<dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-security</artifactId>
</dependency>

public interface UserDetails extends Serializable {

 //返回分配給用戶的角色列表
 Collection<? extends GrantedAuthority> getAuthorities();
 
 //返回密碼
 String getPassword();

 //返回帳號
 String getUsername();

 // 賬戶是否未過期
 boolean isAccountNonExpired();

 // 賬戶是否未鎖定
 boolean isAccountNonLocked();

 // 密碼是否未過期
 boolean isCredentialsNonExpired();

 // 賬戶是否激活
 boolean isEnabled();
}

public interface UserDetailsService {
 UserDetails loadUserByUsername(String var1) throws UsernameNotFoundException;
}

/**
 * Created by Yuicon on 2017/5/14.
 */
public class User implements UserDetails {

 private final String id;
 //帳號,這里是我數(shù)據(jù)庫里的字段
 private final String account;
 //密碼
 private final String password;
 //角色集合
 private final Collection<? extends GrantedAuthority> authorities;

 User(String id, String account, String password, Collection<? extends GrantedAuthority> authorities) {
  this.id = id;
  this.account = account;
  this.password = password;
  this.authorities = authorities;
 }

 //返回分配給用戶的角色列表
 @Override
 public Collection<? extends GrantedAuthority> getAuthorities() {
  return authorities;
 }

 @JsonIgnore
 public String getId() {
  return id;
 }

 @JsonIgnore
 @Override
 public String getPassword() {
  return password;
 }
 
 //雖然我數(shù)據(jù)庫里的字段是 `account` ,這里還是要寫成 `getUsername()`,因為是繼承的接口
 @Override
 public String getUsername() {
  return account;
 }
 // 賬戶是否未過期
 @JsonIgnore
 @Override
 public boolean isAccountNonExpired() {
  return true;
 }
 // 賬戶是否未鎖定
 @JsonIgnore
 @Override
 public boolean isAccountNonLocked() {
  return true;
 }
 // 密碼是否未過期
 @JsonIgnore
 @Override
 public boolean isCredentialsNonExpired() {
  return true;
 }
 // 賬戶是否激活
 @JsonIgnore
 @Override
 public boolean isEnabled() {
  return true;
 }
}

/**
 * Created by Yuicon on 2017/5/14.
 */
@Service
public class UserDetailsServiceImpl implements UserDetailsService {
 
 // jpa
 @Autowired
 private UserRepository userRepository;

 /**
  * 提供一種從用戶名可以查到用戶并返回的方法
  * @param account 帳號
  * @return UserDetails
  * @throws UsernameNotFoundException
  */
 @Override
 public UserDetails loadUserByUsername(String account) throws UsernameNotFoundException {
  // 這里是數(shù)據(jù)庫里的用戶類
  User user = userRepository.findByAccount(account);

  if (user == null) {
   throw new UsernameNotFoundException(String.format("沒有該用戶 '%s'.", account));
  } else {
   //這里返回上面繼承了 UserDetails 接口的用戶類,為了簡單我們寫個工廠類
   return UserFactory.create(user);
  }
 }
}

/**
 * Created by Yuicon on 2017/5/14.
 */
final class UserFactory {

 private UserFactory() {
 }

 static User create(User user) {
  return new User(
    user.getId(),
    user.getAccount(),
    user.getPassword(),
   mapToGrantedAuthorities(user.getRoles().stream().map(Role::getName).collect(Collectors.toList()))
  );
 }
 
 //將與用戶類一對多的角色類的名稱集合轉(zhuǎn)換為 GrantedAuthority 集合
 private static List<GrantedAuthority> mapToGrantedAuthorities(List<String> authorities) {
  return authorities.stream()
    .map(SimpleGrantedAuthority::new)
    .collect(Collectors.toList());
 }
}

/**
 * Created by Yuicon on 2017/5/14.
 */
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

 // Spring會自動尋找實現(xiàn)接口的類注入,會找到我們的 UserDetailsServiceImpl 類
 @Autowired
 private UserDetailsService userDetailsService;

 @Autowired
 public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
  authenticationManagerBuilder
    // 設(shè)置UserDetailsService
    .userDetailsService(this.userDetailsService)
    // 使用BCrypt進(jìn)行密碼的hash
    .passwordEncoder(passwordEncoder());
 }

 // 裝載BCrypt密碼編碼器
 @Bean
 public PasswordEncoder passwordEncoder() {
  return new BCryptPasswordEncoder();
 }

 //允許跨域
 @Bean
 public WebMvcConfigurer corsConfigurer() {
  return new WebMvcConfigurerAdapter() {
   @Override
   public void addCorsMappings(CorsRegistry registry) {
    registry.addMapping("/**").allowedOrigins("*")
      .allowedMethods("GET", "HEAD", "POST","PUT", "DELETE", "OPTIONS")
      .allowCredentials(false).maxAge(3600);
   }
  };
 }

 @Override
 protected void configure(HttpSecurity httpSecurity) throws Exception {
  httpSecurity
    // 取消csrf
    .csrf().disable()
    // 基于token，所以不需要session
    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
    .authorizeRequests()
    .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
    // 允許對于網(wǎng)站靜態(tài)資源的無授權(quán)訪問
    .antMatchers(
      HttpMethod.GET,
      "/",
      "/*.html",
      "/favicon.ico",
      "/**/*.html",
      "/**/*.css",
      "/**/*.js",
      "/webjars/**",
      "/swagger-resources/**",
      "/*/api-docs"
    ).permitAll()
    // 對于獲取token的rest api要允許匿名訪問
    .antMatchers("/auth/**").permitAll()
    // 除上面外的所有請求全部需要鑒權(quán)認(rèn)證
    .anyRequest().authenticated();
  // 禁用緩存
  httpSecurity.headers().cacheControl();
 }
}

/**
 * 在 @PreAuthorize 中我們可以利用內(nèi)建的 SPEL 表達(dá)式：比如 'hasRole()' 來決定哪些用戶有權(quán)訪問。
 * 需注意的一點是 hasRole 表達(dá)式認(rèn)為每個角色名字前都有一個前綴 'ROLE_'。所以這里的 'ADMIN' 其實在
 * 數(shù)據(jù)庫中存儲的是 'ROLE_ADMIN' 。這個 @PreAuthorize 可以修飾Controller也可修飾Controller中的方法。
 **/
@RestController
@RequestMapping("/users")
@PreAuthorize("hasRole('USER')") //有ROLE_USER權(quán)限的用戶可以訪問
public class UserController {

 @Autowired
 private UserRepository repository;

 @PreAuthorize("hasRole('ADMIN')")//有ROLE_ADMIN權(quán)限的用戶可以訪問
 @RequestMapping(method = RequestMethod.GET)
 public List<User> getUsers() {
  return repository.findAll();
 }
}