package com.boxuegu.controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
/**
 * security入門案例
 */
@RestController
public class HelloSecurityController {
    @RequestMapping("/hello")
    public String hello() {
        return "hello security";
    }
}

<!--添加Spring Security 依賴 -->
<dependency>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-security</artifactId>
</dependency>

/*
 Navicat Premium Data Transfer
 Source Server         : localhost
 Source Server Type    : MySQL
 Source Server Version : 50540
 Source Host           : localhost:3306
 Source Schema         : security_management
 Target Server Type    : MySQL
 Target Server Version : 50540
 File Encoding         : 65001
 Date: 31/10/2020 14:35:33
*/
SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;
-- ----------------------------
-- Table structure for t_permission
-- ----------------------------
DROP TABLE IF EXISTS `t_permission`;
CREATE TABLE `t_permission`  (
  `ID` int(11) NOT NULL AUTO_INCREMENT COMMENT '編號',
  `permission_name` varchar(30) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '權(quán)限名稱',
  `permission_tag` varchar(30) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '權(quán)限標(biāo)簽',
  `permission_url` varchar(100) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '權(quán)限地址',
  PRIMARY KEY (`ID`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 9 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
-- ----------------------------
-- Records of t_permission
-- ----------------------------
INSERT INTO `t_permission` VALUES (1, '查詢所有用戶', 'user:findAll', '/user/findAll');
INSERT INTO `t_permission` VALUES (2, '用戶添加或修改', 'user:saveOrUpdate', '/user/saveOrUpadate');
INSERT INTO `t_permission` VALUES (3, '用戶刪除', 'user:delete', '/delete/{id}');
INSERT INTO `t_permission` VALUES (4, '根據(jù)ID查詢用戶', 'user:getById', '/user/{id}');
INSERT INTO `t_permission` VALUES (5, '查詢所有商品', 'product:findAll', '/product/findAll');
INSERT INTO `t_permission` VALUES (6, '商品添加或修改', 'product:saveOrUpdate', '/product/saveOrUpadate');
INSERT INTO `t_permission` VALUES (7, '商品刪除', 'product:delete', '/product//delete/{id}');
INSERT INTO `t_permission` VALUES (8, '商品是否顯示', 'product:show', '/product/show/{id}/{isShow}');
-- ----------------------------
-- Table structure for t_role
-- ----------------------------
DROP TABLE IF EXISTS `t_role`;
CREATE TABLE `t_role`  (
  `ID` int(11) NOT NULL AUTO_INCREMENT COMMENT '編號',
  `ROLE_NAME` varchar(30) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '角色名稱',
  `ROLE_DESC` varchar(60) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL COMMENT '角色描述',
  PRIMARY KEY (`ID`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 6 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
-- ----------------------------
-- Records of t_role
-- ----------------------------
INSERT INTO `t_role` VALUES (1, 'ADMIN', '超級管理員');
INSERT INTO `t_role` VALUES (2, 'USER', '用戶管理');
INSERT INTO `t_role` VALUES (3, 'PRODUCT', '商品管理員');
INSERT INTO `t_role` VALUES (4, 'PRODUCT_INPUT', '商品錄入員');
INSERT INTO `t_role` VALUES (5, 'PRODUCT_SHOW', '商品審核員');
-- ----------------------------
-- Table structure for t_role_permission
-- ----------------------------
DROP TABLE IF EXISTS `t_role_permission`;
CREATE TABLE `t_role_permission`  (
  `RID` int(11) NOT NULL COMMENT '角色編號',
  `PID` int(11) NOT NULL COMMENT '權(quán)限編號',
  PRIMARY KEY (`RID`, `PID`) USING BTREE,
  INDEX `FK_Reference_12`(`PID`) USING BTREE,
