Create Spring MVC Project
On the Eclipse, create a Spring MVC project in Spring Boot
Enter Project Information:
- Name: LearnSpringMVCWithRealApps
- Group: com.demo
- Artifact: LearnSpringMVCWithRealApps
- Description: Learn Spring MVC with Real Apps
- Package: com.demo
Select the technologies and libraries to be used:
- Web
- Security
Click Next button to show Site Information for project
Click Finish button to finish create Spring MVC project
Configure pom.xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.demo</groupId>
<artifactId>LearnSpringMVCWithRealApps</artifactId>
<version>0.0.1-SNAPSHOT</version>
<packaging>jar</packaging>
<name>LearnSpringMVCWithRealApps</name>
<description>Learn Spring MVC with Real Apps</description>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.0.5.RELEASE</version>
<relativePath /> <!-- lookup parent from repository -->
</parent>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<java.version>1.8</java.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<!-- JSTL tag lib -->
<dependency>
<groupId>javax.servlet.jsp.jstl</groupId>
<artifactId>javax.servlet.jsp.jstl-api</artifactId>
<version>1.2.1</version>
</dependency>
<dependency>
<groupId>taglibs</groupId>
<artifactId>standard</artifactId>
<version>1.1.2</version>
</dependency>
<!-- Tomcat for JSP rendering -->
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-jasper</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
</project>
Configure application.properties
spring.mvc.view.prefix = /WEB-INF/views/
spring.mvc.view.suffix = .jsp
spring.mvc.static-path-pattern=/resources/**
server.port=9596
Entities Class
Create new package named com.demo.entities. In this package, create new entity as below:
package com.demo.entities;
public class Account {
private String username;
private String password;
private String[] roles;
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public String[] getRoles() {
return roles;
}
public void setRoles(String[] roles) {
this.roles = roles;
}
public Account(String username, String password, String[] roles) {
super();
this.username = username;
this.password = password;
this.roles = roles;
}
public Account() {
super();
}
}
Repositories Class
Create new package named com.demo.repositories. In this package, create new repositories as below:
AccountRepository Interface
Create new interface named AccountRepository.java as below:
package com.demo.repositories;
import java.util.List;
import com.demo.entities.Account;
public interface AccountRepository {
public List<Account> findAll();
public Account find(String username);
}
AccountRepositoryImpl Class
Create new class named AccountRepositoryImpl.java as below:
package com.demo.repositories;
import java.util.ArrayList;
import java.util.List;
import org.springframework.stereotype.Repository;
import com.demo.entities.Account;
@Repository("accountRepository")
public class AccountRepositoryImpl implements AccountRepository {
@Override
public List<Account> findAll() {
List<Account> accounts = new ArrayList<Account>();
accounts.add(new Account("acc1", "$2a$04$YnS.4Ak1DPOV2YDjzPSl.ugIVk4/gXGPAHtSd/8g3fj2vJOuV49AG", new String[] {"ROLE_SUPER_ADMIN", "ROLE_ADMIN", "ROLE_EMPLOYEE"})); // password = 123
accounts.add(new Account("acc2", "$2a$04$YnS.4Ak1DPOV2YDjzPSl.ugIVk4/gXGPAHtSd/8g3fj2vJOuV49AG", new String[] {"ROLE_ADMIN", "ROLE_EMPLOYEE"})); // password = 123
accounts.add(new Account("acc3", "$2a$04$YnS.4Ak1DPOV2YDjzPSl.ugIVk4/gXGPAHtSd/8g3fj2vJOuV49AG", new String[] {"ROLE_EMPLOYEE"})); // password = 123
return accounts;
}
@Override
public Account find(String username) {
for(Account account : this.findAll()) {
if(account.getUsername().equalsIgnoreCase(username)) {
return account;
}
}
return null;
}
}
Services Class
Create new package named com.demo.services. In this package, create new services as below:
AccountService Interface
Create new interface named AccountService.java as below:
package com.demo.services;
import org.springframework.security.core.userdetails.UserDetailsService;
public interface AccountService extends UserDetailsService {
}
AccountServiceImpl Class
Create new class named AccountServiceImpl.java as below:
package com.demo.services;
import java.util.ArrayList;
import java.util.List;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import com.demo.entities.Account;
import com.demo.repositories.AccountRepository;
