{
??"alg": "HS256", // 簽名算法
??"typ": "JWT" // 令牌類型
}

{ "userId": 1, // 自定義聲明：用戶ID "userName": "admin", // 自定義聲明：用戶名 "role": "ADMIN", // 自定義聲明：角色 "exp": 1715287600, // 標(biāo)準(zhǔn)聲明：過(guò)期時(shí)間 "iat": 1715284000 // 標(biāo)準(zhǔn)聲明：簽發(fā)時(shí)間 }

<!-- Spring Boot Web -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>
<!-- Spring Security -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<!-- JWT依賴 -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.11.5</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>
<!-- 數(shù)據(jù)庫(kù)依賴（模擬用戶數(shù)據(jù)，可替換為MySQL） -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
    <groupId>com.h2database</groupId>
    <artifactId>h2</artifactId>
    <scope>runtime</scope>
</dependency>

import io.jsonwebtoken.*;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import java.util.function.Function;
@Component
public class JwtTokenUtil {
    // JWT簽名密鑰（生產(chǎn)環(huán)境需配置在配置中心，如Nacos，嚴(yán)禁硬編碼）
    @Value("${jwt.secret}")
    private String secret;
    // JWT過(guò)期時(shí)間（單位：毫秒，此處配置1小時(shí)）
    @Value("${jwt.expiration}")
    private long expiration;
    // 從令牌中獲取用戶名
    public String getUsernameFromToken(String token) {
        return getClaimFromToken(token, Claims::getSubject);
    }
    // 從令牌中獲取過(guò)期時(shí)間
    public Date getExpirationDateFromToken(String token) {
        return getClaimFromToken(token, Claims::getExpiration);
    }
    // 從令牌中獲取自定義聲明
    public <T> T getClaimFromToken(String token, Function<Claims, T> claimsResolver) {
        final Claims claims = getAllClaimsFromToken(token);
        return claimsResolver.apply(claims);
    }
    // 解析令牌，獲取所有聲明（需驗(yàn)證簽名）
    private Claims getAllClaimsFromToken(String token) {
        return Jwts.parserBuilder()
                .setSigningKey(secret.getBytes())
                .build()
                .parseClaimsJws(token)
                .getBody();
    }
    // 判斷令牌是否過(guò)期
    private Boolean isTokenExpired(String token) {
        final Date expiration = getExpirationDateFromToken(token);
        return expiration.before(new Date());
    }
    // 生成JWT令牌（基于用戶信息）
    public String generateToken(UserDetails userDetails) {
        Map<String, Object> claims = new HashMap<>();
        // 自定義聲明：添加用戶角色（可根據(jù)需求添加更多信息）
        claims.put("roles", userDetails.getAuthorities());
        return doGenerateToken(claims, userDetails.getUsername());
    }
    // 生成令牌核心方法
    private String doGenerateToken(Map<String, Object> claims, String subject) {
        return Jwts.builder()
                .setClaims(claims) // 自定義聲明
                .setSubject(subject) // 用戶名（唯一標(biāo)識(shí)）
                .setIssuedAt(new Date(System.currentTimeMillis())) // 簽發(fā)時(shí)間
                .setExpiration(new Date(System.currentTimeMillis() + expiration)) // 過(guò)期時(shí)間
                .signWith(SignatureAlgorithm.HS256, secret.getBytes()) // 簽名算法+密鑰
                .compact();
    }
    // 驗(yàn)證令牌（驗(yàn)證簽名、過(guò)期時(shí)間、用戶名匹配）
    public Boolean validateToken(String token, UserDetails userDetails) {
        final String username = getUsernameFromToken(token);
        return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
    }
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
@Configuration
@EnableWebSecurity // 啟用Spring Security
@EnableGlobalMethodSecurity(prePostEnabled = true) // 啟用方法級(jí)別的權(quán)限控制
public class SecurityConfig {
    @Autowired
    private UserDetailsService userDetailsService;
    @Autowired
    private JwtAuthenticationFilter jwtAuthenticationFilter;
    @Autowired
    private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
    // 密碼加密器（BCrypt加密，不可逆，安全性高）
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    // 認(rèn)證提供者（關(guān)聯(lián)UserDetailsService和PasswordEncoder）
    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService);
        authProvider.setPasswordEncoder(passwordEncoder());
        return authProvider;
    }
    // 認(rèn)證管理器（核心認(rèn)證組件）
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }
    // 核心安全配置（配置授權(quán)規(guī)則、過(guò)濾器、會(huì)話管理等）
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                // 關(guān)閉CSRF防護(hù)（微服務(wù)中JWT無(wú)狀態(tài)，無(wú)需CSRF）
                .csrf().disable()
                // 配置未認(rèn)證請(qǐng)求的處理方式（返回401）
                .exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint).and()
                // 配置會(huì)話管理：無(wú)狀態(tài)（不創(chuàng)建Session）
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                // 配置授權(quán)規(guī)則
                .authorizeRequests()
                // 登錄接口、注冊(cè)接口允許匿名訪問(wèn)
                .antMatchers("/api/auth/login", "/api/auth/register").permitAll()
                // 靜態(tài)資源允許匿名訪問(wèn)
                .antMatchers("/static/**", "/swagger-ui/**").permitAll()
                // 管理員接口僅允許ADMIN角色訪問(wèn)
                .antMatchers("/api/admin/**").hasRole("ADMIN")
                // 普通用戶接口允許USER或ADMIN角色訪問(wèn)
                .antMatchers("/api/user/**").hasAnyRole("USER", "ADMIN")
                // 其他所有請(qǐng)求都需要認(rèn)證
                .anyRequest().authenticated();
        // 注冊(cè)認(rèn)證提供者
        http.authenticationProvider(authenticationProvider());
        // 添加JWT過(guò)濾器（在用戶名密碼過(guò)濾器之前執(zhí)行，先驗(yàn)證令牌）
        http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    @Autowired
    private JwtTokenUtil jwtTokenUtil;
    @Autowired
    private UserDetailsService userDetailsService;
    // 攔截請(qǐng)求，驗(yàn)證JWT令牌
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        try {
            // 1. 從請(qǐng)求頭中提取JWT令牌（請(qǐng)求頭格式：Authorization: Bearer <token>）
            String jwt = getJwtFromRequest(request);
            // 2. 驗(yàn)證令牌是否存在且有效
            if (jwt != null && !jwt.isEmpty() && jwtTokenUtil.validateToken(jwt, userDetailsService.loadUserByUsername(jwtTokenUtil.getUsernameFromToken(jwt)))) {
                // 3. 從令牌中獲取用戶名，加載用戶信息
                String username = jwtTokenUtil.getUsernameFromToken(jwt);
                UserDetails userDetails = userDetailsService.loadUserByUsername(username);
                // 4. 創(chuàng)建認(rèn)證對(duì)象，存入SecurityContext
                UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
                        userDetails, null, userDetails.getAuthorities());
                authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(authentication);
            }
        } catch (Exception e) {
            logger.error("無(wú)法設(shè)置用戶認(rèn)證信息: {}", e);
        }
        // 繼續(xù)執(zhí)行過(guò)濾器鏈
        filterChain.doFilter(request, response);
    }
    // 從請(qǐng)求頭中提取JWT令牌
    private String getJwtFromRequest(HttpServletRequest request) {
        String bearerToken = request.getHeader("Authorization");
        if (bearerToken != null && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7); // 截取Bearer后面的令牌部分
        }
        return null;
    }
}

