CREATE TABLE `auth_user`
(
	`id`                      varchar(36) NOT NULL,
	`username`                varchar(100) DEFAULT NULL,
	`password`                varchar(100) DEFAULT NULL,
	`role`                    varchar(100) DEFAULT NULL,
	`account_non_expired`     int(11) DEFAULT '0',
	`account_non_locked`      int(11) DEFAULT '0',
	`credentials_non_expired` int(11) DEFAULT '0',
	`is_enabled`              int(11) DEFAULT NULL,
	PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf32;
INSERT INTO auth_user (id, username, password, `role`, account_non_expired, account_non_locked,
					   credentials_non_expired, is_enabled)
VALUES ('1', 'user', '15tT+y0b+lJq2HIKUjsvvg==', 'USER', 1, 1, 1, 1),
	   ('2', 'admin', '15tT+y0b+lJq2HIKUjsvvg==', 'ADMIN', 1, 1, 1, 1);

<dependencies>
	<dependency>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-security</artifactId>
	</dependency>
	<!-- AES加密 -->
	<dependency>
		<groupId>org.apache.directory.studio</groupId>
		<artifactId>org.apache.commons.codec</artifactId>
		<version>1.8</version>
	</dependency>
	<!-- JWT -->
	<dependency>
		<groupId>io.jsonwebtoken</groupId>
		<artifactId>jjwt</artifactId>
		<version>0.9.0</version>
	</dependency>
</dependencies>

public class AuthUser implements Serializable, UserDetails {
	private static final long serialVersionUID = 1L;
	private String id;
	private String username;
	private String password;
	private String role;
	private Integer accountNonExpired;
	private Integer accountNonLocked;
	private Integer credentialsNonExpired;
	private Integer isEnabled;
	@Override
	public Collection<? extends GrantedAuthority> getAuthorities() {
		// 獲取用戶所有權(quán)限
		String[] roles = role.split(",");
		// 遍歷 roles，取出每一個(gè)權(quán)限進(jìn)行認(rèn)證，添加到簡(jiǎn)單的授予認(rèn)證類(lèi)
		List<SimpleGrantedAuthority> authorities = new ArrayList<>();
		for (String role : roles) {
			authorities.add(new SimpleGrantedAuthority("ROLE_" + role));
		}
		// 返回到已經(jīng)被授予認(rèn)證的權(quán)限集合, 這里面的角色所擁有的權(quán)限都已經(jīng)被 spring security 所知道
		return authorities;
	}
	@Override
	public boolean isAccountNonExpired() {
		return this.accountNonExpired != null && this.accountNonExpired == 1;
	}
	@Override
	public boolean isAccountNonLocked() {
		return this.accountNonLocked != null && this.accountNonLocked == 1;
	}
	@Override
	public boolean isCredentialsNonExpired() {
		return this.credentialsNonExpired != null && this.credentialsNonExpired == 1;
	}
	@Override
	public boolean isEnabled() {
		return this.isEnabled != null && this.isEnabled == 1;
	}
	// 略去其它 Get、Set 方法
}

public interface AuthUserService extends UserDetailsService {
}
@Service("authUserService")
public class AuthUserServiceImpl implements AuthUserService {
	@Resource
	private AuthUserDao authUserDao;
	@Override
	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
		AuthUser authUser = authUserDao.queryByName(username);
		if (authUser == null) {
			throw new IllegalArgumentException("User [" + username + "] doesn't exist.");
		}
		return authUser;
	}
}

@RestController
@RequestMapping("api/resource")
public class ResourceController {
	@GetMapping("user")
	public String demo1() {
		return "User demo.";
	}
	@GetMapping("admin")
	public String demo2() {
		return "Admin demo.";
	}
}