@Service("accountService")
public class AccountServiceImpl implements AccountService {
@Autowired
private AccountRepository accountRepository;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
Account account = accountRepository.find(username);
if (account == null) {
throw new UsernameNotFoundException("Username not found for " + username);
}
List<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>();
for (String role : account.getRoles()) {
grantedAuthorities.add(new SimpleGrantedAuthority(role));
}
return new User(account.getUsername(), account.getPassword(), grantedAuthorities);
}
}
Controllers
Create new package named com.demo.controllers. In this package, create new controllers as below:
Home Controller
Create new controller named HomeController.java as below:
package com.demo.controllers;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
@Controller
@RequestMapping("home")
public class HomeController {
@RequestMapping(method = RequestMethod.GET)
public String index() {
return "home/index";
}
}
SuperAdmin Controller
Create new controller named SuperAdminController.java as below:
package com.demo.controllers;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
@Controller
@RequestMapping("/superadmin**")
public class SuperAdminController {
@RequestMapping(method = RequestMethod.GET)
public String index() {
return "superadmin/index";
}
}
Admin Controller
Create new controller named AdminController.java as below:
package com.demo.controllers;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
@Controller
@RequestMapping("/admin**")
public class AdminController {
@RequestMapping(method = RequestMethod.GET)
public String index() {
return "admin/index";
}
}
Employee Controller
Create new controller named EmployeeController.java as below:
package com.demo.controllers;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
@Controller
@RequestMapping("/employee**")
public class EmployeeController {
@RequestMapping(method = RequestMethod.GET)
public String index() {
return "employee/index";
}
}
DashBoard Controller
Create new controller named DashBoardController.java as below:
package com.demo.controllers;
import org.springframework.stereotype.Controller;
import org.springframework.ui.ModelMap;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
@Controller
@RequestMapping("/dashboard")
public class DashBoardController {
@RequestMapping(method = RequestMethod.GET)
public String index() {
return "redirect:/dashboard/login";
}
@RequestMapping(value = "login", method = RequestMethod.GET)
public String login(
@RequestParam(value = "error", required = false) String error,
@RequestParam(value = "logout", required = false) String logout,
ModelMap modelMap) {
if(error != null) {
modelMap.put("msg", "Invalid username or password!");
}
if(logout != null) {
modelMap.put("msg", "Logout successfully");
}
return "dashboard/login";
}
@RequestMapping(value = "welcome", method = RequestMethod.GET)
public String welcome() {
return "dashboard/welcome";
}
@RequestMapping(value = "accessDenied", method = RequestMethod.GET)
public String accessDenied() {
return "dashboard/accessDenied";
}
}
Create View
Create new folders with path webapp\WEB-INF\views in src\main. In views folder, create new JSP Pages as below:
Home View
Create new folder named home. Create new jsp file named index.jsp as below:
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Home Page</title>
</head>
<body>
<h3>Home Page</h3>
</body>
</html>
SuperAdmin View
Create new folder named superadmin. Create new jsp file named index.jsp
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Super Admin Page</title>
</head>
<body>
<h3>Super Admin Page</h3>
Welcome ${pageContext.request.userPrincipal.name}
<br>
<a href="${pageContext.request.contextPath }/dashboard/logout">Logout</a>
</body>
</html>
Admin View
Create new folder named admin. Create new jsp file named index.jsp as below:
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Admin Page</title>
</head>
<body>
<h3>Admin Page</h3>
Welcome ${pageContext.request.userPrincipal.name}
<br>
<a href="${pageContext.request.contextPath }/dashboard/logout">Logout</a>
</body>
</html>
Employee View
Create new folder named employee. Create new jsp file named index.jsp as below:
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Employee Page</title>
</head>
<body>