  CONSTRAINT `FK_Reference_11` FOREIGN KEY (`RID`) REFERENCES `t_role` (`ID`) ON DELETE RESTRICT ON UPDATE RESTRICT,
  CONSTRAINT `FK_Reference_12` FOREIGN KEY (`PID`) REFERENCES `t_permission` (`ID`) ON DELETE RESTRICT ON UPDATE RESTRICT
) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
-- ----------------------------
-- Records of t_role_permission
-- ----------------------------
INSERT INTO `t_role_permission` VALUES (1, 1);
INSERT INTO `t_role_permission` VALUES (2, 1);
INSERT INTO `t_role_permission` VALUES (1, 2);
INSERT INTO `t_role_permission` VALUES (2, 2);
INSERT INTO `t_role_permission` VALUES (1, 3);
INSERT INTO `t_role_permission` VALUES (2, 3);
INSERT INTO `t_role_permission` VALUES (1, 4);
INSERT INTO `t_role_permission` VALUES (2, 4);
INSERT INTO `t_role_permission` VALUES (1, 5);
INSERT INTO `t_role_permission` VALUES (3, 5);
INSERT INTO `t_role_permission` VALUES (4, 5);
INSERT INTO `t_role_permission` VALUES (5, 5);
INSERT INTO `t_role_permission` VALUES (1, 6);
INSERT INTO `t_role_permission` VALUES (3, 6);
INSERT INTO `t_role_permission` VALUES (4, 6);
INSERT INTO `t_role_permission` VALUES (1, 7);
INSERT INTO `t_role_permission` VALUES (3, 7);
INSERT INTO `t_role_permission` VALUES (4, 7);
INSERT INTO `t_role_permission` VALUES (1, 8);
INSERT INTO `t_role_permission` VALUES (3, 8);
INSERT INTO `t_role_permission` VALUES (5, 8);
-- ----------------------------
-- Table structure for t_user
-- ----------------------------
DROP TABLE IF EXISTS `t_user`;
CREATE TABLE `t_user`  (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `username` varchar(50) CHARACTER SET utf8 COLLATE utf8_bin NULL DEFAULT NULL,
  `password` varchar(100) CHARACTER SET utf8 COLLATE utf8_bin NULL DEFAULT NULL,
  `status` int(1) NULL DEFAULT NULL COMMENT '用戶狀態(tài)1-啟用 0-關(guān)閉',
  PRIMARY KEY (`id`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 6 CHARACTER SET = utf8 COLLATE = utf8_bin ROW_FORMAT = Compact;
-- ----------------------------
-- Records of t_user
-- ----------------------------
INSERT INTO `t_user` VALUES (1, 'admin', '$2a$10$m8WqgTzr0TO.XG.aR91.jegJJmDnGSvWs69aMWPR.WNvCzemHpLum', 1);
INSERT INTO `t_user` VALUES (2, 'zhaoyang', '$2a$10$m8WqgTzr0TO.XG.aR91.jegJJmDnGSvWs69aMWPR.WNvCzemHpLum', 1);
INSERT INTO `t_user` VALUES (3, 'user1', '$2a$10$m8WqgTzr0TO.XG.aR91.jegJJmDnGSvWs69aMWPR.WNvCzemHpLum', 1);
INSERT INTO `t_user` VALUES (4, 'user2', '$2a$10$m8WqgTzr0TO.XG.aR91.jegJJmDnGSvWs69aMWPR.WNvCzemHpLum', 1);
INSERT INTO `t_user` VALUES (5, 'user3', '$2a$10$Wk1jWJPoMQ5s7UIp0S/tu.WTcUZUspUUQH6K3BQpa8uHXWRUQc3/a', 1);
-- ----------------------------
-- Table structure for t_user_role
-- ----------------------------
DROP TABLE IF EXISTS `t_user_role`;
CREATE TABLE `t_user_role`  (
  `UID` int(11) NOT NULL COMMENT '用戶編號',
  `RID` int(11) NOT NULL COMMENT '角色編號',
  PRIMARY KEY (`UID`, `RID`) USING BTREE,
  INDEX `FK_Reference_10`(`RID`) USING BTREE,
  CONSTRAINT `FK_Reference_10` FOREIGN KEY (`RID`) REFERENCES `t_role` (`ID`) ON DELETE RESTRICT ON UPDATE RESTRICT,
  CONSTRAINT `FK_Reference_9` FOREIGN KEY (`UID`) REFERENCES `t_user` (`id`) ON DELETE RESTRICT ON UPDATE RESTRICT
) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
-- ----------------------------
-- Records of t_user_role
-- ----------------------------
INSERT INTO `t_user_role` VALUES (1, 1);
INSERT INTO `t_user_role` VALUES (2, 2);
INSERT INTO `t_user_role` VALUES (3, 4);
INSERT INTO `t_user_role` VALUES (4, 5);
SET FOREIGN_KEY_CHECKS = 1;