public class AESUtil {
	private final static String ALGORITHM = "AES/CBC/NoPadding";
	private final static String DEFAULT_IV = "1234567890123456";
	private final static String DEFAULT_KEY = "1234567890123456";
	public static String encrypt(String data) throws Exception {
		return encrypt(data, DEFAULT_KEY, DEFAULT_IV);
	}
	public static String desEncrypt(String data) throws Exception {
		return desEncrypt(data, DEFAULT_KEY, DEFAULT_IV);
	}
	public static String encrypt(String data, String key, String iv) throws Exception {
		Cipher cipher = Cipher.getInstance(ALGORITHM);
		int blockSize = cipher.getBlockSize();
		byte[] dataBytes = data.getBytes();
		int length = dataBytes.length;
		if (length % blockSize != 0) {
			length = length + (blockSize - (length % blockSize));
		}
		byte[] plaintext = new byte[length];
		System.arraycopy(dataBytes, 0, plaintext, 0, dataBytes.length);
		SecretKeySpec keySpec = new SecretKeySpec(key.getBytes(), "AES");
		IvParameterSpec ivSpec = new IvParameterSpec(iv.getBytes());
		cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);
	 	byte[] encrypted = cipher.doFinal(plaintext);
		return new Base64().encodeToString(encrypted);
	}
	public static String desEncrypt(String data, String key, String iv) throws Exception {
		byte[] encrypted1 = new Base64().decode(data);
		Cipher cipher = Cipher.getInstance(ALGORITHM);
		SecretKeySpec keySpec = new SecretKeySpec(key.getBytes(), "AES");
		IvParameterSpec ivSpec = new IvParameterSpec(iv.getBytes());
		cipher.init(Cipher.DECRYPT_MODE, keySpec, ivSpec);
		byte[] bytes = cipher.doFinal(encrypted1);
		return new String(bytes);
	}
}

public class TokenUtil {
	/**
	 * 密鑰
	 */
	public static final String JWT_KEY = "ibudai";
	/**
	 * 過(guò)期時(shí)間
	 */
	public static final Long JWT_TTL = TimeUnit.MINUTES.toMillis(5);
	/**
	 * 生成 Token
	 */
	public static String createJWT(String data, Long ttlMillis) {
		String uuid = UUID.randomUUID().toString().replaceAll("-", "");
		JwtBuilder builder = getJwtBuilder(data, ttlMillis, uuid);
		return builder.compact();
	}
	/**
	 * 解析 Token
	 */
	public static Claims parseJWT(String token) {
		SecretKey secretKey = generalKey();
		return Jwts.parser()
				.setSigningKey(secretKey)
				.parseClaimsJws(token)
				.getBody();
	}
	/**
	 * 生成加密后的秘鑰
	 */
	private static SecretKey generalKey() {
		byte[] encodedKey = Base64.getDecoder().decode(JWT_KEY);
		return new SecretKeySpec(encodedKey, 0, encodedKey.length, "AES");
	}
	private static JwtBuilder getJwtBuilder(String subject, Long ttlMillis, String uuid) {
		SignatureAlgorithm algorithm = SignatureAlgorithm.HS256;
		SecretKey secretKey = generalKey();
		long nowMillis = System.currentTimeMillis();
		Date now = new Date(nowMillis);
		if (ttlMillis == null) {
			ttlMillis = JWT_TTL;
		}
		long expMillis = nowMillis + ttlMillis;
		Date expDate = new Date(expMillis);
		return Jwts.builder()
				.setId(uuid)
				// 計(jì)算內(nèi)容
				.setSubject(subject)
				// 簽發(fā)者
				.setIssuer("budai")
				// 簽發(fā)時(shí)間
				.setIssuedAt(now)
				// 加密算法簽名
				.signWith(algorithm, secretKey)
				.setExpiration(expDate);
	}
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
	@Autowired
	private AuthUserService authUserService;
	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
		// 動(dòng)態(tài)讀取數(shù)據(jù)庫(kù)信息
		auth.userDetailsService(authUserService)
				// 自定義 AES 方式加密
				.passwordEncoder(new AESEncoder());
	}
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
	// 手動(dòng)配置
	auth.inMemoryAuthentication()
			.withUser("budai").password("123456").roles("USER")
			.and()
			.withUser("admin").password("123456").roles("ADMIN", "USER")
			.and()
			// 自定義賬號(hào)信息解析方式
			.passwordEncoder(new AESEncoder());
}

public class AESEncoder implements PasswordEncoder {
	@Override
	public String encode(CharSequence charSequence) {
		String str = charSequence.toString();
		try {
			String plain;
			if (!Objects.equals(str, "userNotFoundPassword")) {
				plain = AESUtil.desEncrypt(str);
			} else {
				plain = str;
			}
			return AESUtil.encrypt(plain);
		} catch (Exception e) {
			throw new RuntimeException(e);
		}
	}
	@Override
	public boolean matches(CharSequence charSequence, String s) {
		try {
			String plain = AESUtil.desEncrypt(charSequence.toString());
			String result = AESUtil.encrypt(plain);
			return Objects.equals(result, s);
		} catch (Exception e) {
			throw new RuntimeException(e);
		}
	}
}

