src/
├── main/
│   ├── java/com/example/demo/
│   │   ├── config/
│   │   │   ├── SecurityConfig.java
│   │   │   ├── JwtAuthenticationFilter.java
│   │   │   └── JwtUtil.java
│   │   ├── controller/
│   │   │   ├── AuthController.java
│   │   │   └── TestController.java
│   │   ├── entity/
│   │   │   ├── User.java
│   │   │   └── Role.java
│   │   ├── mapper/
│   │   │   └── UserMapper.java
│   │   ├── service/
│   │   │   ├── UserService.java
│   │   │   └── CustomUserDetailsService.java
│   │   └── DemoApplication.java
│   └── resources/
│       ├── application.properties
│       ├── schema.sql
│       └── mapper/UserMapper.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 
         http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.7.0</version>
        <relativePath/>
    </parent>
    <groupId>com.example</groupId>
    <artifactId>demo</artifactId>
    <version>1.0.0</version>
    <properties>
        <java.version>11</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>2.2.2</version>
        </dependency>
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-api</artifactId>
            <version>0.11.5</version>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-impl</artifactId>
            <version>0.11.5</version>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-jackson</artifactId>
            <version>0.11.5</version>
            <scope>runtime</scope>
        </dependency>
    </dependencies>
</project>

# 服務器端口
server.port=8080
# 數(shù)據(jù)庫配置
spring.datasource.url=jdbc:mysql://localhost:3306/security_demo?useSSL=false&serverTimezone=UTC
spring.datasource.username=root
spring.datasource.password=password
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
# MyBatis配置
mybatis.mapper-locations=classpath:mapper/*.xml
mybatis.type-aliases-package=com.example.demo.entity
# JWT密鑰
jwt.secret=mySecretKey
jwt.expiration=86400

# 使用足夠長且復雜的密鑰
jwt.secret=mySuperLongAndComplexSecretKeyThatIsHardToGuess123!

# 生產(chǎn)環(huán)境應強制使用HTTPS
server.ssl.enabled=true
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=password
server.ssl.key-store-type=PKCS12

CREATE DATABASE IF NOT EXISTS security_demo;
USE security_demo;
CREATE TABLE IF NOT EXISTS users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL UNIQUE,
    password VARCHAR(100) NOT NULL,
    enabled BOOLEAN NOT NULL DEFAULT TRUE
);
CREATE TABLE IF NOT EXISTS roles (
    id INT AUTO_INCREMENT PRIMARY KEY,
    name VARCHAR(50) NOT NULL UNIQUE
);
CREATE TABLE IF NOT EXISTS user_roles (
    user_id INT NOT NULL,
    role_id INT NOT NULL,
    PRIMARY KEY (user_id, role_id),
    FOREIGN KEY (user_id) REFERENCES users(id),
    FOREIGN KEY (role_id) REFERENCES roles(id)
);
-- 插入角色數(shù)據(jù)
INSERT IGNORE INTO roles (name) VALUES ('ROLE_USER');
INSERT IGNORE INTO roles (name) VALUES ('ROLE_ADMIN');
-- 插入用戶數(shù)據(jù)（密碼使用BCrypt加密，原始密碼均為"password"）
INSERT IGNORE INTO users (username, password, enabled) VALUES 
('user', '$2a$10$N.zmdr9k7uOCQb376NoUnuTJ8iAt6Z5EHsM8lE9lBOsl7iKTVKIUi', 1),
('admin', '$2a$10$N.zmdr9k7uOCQb376NoUnuTJ8iAt6Z5EHsM8lE9lBOsl7iKTVKIUi', 1);
-- 分配角色
INSERT IGNORE INTO user_roles (user_id, role_id) VALUES 
(1, 1), -- user has ROLE_USER
(2, 2); -- admin has ROLE_ADMIN

// User.java
package com.example.demo.entity;
import java.util.List;
public class User {
    private Long id;
    private String username;
    private String password;
    private Boolean enabled;
    private List<Role> roles;
    // 構造方法、getter和setter
    public User() {}
    public User(String username, String password) {
        this.username = username;
        this.password = password;
    }
    // 省略getter和setter
}
// Role.java
package com.example.demo.entity;
public class Role {
    private Long id;
    private String name;
    // 構造方法、getter和setter
    public Role() {}
    public Role(String name) {
        this.name = name;
    }
    // 省略getter和setter
}

// UserMapper.java
package com.example.demo.mapper;
import com.example.demo.entity.User;
import org.apache.ibatis.annotations.Mapper;
@Mapper
public interface UserMapper {
    User findByUsername(String username);
    User findById(Long id);
}