<!--添加Spring Security 依賴 -->
<dependency>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-security</artifactId>
</dependency>

package com.boxuegu.config;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
/**
 * Security配置類
 */
@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    /**
     * http請求處理方法
     *
     * @param http
     * @throws Exception
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        /*http.httpBasic()//開啟httpbasic認(rèn)證
                .and().authorizeRequests().
                anyRequest().authenticated();//所有請求都需要登錄認(rèn)證才能訪問*/
        http.formLogin()//開啟表單認(rèn)證
                .and().authorizeRequests().
                .anyRequest().authenticated();//所有請求都需要登錄認(rèn)證才能訪問;
    }
}

http.formLogin().loginPage("/login.html")//開啟表單認(rèn)證
                .and().authorizeRequests().
                antMatchers("/login.html").permitAll()//放行登錄頁面
                .anyRequest().authenticated();//所有請求都需要登錄認(rèn)證才能訪問;

http.formLogin().loginPage("/toLoginPage")//開啟表單認(rèn)證
                .and().authorizeRequests().
                antMatchers("/toLoginPage").permitAll()//放行登錄頁面
                .anyRequest().authenticated();//所有請求都需要登錄認(rèn)證才能訪問;

/**
     * WebSecurity
     *
     * @param web
     * @throws Exception
     */
    @Override
    public void configure(WebSecurity web) throws Exception {
        //解決靜態(tài)資源被攔截的問題
        web.ignoring().antMatchers("/css/**", "/images/**", "/js/**", "/favicon.ico");
    }

/**
     * http請求處理方法
     *
     * @param http
     * @throws Exception
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        /*http.httpBasic()//開啟httpbasic認(rèn)證
                .and().authorizeRequests().
                anyRequest().authenticated();//所有請求都需要登錄認(rèn)證才能訪問*/
        http.formLogin()//開啟表單認(rèn)證
                .loginPage("/toLoginPage")//自定義登錄頁面
                .loginProcessingUrl("/login")// 登錄處理Url
             .usernameParameter("username").passwordParameter("password"). //修改自定義表單name值.
                .successForwardUrl("/")// 登錄成功后跳轉(zhuǎn)路徑
                .and().authorizeRequests().
                antMatchers("/toLoginPage").permitAll()//放行登錄頁面
                .anyRequest().authenticated();//所有請求都需要登錄認(rèn)證才能訪問;
        // 關(guān)閉csrf防護(hù)
		http..csrf().disable();
    }

http.formLogin()//開啟表單認(rèn)證
                .loginPage("/toLoginPage")//自定義登錄頁面
                .loginProcessingUrl("/login")// 登錄處理Url
    			.usernameParameter("username").passwordParameter("password"). //修改自定義表單name值.
                .successForwardUrl("/")// 登錄成功后跳轉(zhuǎn)路徑
                .and().authorizeRequests().
                antMatchers("/toLoginPage").permitAll()//放行登錄頁面與靜態(tài)資源
                .anyRequest().authenticated();//所有請求都需要登錄認(rèn)證才能訪問;       
		// 關(guān)閉csrf防護(hù)
		http.csrf().disable();
		// 允許iframe加載頁面
        http.headers().frameOptions().sameOrigin();

package com.boxuegu.service.impl;
import com.boxuegu.domain.User;
import com.boxuegu.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import java.util.ArrayList;
import java.util.Collection;
/**
 * 基于數(shù)據(jù)庫中完成認(rèn)證
 */
@Service
public class MyUserDetailsService implements UserDetailsService {
    @Autowired
    UserService userService;
    /**
     * 根據(jù)username查詢用戶實(shí)體
     *
     * @param username
     * @return
     * @throws UsernameNotFoundException
     */
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userService.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException(username);// 用戶名沒有找到
        }
        // 先聲明一個權(quán)限集合, 因?yàn)闃?gòu)造方法里面不能傳入null
        Collection<? extends GrantedAuthority> authorities = new ArrayList<>();
        // 需要返回一個SpringSecurity的UserDetails對象
        UserDetails userDetails =
                new org.springframework.security.core.userdetails.User(user.getUsername(),
                        "{noop}" + user.getPassword(),// {noop}表示不加密認(rèn)證。
                        true, // 用戶是否啟用 true 代表啟用
                        true,// 用戶是否過期 true 代表未過期
                        true,// 用戶憑據(jù)是否過期 true 代表未過期
                        true,// 用戶是否鎖定 true 代表未鎖定
                        authorities);
        return userDetails;
    }
}

 /**
     * 身份驗(yàn)證管理器
     *
     * @param auth
     * @throws Exception
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(myUserDetailsService);// 使用自定義用戶認(rèn)證
    }

@Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userService.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException(username);// 用戶名沒有找到
        }
        // 先聲明一個權(quán)限集合, 因?yàn)闃?gòu)造方法里面不能傳入null
        Collection<? extends GrantedAuthority> authorities = new ArrayList<>();
        // 需要返回一個SpringSecurity的UserDetails對象
        UserDetails userDetails =
                new org.springframework.security.core.userdetails.User(user.getUsername(),
                        "{bcrypt}" + user.getPassword(),// {noop}表示不加密認(rèn)證。{bcrypt} 加密認(rèn)證
                        true, // 用戶是否啟用 true 代表啟用
                        true,// 用戶是否過期 true 代表未過期
                        true,// 用戶憑據(jù)是否過期 true 代表未過期
                        true,// 用戶是否鎖定 true 代表未鎖定
                        authorities);
        return userDetails;
    }

/**
     * 獲取當(dāng)前登錄用戶
     *
     * @return
     */
    @RequestMapping("/loginUser")
    @ResponseBody
    public UserDetails getCurrentUser() {
        UserDetails userDetails = (UserDetails)
                SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        return userDetails;
    }

