id 获取对象集合**/
public T getTInId(T t,PK pk);
/***根据对象条件 获取对象集合**/
public List<T> getTInName(T t) throws Exception;
}
BaseDaoImpl.java
package accp.dao.imple;
import java.io.Serializable;
import java.lang.reflect.Field;
import java.lang.reflect.ParameterizedType;
import java.lang.reflect.Type;
import java.util.ArrayList;
import java.util.List;
import java.util.Set;
import accp.util.GenericsUtils;
import org.springframework.orm.hibernate3.support.HibernateDaoSupport;
import accp.dao.BaseDao;
public class BaseDaoImpl<T,PK extends Serializable> extends HibernateDaoSupport implements BaseDao<T, PK> {
private Class clas ;
//得到类
public BaseDaoImpl(){
/**
* 得到泛型的类
* 即 BaseDaoImpl<Users> 得到Users
* 类的超类>>>现在类型的 论据
*/
clas = GenericsUtils.getSuperClassGenricType(getClass());
}
public PK save(T t) {
//System.out.println("T:" +t.getClass().getSimpleName());
return (PK) this.getHibernateTemplate().save(t);
}
public void delete(T t) {
this.getHibernateTemplate().delete(t);
}
public void update(T t) {
this.getHibernateTemplate().update(t);
}
public List<T> getAll(T t) {
// 根据对象 得到对像集合
String objName=t.getClass().getSimpleName();//得到 对象名
//System.out.println(objName);
return this.getHibernateTemplate().find("from "+objName);
}
/********************通过id获取对象****************************/
public T getTInId(T t,PK pk) {
/*String objName=clas.getClass().getSimpleName();//得到 对象名
System.out.println(clas +" : "+objName +" PK: "+pk);*/
return (T) this.getHibernateTemplate().get(t.getClass(),pk);
}
/************************************************************
*通过传送过来的对象值做为条件 查询
*并得到反回的集合
************************************************************/
@SuppressWarnings("unchecked")
public List<T> getTInName(T t) throws Exception {
//得到对象的字段 就是查询条件
String objName=t.getClass().getSimpleName();
//拼接条件
StringBuffer hql=new StringBuffer("from "+objName);
hql.append(" where 1=1");
Field [] objFileds =t.getClass().getDeclaredFields();
Object [] SqlParamter = null;
List<Object> SqlParamters=new ArrayList<Object>();
for(int i=0;i<objFileds.length;i++){
Field fileld=objFileds[i];
fileld.setAccessible(true);//可进入的
Object objT=fileld.get(t);
//得到值
if(!"".equals(objT)&&null!=objT){
if(fileld.getName().equals("id")){
if(Integer.parseInt(objT.toString())>0){//不为0
//如果是id则 则直接处理
return this.getHibernateTemplate().
find("from "+objName +" where id="+objT);
}
}else if(objT instanceof Set){//如果是集合
//可以断续追加对象 条件
}else{
System.out.println(fileld.getName()+" value: "+objT);
hql.append(" and "+fileld.getName()+"=?");
SqlParamters.add(objT);
//SqlParamter[i]=objT;
}
}
}
//如果没有任条件的对象 ，则返回所有数据
if(null==SqlParamters||SqlParamters.size()<=0){
return this.getHibernateTemplate().find("from "+objName);
}
//把集合中的数据 转入数组
SqlParamter=new Object[SqlParamters.size()];
for(int i=0;i<SqlParamters.size();i++){
SqlParamter[i]=SqlParamters.get(i);
}
//excute
return this.getHibernateTemplate().find(hql.toString(),SqlParamter);
}
}
UserServicesImple.java
package accp.services.imple;
import java.io.Serializable;
import java.util.Iterator;
import java.util.List;
import java.util.Set;
import org.springframework.orm.hibernate3.support.HibernateDaoSupport;
import accp.bean.Resc;
import accp.bean.Role;
import accp.bean.User;
import accp.dao.UserDao;
import accp.dao.imple.BaseDaoImpl;
import accp.services.UserServices;
/**
*
* @author liangrui
* 基本操做可以调用BaseDao时的方法
* 用户业务处理层
* extends BaseDaoImpl<User,Integer>
*
*/
public class UserServicesImple implements UserServices {