<!-- UserMapper.xml -->
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" 
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.example.demo.mapper.UserMapper">
    <resultMap id="userResultMap" type="User">
        <id property="id" column="id" />
        <result property="username" column="username" />
        <result property="password" column="password" />
        <result property="enabled" column="enabled" />
        <collection property="roles" ofType="Role">
            <id property="id" column="role_id" />
            <result property="name" column="role_name" />
        </collection>
    </resultMap>
    <select id="findByUsername" resultMap="userResultMap">
        SELECT u.*, r.id as role_id, r.name as role_name
        FROM users u
        LEFT JOIN user_roles ur ON u.id = ur.user_id
        LEFT JOIN roles r ON ur.role_id = r.id
        WHERE u.username = #{username}
    </select>
    <select id="findById" resultMap="userResultMap">
        SELECT u.*, r.id as role_id, r.name as role_name
        FROM users u
        LEFT JOIN user_roles ur ON u.id = ur.user_id
        LEFT JOIN roles r ON ur.role_id = r.id
        WHERE u.id = #{id}
    </select>
</mapper>

// CustomUserDetailsService.java
package com.example.demo.service;
import com.example.demo.entity.User;
import com.example.demo.mapper.UserMapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import java.util.List;
import java.util.stream.Collectors;
@Service
public class CustomUserDetailsService implements UserDetailsService {
    @Autowired
    private UserMapper userMapper;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userMapper.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("用戶不存在: " + username);
        }
        List<GrantedAuthority> authorities = user.getRoles().stream()
                .map(role -> new SimpleGrantedAuthority(role.getName()))
                .collect(Collectors.toList());
        return new org.springframework.security.core.userdetails.User(
                user.getUsername(), 
                user.getPassword(), 
                authorities);
    }
}
// UserService.java
package com.example.demo.service;
import com.example.demo.entity.User;
import com.example.demo.mapper.UserMapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
@Service
public class UserService {
    @Autowired
    private UserMapper userMapper;
    public User findByUsername(String username) {
        return userMapper.findByUsername(username);
    }
}

package com.example.demo.config;
import io.jsonwebtoken.*;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;
import java.util.Date;
/**
 * JWT工具類 - 負責JWT令牌的生成、解析和驗證
 * 
 * 安全特性說明：
 * 1. 使用HMAC-SHA512算法進行簽名，確保令牌完整性
 * 2. 設置合理的過期時間，減少令牌泄露風險
 * 3. 從配置文件中讀取密鑰，便于管理和輪換
 * 4. 提供完整的異常處理，防止無效令牌導致系統(tǒng)異常
 */
@Component
public class JwtUtil {
    // 從配置文件中注入JWT密鑰，生產(chǎn)環(huán)境應使用復雜且足夠長的密鑰
    @Value("${jwt.secret}")
    private String secret;
    // 從配置文件中注入JWT過期時間（秒）
    @Value("${jwt.expiration}")
    private long expiration;
    /**
     * 生成JWT令牌
     * 
     * 安全考慮：
     * 1. 只包含必要信息（用戶名），不包含敏感數(shù)據(jù)
     * 2. 設置簽發(fā)時間和過期時間，控制令牌有效期
     * 3. 使用強加密算法（HS512）進行簽名
     * 
     * @param authentication Spring Security認證對象
     * @return JWT令牌字符串
     */
    public String generateToken(Authentication authentication) {
        // 從認證對象中獲取用戶信息
        UserDetails userDetails = (UserDetails) authentication.getPrincipal();
        Date now = new Date();
        // 計算過期時間：當前時間 + 配置的過期時間（轉換為毫秒）
        Date expiryDate = new Date(now.getTime() + expiration * 1000);
        // 構建JWT令牌
        return Jwts.builder()
                .setSubject(userDetails.getUsername()) // 設置主題（用戶名）
                .setIssuedAt(now)                     // 設置簽發(fā)時間
                .setExpiration(expiryDate)            // 設置過期時間
                .signWith(SignatureAlgorithm.HS512, secret) // 使用HS512算法和密鑰簽名
                .compact();                           // 生成緊湊的JWT字符串
    }
    /**
     * 從JWT令牌中提取用戶名
     * 
     * 安全考慮：
     * 1. 驗證簽名確保令牌未被篡改
     * 2. 解析前不信任任何令牌內容
     * 
     * @param token JWT令牌
     * @return 用戶名
     */
    public String getUsernameFromToken(String token) {
        // 解析JWT令牌，驗證簽名并獲取聲明(Claims)
        Claims claims = Jwts.parser()
                .setSigningKey(secret)                // 設置簽名密鑰
                .parseClaimsJws(token)                // 解析JWS（已簽名的JWT）
                .getBody();                           // 獲取有效負載（Payload）
        // 返回主題（用戶名）
        return claims.getSubject();
    }
    /**
     * 驗證JWT令牌的有效性
     * 
     * 安全考慮：
     * 1. 驗證簽名是否正確，防止偽造令牌
     * 2. 檢查令牌是否過期
     * 3. 捕獲所有可能異常，防止無效令牌導致系統(tǒng)異常
     * 
     * @param token JWT令牌
     * @return 令牌是否有效
     */
    public boolean validateToken(String token) {
        try {
            // 嘗試解析令牌，如果成功則說明令牌有效
            Jwts.parser().setSigningKey(secret).parseClaimsJws(token);
            return true;
        } catch (SignatureException ex) {
            // 簽名不匹配 - 令牌可能被篡改
            // 記錄日志但不拋出異常，避免信息泄露
        } catch (MalformedJwtException ex) {
            // 令牌格式錯誤 - 不是有效的JWT
        } catch (ExpiredJwtException ex) {
            // 令牌已過期 - 需要重新登錄獲取新令牌
        } catch (UnsupportedJwtException ex) {
            // 不支持的JWT令牌 - 可能使用了錯誤的算法
        } catch (IllegalArgumentException ex) {
            // JWT claims string is empty - 令牌為空
        }
        // 任何異常都意味著令牌無效
        return false;
    }
}

