<!-- Spring Security 依賴 -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
    <version>2.7.18</version>
</dependency>
 
<!-- Lombok 依賴 -->
<dependency>
    <groupId>org.projectlombok</groupId>
    <artifactId>lombok</artifactId>
    <optional>true</optional>
</dependency>
 
<!-- 引入Thymeleaf模板引擎 -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>

package com.pjb.model;
 
import lombok.Data;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
 
import java.util.Collection;
import java.util.List;
 
/**
 * 自定義用戶認(rèn)證類：擴(kuò)展 UserDetails 接口
 * @author pan_junbiao
 **/
@Data
public class LoginUserDetails implements UserDetails
{
    private Long userId;
    private String username;
    private String password;
    private String BlogName; //博客名稱
    private String BlogUrl;  //博客地址
    private List<GrantedAuthority> authoritys; //權(quán)限集合
 
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities()
    {
        return this.authoritys;
    }
 
    public void setAuthoritys(List<GrantedAuthority> authoritys)
    {
        this.authoritys = authoritys;
    }
 
    @Override
    public boolean isAccountNonExpired()
    {
        return true;
    }
 
    @Override
    public boolean isAccountNonLocked()
    {
        return true;
    }
 
    @Override
    public boolean isCredentialsNonExpired()
    {
        return true;
    }
 
    @Override
    public boolean isEnabled()
    {
        return true;
    }
}

package com.pjb.service;
 
import com.pjb.model.LoginUserDetails;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
 
import java.util.List;
 
/**
 * 登錄服務(wù)類：擴(kuò)展 UserDetailsService 接口
 * @author pan_junbiao
 **/
@Service
public class LoginUserDetailsService implements UserDetailsService
{
 
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException
    {
        //模擬數(shù)據(jù)庫查詢
        LoginUserDetails user = this.findByUsername(username);
        if (user != null)
        {
            return user;
        }
 
        //未查詢到用戶信息，則拋出異常
        throw new UsernameNotFoundException("未找到用戶名稱為：" + username + "的用戶信息");
    }
 
    /**
     * 模擬數(shù)據(jù)庫查詢
     */
    private LoginUserDetails findByUsername(String username)
    {
        LoginUserDetails loginUserDetails = null;
        if (username != null && username.equals("panjunbiao"))
        {
            loginUserDetails = new LoginUserDetails();
            loginUserDetails.setUserId(1L);
            loginUserDetails.setUsername(username);
            loginUserDetails.setPassword("123456");
            loginUserDetails.setBlogName("您好，歡迎訪問 pan_junbiao的博客");
            loginUserDetails.setBlogUrl("https://blog.csdn.net/pan_junbiao");
 
            //設(shè)置權(quán)限
            List<GrantedAuthority> grantedAuthorityList = AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_USER");
            loginUserDetails.setAuthoritys(grantedAuthorityList);
        }
        return loginUserDetails;
    }
}

package com.pjb.provider;
 
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;
 
/**
 * 登錄認(rèn)證類：擴(kuò)展 AuthenticationProvider
 * @author pan_junbiao
 **/
@Component
public class LoginAuthenticationProvider implements AuthenticationProvider
{
    @Autowired
    private UserDetailsService userDetailsService;
 
    @Autowired
    private PasswordEncoder passwordEncoder;
 
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException
    {
        //從 Authentication 對象中獲取用戶名稱和身份憑證信息
        String username = authentication.getName();
        String password = authentication.getCredentials().toString();
 
        UserDetails user = userDetailsService.loadUserByUsername(username);
        if (passwordEncoder.matches(password, user.getPassword()))
        {
            //密碼匹配成功，則構(gòu)建一個(gè) UsernamePasswordAuthenticationToken 對象并返回
            return new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword(), user.getAuthorities());
        } else
        {
            //密碼匹配失敗，則拋出異常
            throw new BadCredentialsException("用戶密碼不正確");
        }
    }
 
    @Override
    public boolean supports(Class<?> authenticationType)
    {
        return authenticationType.equals(UsernamePasswordAuthenticationToken.class);
    }
}

package com.pjb.handler;
 
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.stereotype.Component;
 
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
 
/**
 * 登錄成功處理類
 */
@Component
public class LoginSuccessHandler implements AuthenticationSuccessHandler
{
    @Override
    public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException
    {
        //重定向至首頁
        httpServletResponse.sendRedirect("/");
    }
}

package com.pjb.handler;
 
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.CredentialsExpiredException;
import org.springframework.security.authentication.DisabledException;
import org.springframework.security.authentication.LockedException;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.stereotype.Component;
 
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
 
/**
 * 登錄失敗處理類
 */
@Component
public class LoginFailureHandler implements AuthenticationFailureHandler
{
    @Override
    public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException authenticationException) throws IOException, ServletException
    {
        //獲取登錄失敗原因
        String errorMessage = "";
        if(authenticationException instanceof BadCredentialsException){
            errorMessage = "用戶名或密碼不正確";
        }else if(authenticationException instanceof DisabledException){
            errorMessage = "賬號被禁用";
        }else if(authenticationException instanceof UsernameNotFoundException){
            errorMessage = "用戶名不存在";
        }else if(authenticationException instanceof CredentialsExpiredException){
            errorMessage = "密碼已過期";
        }else if(authenticationException instanceof LockedException) {
            errorMessage = "賬號被鎖定";
        }else{
            errorMessage = "未知異常";
        }
 
        //設(shè)置響應(yīng)編碼
        httpServletResponse.setContentType("application/json;charset=utf-8");
        PrintWriter out = httpServletResponse.getWriter();
        out.write(errorMessage);
    }
}

package com.pjb.handler;
 