import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.stereotype.Component;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
@Component
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {
    // 未認(rèn)證請(qǐng)求的處理邏輯
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException)
            throws IOException, ServletException {
        // 設(shè)置響應(yīng)狀態(tài)碼401，返回JSON格式的錯(cuò)誤信息
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        response.setContentType("application/json");
        response.getWriter().write("{\"code\":401,\"message\":\"未認(rèn)證，請(qǐng)先登錄獲取令牌\"}");
    }
}

import lombok.Data;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import javax.persistence.*;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
@Data
@Entity
@Table(name = "sys_user")
public class User implements UserDetails {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    @Column(unique = true, nullable = false)
    private String username; // 用戶名（唯一）
    @Column(nullable = false)
    private String password; // 加密后的密碼
    private String role; // 角色（如ADMIN、USER）
    // 實(shí)現(xiàn)UserDetails接口方法：獲取用戶權(quán)限
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        List<GrantedAuthority> authorities = new ArrayList<>();
        // 將角色轉(zhuǎn)換為Spring Security認(rèn)可的權(quán)限格式（ROLE_前綴）
        authorities.add(new SimpleGrantedAuthority("ROLE_" + role));
        return authorities;
    }
    // 實(shí)現(xiàn)UserDetails接口方法：賬號(hào)是否未過(guò)期（默認(rèn)true）
    @Override
    public boolean isAccountNonExpired() {
        return true;
    }
    // 實(shí)現(xiàn)UserDetails接口方法：賬號(hào)是否未鎖定（默認(rèn)true）
    @Override
    public boolean isAccountNonLocked() {
        return true;
    }
    // 實(shí)現(xiàn)UserDetails接口方法：憑證是否未過(guò)期（默認(rèn)true）
    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }
    // 實(shí)現(xiàn)UserDetails接口方法：賬號(hào)是否啟用（默認(rèn)true）
    @Override
    public boolean isEnabled() {
        return true;
    }
}