package com.example.demo.config;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
 * JWT認證過濾器 - 處理每個請求的JWT認證
 * 
 * 安全特性說明：
 * 1. 在每個請求前執(zhí)行，確保所有請求都經(jīng)過認證檢查
 * 2. 從Authorization頭中提取Bearer令牌
 * 3. 驗證令牌有效性并設置安全上下文
 * 4. 即使認證失敗也繼續(xù)過濾器鏈，確保公共接口可訪問
 */
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    @Autowired
    private JwtUtil jwtUtil;
    @Autowired
    private UserDetailsService userDetailsService;
    /**
     * 過濾器核心方法 - 處理每個HTTP請求
     * 
     * 安全流程：
     * 1. 從請求中提取JWT令牌
     * 2. 驗證令牌有效性
     * 3. 如果有效，從令牌中提取用戶名并加載用戶詳情
     * 4. 設置安全上下文，供后續(xù)授權檢查使用
     * 
     * @param request HTTP請求
     * @param response HTTP響應
     * @param filterChain 過濾器鏈
     */
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                    HttpServletResponse response, 
                                    FilterChain filterChain) throws ServletException, IOException {
        try {
            // 從HTTP請求中獲取JWT令牌
            String jwt = getJwtFromRequest(request);
            // 驗證令牌是否存在且有效
            if (StringUtils.hasText(jwt) && jwtUtil.validateToken(jwt)) {
                // 從有效令牌中提取用戶名
                String username = jwtUtil.getUsernameFromToken(jwt);
                // 從數(shù)據(jù)庫加載用戶詳細信息（包括權限）
                UserDetails userDetails = userDetailsService.loadUserByUsername(username);
                // 創(chuàng)建認證令牌，包含用戶詳情和權限
                UsernamePasswordAuthenticationToken authentication = 
                    new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                // 添加請求詳情（如IP地址、會話ID等）
                authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                // 將認證信息設置到安全上下文中，供后續(xù)授權檢查使用
                SecurityContextHolder.getContext().setAuthentication(authentication);
            }
        } catch (Exception ex) {
            // 捕獲所有異常，避免因認證問題導致請求失敗
            // 記錄錯誤日志但繼續(xù)處理請求（某些接口可能允許匿名訪問）
            logger.error("Could not set user authentication in security context", ex);
        }
        // 繼續(xù)過濾器鏈處理（無論認證成功與否）
        filterChain.doFilter(request, response);
    }
    /**
     * 從HTTP請求中提取JWT令牌
     * 
     * 安全考慮：
     * 1. 只接受Bearer類型的認證頭
     * 2. 移除"Bearer "前綴，獲取純令牌
     * 
     * @param request HTTP請求
     * @return JWT令牌或null（如果不存在）
     */
    private String getJwtFromRequest(HttpServletRequest request) {
        // 從Authorization頭獲取Bearer令牌
        String bearerToken = request.getHeader("Authorization");
        // 檢查令牌是否存在且格式正確（以"Bearer "開頭）
        if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
            // 返回去掉"Bearer "前綴的純令牌
            return bearerToken.substring(7);
        }
        // 沒有找到有效令牌
        return null;
    }
}