/**
     * 獲取當(dāng)前登錄用戶
     *
     * @return
     */
    @RequestMapping("/loginUser1")
    @ResponseBody
    public UserDetails getCurrentUser() {
        UserDetails userDetails = (UserDetails)
                SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        return userDetails;
    }
    /**
     * 獲取當(dāng)前登錄用戶
     *
     * @return
     */
    @RequestMapping("/loginUser2")
    @ResponseBody
    public UserDetails getCurrentUser(Authentication authentication) {
        UserDetails userDetails = (UserDetails) authentication.getPrincipal();
        return userDetails;
    }
    /**
     * 獲取當(dāng)前登錄用戶
     *
     * @return
     */
    @RequestMapping("/loginUser3")
    @ResponseBody
    public UserDetails getCurrentUser(@AuthenticationPrincipal UserDetails userDetails) {
        return userDetails;
    }

 <div class="form-group">
         <div >
            <!--記住我 name為remember-me value值可選true  yes 1 on 都行-->
            <input type="checkbox"  name="remember-me" value="true"/>記住我
         </div>
</div>

.and().rememberMe()//開啟記住我功能
                .tokenValiditySeconds(1209600)// token失效時間默認(rèn)2周
                .rememberMeParameter("remember-me")// 自定義表單name值

/**
     * http請求處理方法
     *
     * @param http
     * @throws Exception
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        /*http.httpBasic()//開啟httpbasic認(rèn)證
                .and().authorizeRequests().
                anyRequest().authenticated();//所有請求都需要登錄認(rèn)證才能訪問*/
        http.formLogin()//開啟表單認(rèn)證
                .loginPage("/toLoginPage")//自定義登錄頁面
                .loginProcessingUrl("/login")// 登錄處理Url
                //.usernameParameter().passwordParameter(). 修改自定義表單name值.
                .successForwardUrl("/")// 登錄成功后跳轉(zhuǎn)路徑
                .and().authorizeRequests().
                antMatchers("/toLoginPage").permitAll()//放行登錄頁面與靜態(tài)資源
                .anyRequest().authenticated()//所有請求都需要登錄認(rèn)證才能訪問;
                .and().rememberMe()//開啟記住我功能
                .tokenValiditySeconds(1209600)// token失效時間默認(rèn)2周
                .rememberMeParameter("remember-me")// 自定義表單name值
                .tokenRepository(getPersistentTokenRepository());// 設(shè)置tokenRepository
        // 關(guān)閉csrf防護(hù)
        http.csrf().disable();
        // 允許iframe加載頁面
        http.headers().frameOptions().sameOrigin();
    }
    @Autowired
    DataSource dataSource;
    /**
     * 持久化token,負(fù)責(zé)token與數(shù)據(jù)庫之間的相關(guān)操作
     *
     * @return
     */
    @Bean
    public PersistentTokenRepository getPersistentTokenRepository() {
        JdbcTokenRepositoryImpl tokenRepository = new JdbcTokenRepositoryImpl();
        tokenRepository.setDataSource(dataSource);//設(shè)置數(shù)據(jù)源
        // 啟動時創(chuàng)建一張表, 第一次啟動的時候創(chuàng)建, 第二次啟動的時候需要注釋掉, 否則會報(bào)錯
        tokenRepository.setCreateTableOnStartup(true);
      return tokenRepository;
    }

  /**
     * 根據(jù)用戶ID查詢用戶
     *
     * @return
     */
    @GetMapping("/{id}")
    @ResponseBody
    public User getById(@PathVariable Integer id) {
        //獲取認(rèn)證信息
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        // 判斷認(rèn)證信息是否來源于RememberMe
        if (RememberMeAuthenticationToken.class.isAssignableFrom(authentication.getClass())) {
            throw new RememberMeAuthenticationException("認(rèn)證信息來源于RememberMe,請重新登錄");
        }
        User user = userService.getById(id);
        return user;
    }