import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.stereotype.Repository;
import java.util.Optional;
@Repository
public interface UserRepository extends JpaRepository<User, Long> {
    // 根據(jù)用戶名查詢用戶（Spring Security認(rèn)證核心方法）
    Optional<User> findByUsername(String username);
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
@Service
public class CustomUserDetailsService implements UserDetailsService {
    @Autowired
    private UserRepository userRepository;
    // 加載用戶信息（根據(jù)用戶名）
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 從數(shù)據(jù)庫(kù)查詢用戶，若不存在則拋出異常
        User user = userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("用戶不存在：" + username));
        // 返回User對(duì)象（已實(shí)現(xiàn)UserDetails接口）
        return user;
    }
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.ResponseEntity;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import java.util.HashMap;
import java.util.Map;
@RestController
@RequestMapping("/api/auth")
public class AuthController {
    @Autowired
    private AuthenticationManager authenticationManager;
    @Autowired
    private UserDetailsService userDetailsService;
    @Autowired
    private JwtTokenUtil jwtTokenUtil;
    @Autowired
    private UserRepository userRepository;
    @Autowired
    private PasswordEncoder passwordEncoder;
    // 登錄接口：接收賬號(hào)密碼，返回JWT令牌
    @PostMapping("/login")
    public ResponseEntity<Map<String, String>> login(@RequestBody LoginRequest loginRequest) {
        // 1. 執(zhí)行認(rèn)證（驗(yàn)證賬號(hào)密碼）
        Authentication authentication = authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(
                        loginRequest.getUsername(),
                        loginRequest.getPassword()
                )
        );
        // 2. 認(rèn)證通過(guò)，將認(rèn)證信息存入SecurityContext
        SecurityContextHolder.getContext().setAuthentication(authentication);
        // 3. 加載用戶信息，生成JWT令牌
        UserDetails userDetails = userDetailsService.loadUserByUsername(loginRequest.getUsername());
        String jwt = jwtTokenUtil.generateToken(userDetails);
        // 4. 返回令牌和用戶信息
        Map<String, String> response = new HashMap<>();
        response.put("token", jwt);
        response.put("username", userDetails.getUsername());
        response.put("role", userDetails.getAuthorities().iterator().next().getAuthority().replace("ROLE_", ""));
        return ResponseEntity.ok(response);
    }
    // 注冊(cè)接口（可選，用于測(cè)試）
    @PostMapping("/register")
    public ResponseEntity<String> register(@RequestBody RegisterRequest registerRequest) {
        // 檢查用戶名是否已存在
        if (userRepository.findByUsername(registerRequest.getUsername()).isPresent()) {
            return ResponseEntity.badRequest().body("用戶名已存在");
        }
        // 創(chuàng)建用戶，加密密碼
        User user = new User();
        user.setUsername(registerRequest.getUsername());
        user.setPassword(passwordEncoder.encode(registerRequest.getPassword()));
        user.setRole(registerRequest.getRole()); // 如"USER"、"ADMIN"
        userRepository.save(user);
        return ResponseEntity.ok("注冊(cè)成功");
    }
    // 登錄請(qǐng)求參數(shù)封裝
    public static class LoginRequest {
        private String username;
        private String password;
        // getter/setter
        public String getUsername() { return username; }
        public void setUsername(String username) { this.username = username; }
        public String getPassword() { return password; }
        public void setPassword(String password) { this.password = password; }
    }
    // 注冊(cè)請(qǐng)求參數(shù)封裝
    public static class RegisterRequest {
        private String username;
        private String password;
        private String role;
        // getter/setter
        public String getUsername() { return username; }
        public void setUsername(String username) { this.username = username; }
        public String getPassword() { return password; }
        public void setPassword(String password) { this.password = password; }
        public String getRole() { return role; }
        public void setRole(String role) { this.role = role; }
    }
}

spring:
  # 數(shù)據(jù)庫(kù)配置（H2內(nèi)存數(shù)據(jù)庫(kù)，用于測(cè)試）
  datasource:
    url: jdbc:h2:mem:testdb
    driver-class-name: org.h2.Driver
    username: sa
    password: 123456
  # JPA配置
  jpa:
    hibernate:
      ddl-auto: update # 自動(dòng)創(chuàng)建表結(jié)構(gòu)
    show-sql: true
    properties:
      hibernate:
        format_sql: true
  # H2控制臺(tái)配置（訪問(wèn)：http://localhost:8080/h2-console）
  h2:
    console:
      enabled: true
      path: /h2-console
# JWT配置
jwt:
  secret: abc1234567890abc1234567890abc1234 # 簽名密鑰（生產(chǎn)環(huán)境需修改，建議至少32位）
  expiration: 3600000 # 過(guò)期時(shí)間（1小時(shí)，單位：毫秒）
# 服務(wù)器端口
server:
  port: 8080