private UserDao userDao;//用户数据层接口
public UserDao getUserDao() {
return userDao;
}
public void setUserDao(UserDao userDao) {
this.userDao = userDao;
}
public String sayHello(String name) {
System.out.println("进来了!!!");
return "hello:"+name;
}
public String sayBye(String name) {
// TODO Auto-generated method stub
return "bay:"+name;
}
/**************ajax判断是否有重复名字*********************/
public boolean getAjaxIsUserName(String name) {
return userDao.getAjaxIsUserName(name);
}
/***************************用户登陆***************************/
public User getLogin(User u) {
// TODO Auto-generated method stub
//List<User> list=super.getAll(u);
List list=userDao.getAll(u);
if(null==list||list.size()<=0){
return null;
}else {
return (User) list.get(0);
}
}
/***register***/
public User saveUser(User u){
try {
userDao.save(u);
} catch (Exception e) {
e.printStackTrace();
return null;
}
return u;
}
}
struts_user.xml
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE struts PUBLIC
"-//Apache Software Foundation//DTD Struts Configuration 2.3//EN"
"http://struts.apache.org/dtds/struts-2.3.dtd">
<struts>
<package name="userPackage" namespace="/" extends="struts-default">
<!-- 用户 action -->
<action name="user_*" class="userAction" method="{1}" >
<result name="success">/userPage.jsp</result>
<result name="adminPage">/admin.jsp</result>
<result name="indexs">/index.jsp</result>
<result name="ok">/userReg/ok.jsp</result>
<result name="showUser">/admin/userAuthorities.jsp</result>
<result name="error">/userReg/error.jsp</result>
<result name="updateEidt">/userReg/updateEdit.jsp</result>
<!-- -->
<result name="deleteUserOK" type="redirectAction">user_showUserInfo.action</result>
<result name="updateOk" type="redirectAction">user_showUserInfo.action</result>
<result name="addUsersAndShowRole">/userReg/regsiter.jsp</result>
</action>
<action name="users_*" class="userRegisterAction" method="{1}">
<result name="ok">/userReg/ok.jsp</result>
<result name="error">/userReg/error.jsp</result>
<result name="input">/userReg/regsiter.jsp</result>
<!--防止表单重提交 -->
<result name="invalid.token">/userReg/alert.jsp</result>
<interceptor-ref name="token"/>
<interceptor-ref name="defaultStack"/>
</action>
</package>
</struts>
login.jsp
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>My JSP 'index.jsp' starting page</title>
<style type="text/css">
.errorhide{display: none;}
.error{display: block;}
</style>
</head>
<body>
<div style="1200px; text-align: center; margin-top: 150px;">
<div class="error${param.error==true ? '' : 'hide'}">
登陆失败<br>
<font color="red">${sessionScope['SPRING_SECURITY_LAST_EXCEPTION'].message}</font><br/>
</div>
<form action="${pageContext.request.contextPath}/j_spring_security_check" method="post" style="260px;text-align:center;">
<fieldset>
<legend>登陆</legend>
用户： <input type="text" name="j_username" style="150px;" value="${sessionScope['SPRING_SECURITY_LAST_USERNAME']}"/><br />
密码： <input type="password" name="j_password" style="150px;" /> <br />
<input type="checkbox" name="_spring_security_remember_me"/>一周之内不必登陆<br />
<input type="submit" value="登陆"/>
<input type="reset" value="重置"/>
</fieldset>
</form>
<br/>
<a HREF="${pageContext.request.contextPath}/admin.jsp">ADMIN.JSP</a> <br/>
<a HREF="${pageContext.request.contextPath}/userPage.jsp">userPage.jsp</a> <br/>
<a href="j_spring_security_logout">注销用户</a>
</div>
</body>
</html>
主要代码就这些吧！有兴趣的朋友可以下载源码，全部贴出来，累死个人