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.stereotype.Component;
 
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
 
/**
 * 403無權(quán)限處理類
 */
@Component
public class PermissionDeniedHandler implements AccessDeniedHandler
{
    @Override
    public void handle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AccessDeniedException e) throws IOException, ServletException
    {
        httpServletResponse.setContentType("application/json;charset=utf-8");
        PrintWriter out = httpServletResponse.getWriter();
        out.write("403無權(quán)限");
    }
}

package com.pjb.config;
 
import com.pjb.handler.LoginFailureHandler;
import com.pjb.handler.LoginSuccessHandler;
import com.pjb.handler.PermissionDeniedHandler;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
 
/**
 * Spring Security 配置類
 * @author pan_junbiao
 **/
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter
{
    @Autowired
    private LoginSuccessHandler loginSuccessHandler;
 
    @Autowired
    private LoginFailureHandler loginFailureHandler;
 
    @Autowired
    private PermissionDeniedHandler permissionDeniedHandler;
 
    //自定義的擴(kuò)展 UserDetailsService 類
    @Autowired
    private UserDetailsService loginUserDetailsService;
 
    //自定義的擴(kuò)展 AuthenticationProvider 類
    @Autowired
    private AuthenticationProvider loginAuthenticationProvider;
 
    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        http.authorizeRequests() //返回一個(gè)URL攔截注冊器
                .anyRequest() //匹配所有的請求
                .authenticated() //所有匹配的URL都需要被認(rèn)證才能訪問
                .and() //結(jié)束當(dāng)前標(biāo)簽，讓上下文回到 HttpSecurity
                .formLogin() //啟動(dòng)表單認(rèn)證
                .loginPage("/myLogin.html") //自定義登錄頁面
                .loginProcessingUrl("/auth/form") //指定處理登錄請求路徑
                .permitAll() //使登錄頁面不設(shè)限訪問
                //.defaultSuccessUrl("/index") //登錄認(rèn)證成功后的跳轉(zhuǎn)頁面
                .successHandler(loginSuccessHandler) //指定登錄成功時(shí)的處理
                .failureHandler(loginFailureHandler) //指定登錄失敗時(shí)的處理
                .and()
                .exceptionHandling().accessDeniedHandler(permissionDeniedHandler) //403無權(quán)時(shí)的返回操作
                .and().csrf().disable(); //關(guān)閉CSRF的防御功能
    }
 
    /**
     * 核心代碼：
     * 將擴(kuò)展的 LoginUserDetailsService 和 LoginAuthenticationProvider 注入，
     * 并將其添加到 AuthenticationManagerBuilder 中，這樣 AuthenticationManagerBuilder 將基于上述
     * 自定義的 LoginUserDetailsService 來完成 UserDetails 的創(chuàng)建和管理，
     * 并基于自定義的 LoginAuthenticationProvider 完成用戶認(rèn)證。
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception
    {
        auth.userDetailsService(loginUserDetailsService);
        auth.authenticationProvider(loginAuthenticationProvider);
    }
 
    /**
     * 由于5.x版本之后默認(rèn)啟用了委派密碼編譯器，
     * 因而按照以往的方式設(shè)置內(nèi)存密碼將會讀取異常，
     * 所以需要暫時(shí)將密碼編碼器設(shè)置為 NoOpPasswordEncoder
     */
    @Bean
    public PasswordEncoder passwordEncoder()
    {
        return NoOpPasswordEncoder.getInstance();
    }
}

package com.pjb.controller;
 
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
 
import javax.servlet.http.HttpServletRequest;
import java.security.Principal;
 
/**
 * 首頁控制器
 * @author pan_junbiao
 **/
@Controller
public class IndexController
{
    /**
     * 首頁
     */
    @RequestMapping("/")
    public String index(HttpServletRequest request)
    {
        //獲取當(dāng)前登錄人
        String userName = "未登錄";
        Principal principal = request.getUserPrincipal();
        if (principal != null)
        {
            userName = principal.getName();
        }
 
        //返回頁面
        request.setAttribute("userName", userName);
        return "/index.html";
    }
}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>登錄</title>
    <meta name="author" content="pan_junbiao的博客">
</head>
<body>
<form name="myForm" action="/auth/form" method="post">
    <table align="center">
        <caption>用戶登錄</caption>
        <tr>
            <td>登錄賬戶：</td>
            <td>
                <input type="text" name="username" placeholder="請輸入登錄賬戶" value="panjunbiao" />
            </td>
        </tr>
        <tr>
            <td>登錄密碼：</td>
            <td>
                <input type="password" name="password" placeholder="請輸入登錄密碼" value="123456" />
            </td>
        </tr>
        <!-- 以下是提交、取消按鈕 -->
        <tr>
            <td colspan="2" style="text-align: center; padding: 5px;">
                <input type="submit" value="提交" />
                <input type="reset" value="重置" />
            </td>
        </tr>
    </table>
</form>
</body>
</html>

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8">
    <title>首頁</title>
    <meta name="author" content="pan_junbiao的博客">
</head>
<body>
    <h1 style="color: red">Hello,Spring Security</h1>
    <p>博客信息：您好，歡迎訪問 pan_junbiao的博客</p>
    <p>博客地址：https://blog.csdn.net/pan_junbiao</p>
    <p th:text="'當(dāng)前登錄人：' + ${userName}"></p>
    <a href="/logout" rel="external nofollow"  onclick="return confirm('確認(rèn)注銷嗎？');">登出</a>
</body>
</html>