public class AESEncoder implements PasswordEncoder {
	@Override
	public String encode(CharSequence charSequence) {
		String str = charSequence.toString();
		try {
			String plain;
			if (!Objects.equals(str, "userNotFoundPassword")) {
				plain = AESUtil.desEncrypt(str);
			} else {
				plain = str;
			}
			return AESUtil.encrypt(plain);
		} catch (Exception e) {
			throw new RuntimeException(e);
		}
	}
	@Override
	public boolean matches(CharSequence charSequence, String s) {
		try {
			String plain = AESUtil.desEncrypt(charSequence.toString());
			String result = AESUtil.encrypt(plain);
			return Objects.equals(result, s);
		} catch (Exception e) {
			throw new RuntimeException(e);
		}
	}
}

private void failureHandle(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException {
	String msg;
	if (exception instanceof LockedException) {
		msg = "Account has been locked, please contact the administrator.";
	} else if (exception instanceof BadCredentialsException) {
		msg = "Account credential error, please recheck.";
	} else {
		msg = "Account doesn't exist, please recheck.";
	}
	response.setContentType("application/json;charset=UTF-8");
	response.setStatus(203);
	ResultData<Object> result = new ResultData<>(203, msg, null);
	response.getWriter().write(objectMapper.writeValueAsString(result));
}

private void unAuthHandle(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException {
	String msg = "Please login and try again.";
	response.setContentType("application/json;charset=UTF-8");
	response.setStatus(203);
	ResultData<Object> result = new ResultData<>(203, msg, null);
	response.getWriter().write(objectMapper.writeValueAsString(result));
}

@Configuration
public class FilterConfig {
	/**
	 * 設(shè)置放行資源
	 *
	 * 例：/api/auth/verify
	 */
	@Value("${auth.api.verify}")
	private String verifyAPI;
	@Bean
	public FilterRegistrationBean<AuthFilter> orderFilter1() {
		FilterRegistrationBean<AuthFilter> filter = new FilterRegistrationBean<>();
		filter.setName("auth-filter");
		// Set effect url
		filter.setUrlPatterns(Collections.singleton("/**"));
		// Set ignore url, when multiply the value spilt with ","
		filter.addInitParameter("excludedUris", verifyAPI);
		filter.setOrder(-1);
		filter.setFilter(new AuthFilter());
		return filter;
	}
}

public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
	HttpServletRequest req = (HttpServletRequest) servletRequest;
	HttpServletResponse response = (HttpServletResponse) servletResponse;
	int status;
	String msg;
	String token = req.getHeader("Token");
	if (StringUtils.isNotBlank(token)) {
		boolean isExpired = false;
		try {
			TokenUtil.parseJWT(token);
		} catch (ExpiredJwtException e) {
			isExpired = true;
		}
		if (!isExpired) {
			filterChain.doFilter(req, servletResponse);
			return;
		} else {
			status = 203;
			msg = "Login expired.";
		}
	} else {
		status = 203;
		msg = "Please login and try again.";
	}
	response.setContentType("application/json;charset=UTF-8");
	response.setStatus(status);
	ResultData<Object> result = new ResultData<>(status, msg, null);
	response.getWriter().write(objectMapper.writeValueAsString(result));
}

/**
	 * 設(shè)置跨域訪問(wèn)地址，逗號(hào)分隔
	 *
	 * 例：http://localhost:8080,http://127.0.0.1:8080
	 */
	@Value("${auth.host.cors}")
	private String hosts;
	@Override
	public void addCorsMappings(CorsRegistry registry) {
		String[] crosHost = hosts.trim().split(",");
		// 設(shè)置允許跨域的路徑
		registry.addMapping("/**")
				// 設(shè)置允許跨域請(qǐng)求的域名
				.allowedOriginPatterns(crosHost)
				// 是否允許cookie
				.allowCredentials(true)
				// 設(shè)置允許的請(qǐng)求方式
				.allowedMethods("GET", "POST", "DELETE", "PUT")
				// 設(shè)置允許的header屬性
				.allowedHeaders("*")
				// 跨域允許時(shí)間
				.maxAge(TimeUnit.SECONDS.toMillis(5));
	}
}