UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext()
                .getAuthentication()
                .getPrincipal();

  .and()
                .formLogin()
                //指定url，可由相應的controller處理跳轉(zhuǎn)到登錄頁如login_page.html
                .loginPage("/mylogin")//自定義登錄url
                //指定自定義form表單請求的路徑
                .loginProcessingUrl("/myloginForm").usernameParameter("userName").passwordParameter("passWord")
                //.defaultSuccessUrl("/success")
                .successForwardUrl("/success")//設置了登入登出的Handler,優(yōu)先響應Handler
                .failureUrl("/fail")//設置了登入登出的Handler,優(yōu)先響應Handler

 .and()
                .logout()
                .logoutUrl("/mylogout")//自定義退出url
                .logoutSuccessUrl("/mylogin")
                .logoutSuccessHandler(myLogoutSuccessHandle)//設置了登入登出的Handler,優(yōu)先響應Handler
                .invalidateHttpSession(true)
                .permitAll()

export const login = data => {
  return http.post(`/myloginForm?userName=${data.userName}&passWord=${data.passWord}&rememberMe=${data.rememberMe}&imageCode=${data.imageCode}`)
}
export const logout = data => {
  return http.post(`/mylogout`)
}

<!--要與.loginProcessingUrl("/myloginForm")相對應-->
<form name="f" action="/myloginForm" method="post">
    <br/>
    用戶名:
    <input type="text" name="userName" placeholder="name"><br/>
    密碼:
    <input type="password" name="passWord" placeholder="password"><br/>
    <input type="text" name="imageCode">
    <img src="/createImageCode"><br/>
    <input type="checkbox" name="rememberMe"/>下次自動登錄<br/>
    <input name="submit" type="submit" value="提交">
</form>
<form action="/mylogout" method="post">
    <input type="submit" class="btn btn-primary" value="注銷"/><!-- 5 -->
</form>

//自定義認證成功或者失敗的返回json
                .successHandler(myAuthenticationSuccessHandler)
                .failureHandler(myAuthenticationFailureHandler)
                
.logoutSuccessHandler(myLogoutSuccessHandle)//設置了登入登出的Handler,優(yōu)先響應Handler
               

  http.exceptionHandling().authenticationEntryPoint(myAuthenticationEntryPoint);//未登錄
        http.exceptionHandling().accessDeniedHandler(myAccessDeniedHandler); // 無權(quán)訪問

.and()
                .rememberMe()// 記住我
                .rememberMeParameter("rememberMe")
                .tokenRepository(persistentTokenRepository())
                .userDetailsService(myUserDetailsService).tokenValiditySeconds(60 * 60 * 24);

/**
     * springSecurity會根據(jù)情況自動將token插入persistent_logins
     *
     * @return
     */
    @Bean
    public PersistentTokenRepository persistentTokenRepository() {
        JdbcTokenRepositoryImpl tokenRepository = new JdbcTokenRepositoryImpl();
        tokenRepository.setDataSource(dataSource);
        return tokenRepository;
    }

//將我們自定義的驗證碼過濾器，配置
//UsernamePasswordAuthenticationFilter之前http.addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)

public class AuthenticationSuccessEventListener implements ApplicationListener<AuthenticationSuccessEvent>
{}
public class AuthenticationFailureListener implements ApplicationListener<AuthenticationFailureBadCredentialsEvent> {}

export const login = data => {
  return http.post(`/myloginForm?userName=${data.userName}&passWord=${data.passWord}&rememberMe=${data.rememberMe}&imageCode=${data.imageCode}`)
}
export const logout = data => {
  return http.post(`/mylogout`)
}

.antMatchers( "/user/list").hasAuthority("admin")
                .antMatchers( "/user/list2").hasRole("manager")