 
 在重要操作步驟可以加以驗(yàn)證, true代表自動登錄,則引導(dǎo)用戶重新表單登錄,  false正常進(jìn)行
#### 2.3.6 自定義登錄成功處理和失敗處理
?		  在某些場景下,用戶登錄成功或失敗的情況下用戶需要執(zhí)行一些后續(xù)操作,比如登錄日志的搜集, 或者在現(xiàn)在目前前后端分離的情況下用戶登錄成功和失敗后需要給前臺頁面返回對應(yīng)的錯誤信息, 有前臺主導(dǎo)登錄成功或者失敗的頁面跳轉(zhuǎn). 這個時候需要要到用到AuthenticationSuccessHandler與AnthenticationFailureHandler.
**自定義成功處理：**
?        實(shí)現(xiàn)AuthenticationSuccessHandler接口，并重寫onAnthenticationSuccesss()方法.
**自定義失敗處理：**
?		實(shí)現(xiàn)AuthenticationFailureHandler接口，并重寫onAuthenticationFailure()方法；
1. 代碼實(shí)現(xiàn)登錄成功或失敗的自定義處理
 - SecurityConfiguration類
   ```java
   .successHandler(myAuthenticationService)//自定義登錄成功處理
                   .failureHandler(myAuthenticationService)//自定義登錄失敗處理

package com.boxuegu.service.impl;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.RedirectStrategy;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.stereotype.Component;
import org.springframework.stereotype.Service;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;
/**
 * 自定義登錄成功或失敗處理類
 */
@Service
public class MyAuthenticationService implements AuthenticationSuccessHandler, AuthenticationFailureHandler {
    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
 @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authentication) throws IOException, ServletException {
    }
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        System.out.println("登錄成功后續(xù)處理....");
        //重定向到index頁
        redirectStrategy.sendRedirect(request, response, "/");
    }
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        System.out.println("登錄失敗后續(xù)處理....");
         //重定向到login頁
        redirectStrategy.sendRedirect(request, response, "/toLoginPage");
    }
}

<form id="formLogin" action="/login" method="post">
                <div class="panel loginbox">
                   .....
                    <div style="padding:30px;">
                        <input type="button" onclick="login()"
                               class="button button-block bg-main text-big input-big" value="登錄">
                    </div>
                </div>
            </form>
        </div>
    </div>
</div>
<script>
    function login() {
        $.ajax({
            type: "POST",//方法類型
            dataType: "json",//服務(wù)器預(yù)期返回類型
            url: "/login",   // 登錄url
            data: $("#formLogin").serialize(),
            success: function (data) {
                console.log(data)
                if (data.code == 200) {
                    window.location.href = "/";
                } else {
                    alert(data.message);
                }
            }
        });
    }
</script>

@Autowired
    ObjectMapper objectMapper;
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        System.out.println("登錄成功后續(xù)處理....");
        //redirectStrategy.sendRedirect(request, response, "/");
        Map result = new HashMap();
        result.put("code", HttpStatus.OK.value());// 設(shè)置響應(yīng)碼
        result.put("message", "登錄成功");// 設(shè)置響應(yīng)信息
        response.setContentType("application/json;charset=UTF-8");
        response.getWriter().write(objectMapper.writeValueAsString(result));
    }
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        System.out.println("登錄失敗后續(xù)處理....");
        //redirectStrategy.sendRedirect(request, response, "/toLoginPage");
        Map result = new HashMap();
        result.put("code", HttpStatus.UNAUTHORIZED.value());// 設(shè)置響應(yīng)碼
        result.put("message", exception.getMessage());// 設(shè)置錯誤信息
        response.setContentType("application/json;charset=UTF-8");
        response.getWriter().write(objectMapper.writeValueAsString(result));
    }

<a class="button button-little bg-red" href="/logout" rel="external nofollow" >
            <span class="icon-power-off"></span>退出登錄</a></div>

package com.boxuegu.service.impl;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.RedirectStrategy;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
import org.springframework.stereotype.Service;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;
/**
 * 自定義登錄成功,失敗,退出處理類
 */
@Service
public class MyAuthenticationService implements AuthenticationSuccessHandler,
        AuthenticationFailureHandler, LogoutSuccessHandler {
    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
     ................
    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        System.out.println("退出成功后續(xù)處理....");
        redirectStrategy.sendRedirect(request, response, "/toLoginPage");
    }
}

.and().logout().logoutUrl("/logout")//設(shè)置退出url
                .logoutSuccessHandler(myAuthenticationService)//自定義退出處理

package com.boxuegu.filter;
import com.boxuegu.controller.ValidateCodeController;