<h3>Employee Page</h3>
Welcome ${pageContext.request.userPrincipal.name}
<br>
<a href="${pageContext.request.contextPath }/dashboard/logout">Logout</a>
</body>
</html>
DashBoard View
Create new folder named dashboard. In this folder, create new views as below:
Login View
Create new jsp file named login.jsp as below:
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Login Page</title>
</head>
<body>
<h3>Login Page</h3>
${msg }
<form method="post"
action="${pageContext.request.contextPath }/dashboard/process-login">
<table cellpadding="2" cellspacing="2">
<tr>
<td>Username</td>
<td><input type="text" name="username"></td>
</tr>
<tr>
<td>Password</td>
<td><input type="password" name="password"></td>
</tr>
<tr>
<td> </td>
<td><input type="submit" value="Login"></td>
</tr>
</table>
</form>
</body>
</html>
Welcome View
Create new jsp file named welcome.jsp as below:
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Welcome Page</title>
</head>
<body>
<h3>Welcome Page</h3>
Welcome ${pageContext.request.userPrincipal.name}
<br>
<a href="${pageContext.request.contextPath }/dashboard/logout">Logout</a>
</body>
</html>
AccessDenied View
Create new jsp file named accessDenied.jsp as below:
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Access Denied Page</title>
</head>
<body>
<h3>Access Denied Page</h3>
<a href="${pageContext.request.contextPath}/dashboard/welcome">Back</a>
</body>
</html>
Security Configuration
In com.demo package, create new java class named SecurityConfiguration.java use for Spring Security as below:
package com.demo;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import com.demo.services.AccountService;
@EnableWebSecurity
@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Autowired
private AccountService accountService;
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity.cors().and().csrf().disable();
httpSecurity.authorizeRequests()
.antMatchers("/superadmin**").access("hasRole('ROLE_SUPER_ADMIN')")
.antMatchers("/admin**").access("hasRole('ROLE_SUPER_ADMIN') or hasRole('ROLE_ADMIN')")
.antMatchers("/employee**").access("hasRole('ROLE_SUPER_ADMIN') or hasRole('ROLE_ADMIN') or hasRole('ROLE_EMPLOYEE')")
.and()
.formLogin().loginPage("/dashboard/login")
.loginProcessingUrl("/dashboard/process-login")
.defaultSuccessUrl("/dashboard/welcome")
.failureUrl("/dashboard/login?error")
.usernameParameter("username").passwordParameter("password")
.and()
.logout().logoutUrl("/dashboard/logout")
.logoutSuccessUrl("/dashboard/login?logout")
.and()
.exceptionHandling().accessDeniedPage("/dashboard/accessDenied");
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder builder)
throws Exception {
builder.userDetailsService(accountService);
}
@Bean
public BCryptPasswordEncoder encoder() {
return new BCryptPasswordEncoder();
}
}
Structure of Project
Run Application
Select LearnSpringMVCWithRealAppsApplication.java file in com.demo package, right click and select Run As/Spring Boot App menu
Access index method in home controller with following url: http://localhost:9596/home
Output
Test access index action in superadmin controller without account with url: http://localhost:9596/superadmin
Output
Test access index action in admin controller without account with url: http://localhost:9596/admin
Output
Test access index action in employee controller without account with url: http://localhost:9596/employee
Output
Test login with invalid account: username is abc and password is 123
Output
Test login with valid account: username is acc2 and password is 123. This account have roles: ROLE_ADMIN and ROLE_EMPLOYEE
Output
Use acc2 has logged access index action in superadmin controller with url: http://localhost:9596/superadmin
Output
Use acc2 has logged access index action in admin controller with url: http://localhost:9596/admin
Output
Use acc2 has logged access index action in employee controller with url: http://localhost:9596/employee
Output
References
I recommend you refer to the books below to learn more about the knowledge in this article:
- Spring MVC Beginners Guide – Second Edition
- Spring Boot in Action
- Pro Spring Boot
- Spring Data
- Spring Security – Third Edition: Secure your web applications, RESTful services, and microservice architectures
- Spring Security Essentials
- OAuth 2.0 Cookbook: Protect your web applications using Spring Security
- Pro Spring Security