package com.example.demo.config;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
/**
 * Spring Security配置類 - 定義應用程序的安全策略
 * 
 * 安全特性說明：
 * 1. 使用無狀態(tài)會話管理，適合RESTful API
 * 2. 配置密碼編碼器，確保密碼安全存儲
 * 3. 定義URL訪問規(guī)則，實現(xiàn)基于角色的訪問控制
 * 4. 集成JWT認證過濾器，替代默認的表單登錄
 */
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private CustomUserDetailsService userDetailsService;
    @Autowired
    private JwtUtil jwtUtil;
    /**
     * 密碼編碼器Bean - 用于密碼加密和驗證
     * 
     * 安全考慮：
     * 1. 使用BCrypt強哈希算法，自動處理鹽值
     * 2. 適合密碼存儲，抵抗彩虹表攻擊
     * 
     * @return BCrypt密碼編碼器實例
     */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    /**
     * 認證管理器Bean - 暴露給其他組件使用
     * 
     * 用途：
     * 1. 在AuthController中用于手動認證用戶
     * 2. 可以被其他需要認證服務的組件使用
     */
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
    /**
     * 配置認證管理器 - 設置自定義用戶詳情服務和密碼編碼器
     * 
     * 安全流程：
     * 1. 使用自定義UserDetailsService從數(shù)據(jù)庫加載用戶信息
     * 2. 使用BCrypt密碼編碼器驗證密碼
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }
    /**
     * 配置HTTP安全策略 - 核心安全配置方法
     * 
     * 安全策略：
     * 1. 禁用CORS和CSRF（因使用無狀態(tài)JWT認證）
     * 2. 使用無狀態(tài)會話管理
     * 3. 配置URL訪問規(guī)則（基于角色）
     * 4. 添加JWT認證過濾器
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // 啟用CORS并禁用CSRF（因使用JWT而非Cookie）
            .cors().and().csrf().disable()
            // 會話管理設置為無狀態(tài)（不創(chuàng)建和使用HTTP會話）
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
            // 配置請求授權規(guī)則
            .authorizeRequests()
                .antMatchers("/api/auth/**").permitAll()      // 認證接口允許匿名訪問
                .antMatchers("/api/user/**").hasRole("USER")  // 用戶接口需要USER角色
                .antMatchers("/api/admin/**").hasRole("ADMIN") // 管理員接口需要ADMIN角色
                .anyRequest().authenticated()                 // 其他所有請求需要認證
            .and();
        // 添加JWT認證過濾器到UsernamePasswordAuthenticationFilter之前
        http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    }
    /**
     * 創(chuàng)建JWT認證過濾器Bean
     * 
     * 說明：
     * 1. 過濾器在每個請求前執(zhí)行
     * 2. 負責提取和驗證JWT令牌
     * 3. 設置安全上下文中的認證信息
     * 
     * @return JWT認證過濾器實例
     */
    @Bean
    public JwtAuthenticationFilter jwtAuthenticationFilter() {
        return new JwtAuthenticationFilter();
    }
}

// AuthController.java
package com.example.demo.controller;
import com.example.demo.config.JwtUtil;
import com.example.demo.entity.User;
import com.example.demo.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.ResponseEntity;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.bind.annotation.*;
import java.util.HashMap;
import java.util.Map;
@RestController
@RequestMapping("/api/auth")
public class AuthController {
    @Autowired
    private AuthenticationManager authenticationManager;
    @Autowired
    private JwtUtil jwtUtil;
    @Autowired
    private UserService userService;
    @PostMapping("/login")
    public ResponseEntity<?> login(@RequestBody Map<String, String> loginRequest) {
        String username = loginRequest.get("username");
        String password = loginRequest.get("password");
        Authentication authentication = authenticationManager.authenticate(
            new UsernamePasswordAuthenticationToken(username, password)
        );
        SecurityContextHolder.getContext().setAuthentication(authentication);
        String jwt = jwtUtil.generateToken(authentication);
        User user = userService.findByUsername(username);
        Map<String, Object> response = new HashMap<>();
        response.put("token", jwt);
        response.put("user", user);
        return ResponseEntity.ok(response);
    }
}
// TestController.java
package com.example.demo.controller;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/api")
public class TestController {
    @GetMapping("/user/test")
    @PreAuthorize("hasRole('USER')")
    public String userAccess() {
        return "用戶內容";
    }
    @GetMapping("/admin/test")
    @PreAuthorize("hasRole('ADMIN')")
    public String adminAccess() {
        return "管理員內容";
    }
}

// DemoApplication.java
package com.example.demo;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
public class DemoApplication {
    public static void main(String[] args) {
        SpringApplication.run(DemoApplication.class, args);
    }
}

POST http://localhost:8080/api/auth/login
Content-Type: application/json
{
  "username": "user",
  "password": "password"
}

GET http://localhost:8080/api/user/test
Authorization: Bearer <your_token>

GET http://localhost:8080/api/admin/test
Authorization: Bearer <your_token>