import com.boxuegu.exception.ValidateCodeException;
import com.boxuegu.service.impl.MyAuthenticationService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;
import org.springframework.web.bind.ServletRequestBindingException;
import org.springframework.web.filter.OncePerRequestFilter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
 * 驗(yàn)證碼驗(yàn)證filter 需要繼承OncePerRequestFilter確保在一次請求只通過一次filter，而不需要重復(fù)執(zhí)行
 */
@Component
public class ValidateCodeFilter extends OncePerRequestFilter {
    @Autowired
    MyAuthenticationService myAuthenticationService;
    @Autowired
    StringRedisTemplate stringRedisTemplate;
    @Override
    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
        // 判斷是否是登錄請求,只有登錄請求才去校驗(yàn)驗(yàn)證碼
        if (httpServletRequest.getRequestURI().equals("/login")
                && httpServletRequest.getMethod().equalsIgnoreCase("post")) {
            try {
                validate(httpServletRequest);
            } catch (ValidateCodeException e) {
                myAuthenticationService.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
                return;
            }
        }
        //如果不是登錄請求，直接調(diào)用后面的過濾器鏈
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }
    private void validate(HttpServletRequest request) throws ServletRequestBindingException {
        //獲取ip
        String remoteAddr = request.getRemoteAddr();
        //拼接redis的key
        String redisKey = ValidateCodeController.REDIS_KEY_IMAGE_CODE + "-" + remoteAddr;
        //從redis中獲取imageCode
        String redisImageCode =
                stringRedisTemplate.boundValueOps(redisKey).get();
        String imageCode = request.getParameter("imageCode");
        if (!StringUtils.hasText(imageCode)) {
            throw new ValidateCodeException("驗(yàn)證碼的值不能為空！");
        }
        if (redisImageCode == null) {
            throw new ValidateCodeException("驗(yàn)證碼已過期！");
        }
        if (!redisImageCode.equals(imageCode)) {
            throw new ValidateCodeException("驗(yàn)證碼不正確！");
        }
        // 從redis中刪除imageCode
        stringRedisTemplate.delete(redisKey);
    }
}

package com.boxuegu.exception;
import org.springframework.security.core.AuthenticationException;
/**
 * 驗(yàn)證碼異常類
 */
public class ValidateCodeException extends AuthenticationException {
    public ValidateCodeException(String msg) {
        super(msg);
    }
}

 	@Autowired
 	ValidateCodeFilter validateCodeFilter;
 /**
     * http請求處理方法
     *
     * @param http
     * @throws Exception
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        /*http.httpBasic()//開啟httpbasic認(rèn)證
                .and().authorizeRequests().
                anyRequest().authenticated();//所有請求都需要登錄認(rèn)證才能訪問*/
        // 加在用戶名密碼過濾器的前面
        http.addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class);
        http.formLogin()//開啟表單認(rèn)證
                .loginPage("/toLoginPage")//自定義登錄頁面
                .loginProcessingUrl("/login")// 登錄處理Url
                //.usernameParameter().passwordParameter(). 修改自定義表單name值.
                .successForwardUrl("/")// 登錄成功后跳轉(zhuǎn)路徑
                .successHandler(myAuthenticationService)//自定義登錄成功處理
                .failureHandler(myAuthenticationService)//自定義登錄失敗處理
                .and().logout().logoutUrl("/logout")//設(shè)置退出url
                .logoutSuccessHandler(myAuthenticationService)//自定義退出處理
                .and().authorizeRequests().
                antMatchers("/toLoginPage","/code/**").permitAll()//放行登錄頁面與靜態(tài)資源
                .anyRequest().authenticated()//所有請求都需要登錄認(rèn)證才能訪問;
                .and().rememberMe()//開啟記住我功能
                .tokenValiditySeconds(1209600)// token失效時間默認(rèn)2周
                .rememberMeParameter("remember-me")// 自定義表單name值
                .tokenRepository(getPersistentTokenRepository());// 設(shè)置tokenRepository
        // 關(guān)閉csrf防護(hù)
        http.csrf().disable();
        // 允許iframe加載頁面
        http.headers().frameOptions().sameOrigin();  
    }

#session設(shè)置
#配置session超時時間
server.servlet.session.timeout=60

http.sessionManagement()//設(shè)置session管理
                .invalidSessionUrl("/toLoginPage")// session無效后跳轉(zhuǎn)的路徑, 默認(rèn)是登錄頁面

#session設(shè)置
#配置session超時時間
server.servlet.session.timeout=600

http.sessionManagement().//設(shè)置session管理
                invalidSessionUrl("/toLoginPage")// session無效后跳轉(zhuǎn)的路徑, 默認(rèn)是登錄頁面
                .maximumSessions(1)//設(shè)置session最大會話數(shù)量 ,1同一時間只能有一個用戶登錄
                .expiredUrl("/toLoginPage");//設(shè)置session過期后跳轉(zhuǎn)路徑

http.sessionManagement().//設(shè)置session管理
                invalidSessionUrl("/toLoginPage")// session無效后跳轉(zhuǎn)的路徑, 默認(rèn)是登錄頁面