<!-- 新增OAuth2.0授權(quán)服務(wù)器依賴 -->
<dependency>
    <groupId>org.springframework.security.oauth</groupId>
    <artifactId>spring-security-oauth2</artifactId>
    <version>2.3.8.RELEASE</version>
</dependency>
<!-- 其他依賴（Spring Boot Web、Spring Security、JWT、數(shù)據(jù)庫(kù)）同上 -->

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
@Configuration
@EnableAuthorizationServer // 啟用授權(quán)服務(wù)器
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
    // 客戶端ID（提前注冊(cè)，用于客戶端身份驗(yàn)證）
    private static final String CLIENT_ID = "client1";
    // 客戶端密鑰（加密存儲(chǔ)，密碼：123456）
    private static final String CLIENT_SECRET = "$2a$10$EixZaYbB.rK4fl8x2q7Meu6Q6D2V4Xw6Q6D2V4Xw6Q6D2V4Xw6Q6";
    // 授權(quán)范圍
    private static final String SCOPE = "all";
    // 授權(quán)碼模式
    private static final String GRANT_TYPE_AUTHORIZATION_CODE = "authorization_code";
    // 密碼模式
    private static final String GRANT_TYPE_PASSWORD = "password";
    // 刷新令牌模式
    private static final String GRANT_TYPE_REFRESH_TOKEN = "refresh_token";
    // 令牌有效期（1小時(shí)）
    private static final int ACCESS_TOKEN_VALIDITY_SECONDS = 3600;
    // 刷新令牌有效期（7天）
    private static final int REFRESH_TOKEN_VALIDITY_SECONDS = 604800;
    @Autowired
    private AuthenticationManager authenticationManager;
    @Autowired
    private PasswordEncoder passwordEncoder;
    // JWT簽名密鑰（與資源服務(wù)器、JWT工具類一致，生產(chǎn)環(huán)境配置在配置中心）
    private static final String JWT_SECRET = "abc1234567890abc1234567890abc1234";
    // 配置令牌存儲(chǔ)（JWT），用于存儲(chǔ)和解析JWT令牌
    @Bean
    public TokenStore tokenStore() {
        return new JwtTokenStore(accessTokenConverter());
    }
    // 配置JWT令牌轉(zhuǎn)換器（設(shè)置簽名密鑰，確保令牌生成和驗(yàn)證的一致性）
    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        converter.setSigningKey(JWT_SECRET); // 與JWT工具類的密鑰完全一致
        return converter;
    }
    // 配置客戶端信息（客戶端在授權(quán)服務(wù)器注冊(cè)的核心信息，用于客戶端身份校驗(yàn)）
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                // 客戶端ID（唯一標(biāo)識(shí)，客戶端需攜帶此ID請(qǐng)求授權(quán)）
                .withClient(CLIENT_ID)
                // 客戶端密鑰（加密存儲(chǔ)，客戶端請(qǐng)求時(shí)需攜帶加密前的密鑰進(jìn)行校驗(yàn)）
                .secret(CLIENT_SECRET)
                // 授權(quán)范圍，用于限制客戶端可訪問(wèn)的資源范圍
                .scopes(SCOPE)
                // 支持的授權(quán)模式，此處兼容授權(quán)碼模式（SSO核心）、密碼模式（內(nèi)部系統(tǒng)）、刷新令牌模式
                .authorizedGrantTypes(GRANT_TYPE_AUTHORIZATION_CODE, GRANT_TYPE_PASSWORD, GRANT_TYPE_REFRESH_TOKEN)
                // 訪問(wèn)令牌有效期（1小時(shí)，避免令牌長(zhǎng)期有效帶來(lái)的安全風(fēng)險(xiǎn)）
                .accessTokenValiditySeconds(ACCESS_TOKEN_VALIDITY_SECONDS)
                // 刷新令牌有效期（7天，用戶無(wú)需頻繁登錄，提升體驗(yàn)）
                .refreshTokenValiditySeconds(REFRESH_TOKEN_VALIDITY_SECONDS)
                // 回調(diào)地址（授權(quán)碼模式必填，授權(quán)服務(wù)器頒發(fā)授權(quán)碼后，跳轉(zhuǎn)至此地址傳遞授權(quán)碼）
                .redirectUris("http://localhost:8081/callback");
    }
    // 配置授權(quán)服務(wù)器端點(diǎn)（核心組件關(guān)聯(lián)，確保認(rèn)證和令牌生成流程正常）
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints
                // 關(guān)聯(lián)認(rèn)證管理器（用于密碼模式，驗(yàn)證用戶賬號(hào)密碼合法性）
