@Override
public UserDetails loadUserByUsername(String username) {
    // 從數(shù)據(jù)庫查用戶 → 返回 UserDetails（含加密密碼 + 權(quán)限）
}

// 注冊時(shí)：
user.setPassword(passwordEncoder.encode(rawPassword));
// 登錄時(shí)（框架自動(dòng)調(diào)用）：
passwordEncoder.matches(rawPassword, encodedPassword); // true/false

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
String username = auth.getName();

sequenceDiagram
    participant User
    participant Filter as FilterChain (Spring Security)
    participant Provider as AuthenticationProvider
    participant Service as UserDetailsService
    participant Encoder as PasswordEncoder
    User->>Filter: 提交用戶名/密碼
    Filter->>Provider: 調(diào)用 authenticate()
    Provider->>Service: loadUserByUsername(username)
    Service-->>Provider: 返回 UserDetails（含加密密碼）
    Provider->>Encoder: matches(輸入密碼, 數(shù)據(jù)庫加密密碼)
    alt 匹配成功
        Encoder-->>Provider: true
        Provider-->>Filter: 返回認(rèn)證成功 Authentication
        Filter->>User: 登錄成功，跳轉(zhuǎn)
    else 匹配失敗
        Encoder-->>Provider: false
        Provider-->>Filter: 拋出異常
        Filter->>User: 登錄失敗
    end

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/login", "/register", "/css/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")           // 自定義登錄頁
                .defaultSuccessUrl("/home")    // 登錄成功跳轉(zhuǎn)
                .permitAll()
            )
            .logout(logout -> logout
                .logoutSuccessUrl("/login?logout")
                .permitAll()
            );
        return http.build();
    }
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(); // 推薦使用 BCrypt
    }
}

@Component
public class MyUserServiceImpl implements UserDetailsService {
    @Autowired
    private UserMapper userMapper;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userMapper.findUserByName(username);
        if (user == null) throw new UsernameNotFoundException("用戶不存在");
        // ? 直接返回?cái)?shù)據(jù)庫中的加密密碼（注冊時(shí)已加密存儲(chǔ)?。?
        return User.builder()
            .username(user.getUsername())
            .password(user.getSupwd()) // ← 不要再 encode!
            .roles("USER") // 或者 .authorities(getAuthorities())
            .build();
    }
}

@Service
public class ArticleService {
    @PreAuthorize("hasRole('ADMIN')") // 需要 ADMIN 角色
    public void deleteArticle(Long id) {
        // ...
    }
    @PreAuthorize("hasAuthority('article:edit')") // 需要具體權(quán)限
    public void editArticle(Article article) {
        // ...
    }
    @PostAuthorize("returnObject.owner == authentication.name")
    public Article getArticle(Long id) {
        // 返回后檢查：只有文章主人才能看
    }
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity // ← 啟用 @PreAuthorize 等注解
public class SecurityConfig { ... }

<!-- 只有 ADMIN 能看到 -->
<div sec:authorize="hasRole('ADMIN')">
    <a href="/admin" rel="external nofollow" >管理后臺(tái)</a>
</div>
<!-- 顯示當(dāng)前用戶名 -->
<span sec:authentication="name"></span>

<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity6</artifactId>
</dependency>

@Component
public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, 
                                        HttpServletResponse response, 
                                        Authentication authentication) throws IOException {
        response.sendRedirect("/home?loginSuccess");
    }
}

.formLogin(form -> form
    .successHandler(mySuccessHandler)
    .failureHandler(myFailureHandler)
)

@Component
public class MyAccessDeniedHandler implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException {
        response.sendRedirect("/403");
    }
}

.exceptionHandling(ex -> ex
    .accessDeniedHandler(myAccessDeniedHandler)
)

src/
├── controller/
│   └── LoginController.java       // 登錄頁、首頁
├── service/
│   └── MyUserServiceImpl.java     // loadUserByUsername
├── config/
│   └── SecurityConfig.java        // 權(quán)限配置 + PasswordEncoder
└── entity/
    └── User.java                  // 用戶實(shí)體（含加密密碼字段）