                .maximumSessions(1)//設(shè)置session最大會話數(shù)量 ,1同一時間只能有一個用戶登錄
                .maxSessionsPreventsLogin(true)//當(dāng)達(dá)到最大會話個數(shù)時阻止登錄。
                .expiredUrl("/toLoginPage");//設(shè)置session過期后跳轉(zhuǎn)路徑

<!-- 基于redis實(shí)現(xiàn)session共享 -->
<dependency>
    <groupId>org.springframework.session</groupId>
    <artifactId>spring-session-data-redis</artifactId>
</dependency>

#使用redis共享session
spring.session.store-type=redis

//開啟csrf防護(hù), 可以設(shè)置哪些不需要防護(hù)
http.csrf().ignoringAntMatchers("/user/save");

<input type="hidden" th:name="${_csrf.parameterName}"  th:value="${_csrf.token}"/>

// 設(shè)置/user/** 訪問需要ADMIN角色
http.authorizeRequests().antMatchers("/user/**").hasRole("ADMIN");
// 設(shè)置/user/** 訪問需要PRODUCT角色和IP地址為127.0.0.1  .hasAnyRole("PRODUCT,ADMIN")
http.authorizeRequests().antMatchers("/product/**")
                .access("hasAnyRole('ADMIN,PRODUCT') and hasIpAddress('127.0.0.1')");
// 設(shè)置自定義權(quán)限不足信息.
http.exceptionHandling().accessDeniedHandler(accessDeniedHandler);

package com.boxuegu.handle;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.stereotype.Component;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
 * 自定義權(quán)限不足信息
 */ 
@Component
public class MyAccessDeniedHandler implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest httpServletRequest, HttpServletResponse resp, AccessDeniedException e) throws IOException, ServletException {
        resp.setStatus(HttpServletResponse.SC_FORBIDDEN);
        resp.setContentType("text/html;charset=UTF-8");
        resp.getWriter().write("權(quán)限不足，請聯(lián)系管理員!");
    }
}

// 先聲明一個權(quán)限集合, 因?yàn)闃?gòu)造方法里面不能傳入null
Collection<GrantedAuthority> authorities = new ArrayList<>();
if ("admin".equalsIgnoreCase(user.getUsername())) {
    authorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
} else {
	authorities.add(new SimpleGrantedAuthority("ROLE_PRODUCT"));
}

package com.boxuegu.service.impl;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.stereotype.Component;
import javax.servlet.http.HttpServletRequest;
import java.util.Collection;
/**
 * 自定義授權(quán)類  
 */
@Component
public class MyAuthorizationService {
    /**
     * 檢查用戶是否有對應(yīng)的訪問權(quán)限
     *
     * @param authentication 登錄用戶
     * @param request        請求對象
     * @return
     */
    public boolean check(Authentication authentication, HttpServletRequest request) {
        User user = (User) authentication.getPrincipal();
        // 獲取用戶所有權(quán)限
        Collection<GrantedAuthority> authorities = user.getAuthorities();
        // 獲取用戶名
        String username = user.getUsername();
        // 如果用戶名為admin,則不需要認(rèn)證
        if (username.equalsIgnoreCase("admin")) {
            return true;
        } else {
            // 循環(huán)用戶的權(quán)限, 判斷是否有ROLE_ADMIN權(quán)限, 有返回true
            for (GrantedAuthority authority : authorities) {
                String role = authority.getAuthority();
                if ("ROLE_ADMIN".equals(role)) {
                    return true;
                }
            }
        }
        return false;
    }
}

//使用自定義Bean授權(quán)
http.authorizeRequests().antMatchers("/user/**").
                access("@myAuthorizationService.check(authentication,request)");

 /**
     * 檢查用戶是否有對應(yīng)的訪問權(quán)限
     *
     * @param authentication 登錄用戶
     * @param request        請求對象
     * @param id             參數(shù)ID
     * @return
     */
    public boolean check(Authentication authentication, HttpServletRequest request, Integer id) {
        if (id > 10) {
            return false;
        }
        return true;
    }

//使用自定義Bean授權(quán),并攜帶路徑參數(shù)
        http.authorizeRequests().antMatchers("/user/delete/{id}").
                access("@myAuthorizationService.check(authentication,request,#id)");

/**
 * Security配置類
 */
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)//開啟注解支持
public class SecurityConfiguration extends WebSecurityConfigurerAdapter	
/**
 * Security配置類
 */
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)//開啟注解支持
public class SecurityConfiguration extends WebSecurityConfigurerAdapter

/**
     * 查詢所有用戶
     *
     * @return
     */
    @RequestMapping("/findAll")
    @PreAuthorize("hasRole('ADMIN')")//需要ADMIN權(quán)限
    public String findAll(Model model) {
        List<User> userList = userService.list();
        model.addAttribute("userList", userList);
        return "user_list";
    }
    /**
     * 用戶修改頁面跳轉(zhuǎn)
     *
     * @return
     */
    @RequestMapping("/update/{id}")
    @PreAuthorize("#id<10")//針對參數(shù)權(quán)限限定 id<10可以訪問
    public String update(@PathVariable Integer id, Model model) {
        User user = userService.getById(id);
        model.addAttribute("user", user);
        return "user_update";
    }

 /**
     * 根據(jù)ID查詢用戶
     *
     * @return
     */
    @GetMapping("/{id}")
    @ResponseBody
    @PostAuthorize("returnObject.username== authentication.principal.username")//判斷查詢用戶信息是否是當(dāng)前登錄用戶信息.否則沒有權(quán)限
    public User getById(@PathVariable Integer id) {
     User user = userService.getById(id);
        return user;
 }

/**
     * 商品刪除-多選刪除
     *
     * @return
     */
    @GetMapping("/delByIds")
    @PreFilter(filterTarget = "ids", value = "filterObject%2==0")//剔除參數(shù)為基數(shù)的值
 public String delByIds(@RequestParam(value = "id") List<Integer> ids) {
        for (Integer id : ids) {
         System.out.println(id);
        }
     return "redirect:/user/findAll";
    }

/**
     * 查詢所有用戶-返回json數(shù)據(jù)
     *
     * @return
     */
    @RequestMapping("/findAllTOJson")
    @ResponseBody
    @PostFilter("filterObject.id%2==0")//剔除返回值ID為偶數(shù)的值
    public List<User> findAllTOJson() {
     List<User> userList = userService.list();
        return userList;
 }

package com.boxuegu.mapper;
import com.baomidou.mybatisplus.core.mapper.BaseMapper;
import com.boxuegu.domain.Permission;
import org.apache.ibatis.annotations.Select;
import java.util.List;
public interface PermissionMapper extends BaseMapper<Permission> {
    /**
     * 根據(jù)用戶ID查詢權(quán)限
     *
     * @param id
     * @return
     */
    @Select("SELECT p.*  FROM t_permission p,t_role_permission rp,t_role r,t_user_role ur,t_user u " +
            "WHERE p.id = rp.PID AND rp.RID = r.id AND r.id = ur.RID AND ur.UID = u.id AND u.id =#{id}")
    List<Permission> findByUserId(Integer id);
}

 // 先聲明一個權(quán)限集合, 因?yàn)闃?gòu)造方法里面不能傳入null
Collection<GrantedAuthority> authorities = new ArrayList<>();
// 查詢用戶對應(yīng)所有權(quán)限
List<Permission> permissions = permissionService.findByUserId(user.getId());
for (Permission permission : permissions) {
    // 授權(quán)
    authorities.add(new SimpleGrantedAuthority(permission.getPermissionTag()));
}

// 查詢數(shù)據(jù)庫所有權(quán)限列表
List<Permission> permissions = permissionService.list();
for (Permission permission : permissions) {
     //添加請求權(quán)限
http.authorizeRequests().
                  antMatchers(permission.getPermissionUrl()).hasAuthority(permission.getPermissionTag());
}

<!--添加thymeleaf為SpringSecurity提供的標(biāo)簽 依賴 -->
<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity5</artifactId>
    <version>3.0.4.RELEASE</version>
</dependency>

!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/extras/spring-security">

<div class="leftnav">
    <div class="leftnav-title">
        <div sec:authorize="isAuthenticated()">
            <span sec:authentication="name"></span>
            <img src="images/y.jpg" class="radius-circle rotate-hover" height="50" alt=""/></div>
    </div>
    <div sec:authorize="hasAuthority('user:findAll')">
        <h2><span class="icon-user"></span>系統(tǒng)管理</h2>
        <ul style="display:block">
            <li><a href="/user/findAll" target="right"><span class="icon-caret-right"></span>用戶管理</a></li>
            <li><a href="javascript:void(0)" onclick="toCors()" target="right"><span
                    class="icon-caret-right"></span>跨域測試</a></li>
        </ul>
    </div>
    <div sec:authorize="hasAuthority('product:findAll')">
        <h2><span class="icon-pencil-square-o"></span>數(shù)據(jù)管理</h2>
        <ul>
            <li><a href="/product/findAll" target="right"><span class="icon-caret-right"></span>商品管理</a></li>
        </ul>
    </div>
</div>

<!--添加thymeleaf為SpringSecurity提供的標(biāo)簽 依賴 -->
<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity5</artifactId>
    <version>3.0.4.RELEASE</version>
</dependency>

!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/extras/spring-security">

<div class="leftnav">
    <div class="leftnav-title">
        <div sec:authorize="isAuthenticated()">
            <span sec:authentication="name"></span>
            <img src="images/y.jpg" class="radius-circle rotate-hover" height="50" alt=""/></div>
    </div>
    <div sec:authorize="hasAuthority('user:findAll')">
        <h2><span class="icon-user"></span>系統(tǒng)管理</h2>
        <ul style="display:block">
            <li><a href="/user/findAll" target="right"><span class="icon-caret-right"></span>用戶管理</a></li>
            <li><a href="javascript:void(0)" onclick="toCors()" target="right"><span
                    class="icon-caret-right"></span>跨域測試</a></li>
        </ul>
    </div>
    <div sec:authorize="hasAuthority('product:findAll')">
        <h2><span class="icon-pencil-square-o"></span>數(shù)據(jù)管理</h2>
        <ul>
            <li><a href="/product/findAll" target="right"><span class="icon-caret-right"></span>商品管理</a></li>
        </ul>
    </div>
</div>