                .authenticationManager(authenticationManager)
                // 關(guān)聯(lián)令牌存儲(chǔ)（JWT），用于存儲(chǔ)和讀取令牌信息
                .tokenStore(tokenStore())
                // 關(guān)聯(lián)令牌轉(zhuǎn)換器（JWT），用于生成和解析JWT令牌
                .accessTokenConverter(accessTokenConverter());
    }
    // 配置授權(quán)服務(wù)器安全規(guī)則（控制授權(quán)服務(wù)器端點(diǎn)的訪問(wèn)權(quán)限）
    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        security
                // 允許所有客戶端訪問(wèn)token_key端點(diǎn)（獲取JWT簽名公鑰，用于資源服務(wù)器驗(yàn)證令牌）
                .tokenKeyAccess("permitAll()")
                // 允許所有客戶端訪問(wèn)check_token端點(diǎn)（驗(yàn)證令牌的合法性，資源服務(wù)器會(huì)調(diào)用此端點(diǎn)）
                .checkTokenAccess("permitAll()")
                // 允許客戶端通過(guò)表單認(rèn)證（用于客戶端身份校驗(yàn)，簡(jiǎn)化客戶端請(qǐng)求流程）
                .allowFormAuthenticationForClients();
    }
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Autowired
    private UserDetailsService userDetailsService;
    // 密碼加密器（與前文一致，BCrypt不可逆加密，確保密碼安全）
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    // 認(rèn)證提供者（關(guān)聯(lián)UserDetailsService和PasswordEncoder，用于加載用戶信息并校驗(yàn)密碼）
    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService);
        authProvider.setPasswordEncoder(passwordEncoder());
        return authProvider;
    }
    // 認(rèn)證管理器（核心認(rèn)證組件，授權(quán)服務(wù)器密碼模式需依賴此組件）
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }
    // 安全過(guò)濾器鏈配置（關(guān)閉Session，允許授權(quán)相關(guān)端點(diǎn)匿名訪問(wèn)）
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                // 關(guān)閉CSRF防護(hù)（授權(quán)服務(wù)器無(wú)狀態(tài)，無(wú)需CSRF）
                .csrf().disable()
                // 關(guān)閉Session（授權(quán)服務(wù)器無(wú)需存儲(chǔ)用戶會(huì)話，適配微服務(wù)無(wú)狀態(tài)架構(gòu)）
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                // 授權(quán)規(guī)則配置
                .authorizeRequests()
                // 授權(quán)服務(wù)器核心端點(diǎn)允許匿名訪問(wèn)（客戶端請(qǐng)求授權(quán)、獲取令牌需訪問(wèn)這些端點(diǎn)）
                .antMatchers("/oauth/authorize", "/oauth/token", "/oauth/check_token", "/oauth/token_key").permitAll()
                // 登錄接口、注冊(cè)接口允許匿名訪問(wèn)（用于用戶注冊(cè)和登錄驗(yàn)證）
                .antMatchers("/api/auth/login", "/api/auth/register").permitAll()
                // 其他所有請(qǐng)求需認(rèn)證（避免未授權(quán)訪問(wèn)）
                .anyRequest().authenticated();
        // 注冊(cè)認(rèn)證提供者
        http.authenticationProvider(authenticationProvider());
        return http.build();
    }
}

spring:
  # 數(shù)據(jù)庫(kù)配置（H2內(nèi)存數(shù)據(jù)庫(kù)，用于測(cè)試，生產(chǎn)環(huán)境替換為MySQL）
  datasource:
    url: jdbc:h2:mem:authdb
    driver-class-name: org.h2.Driver
    username: sa
    password: 123456
  # JPA配置（自動(dòng)創(chuàng)建表結(jié)構(gòu)，簡(jiǎn)化測(cè)試）
  jpa:
    hibernate:
      ddl-auto: update
    show-sql: true
    properties:
      hibernate:
        format_sql: true
  # H2控制臺(tái)配置（訪問(wèn)：http://localhost:8080/h2-console，用于插入測(cè)試用戶）
  h2:
    console:
      enabled: true
      path: /h2-console
# JWT配置（與資源服務(wù)器、令牌轉(zhuǎn)換器一致）
jwt:
  secret: abc1234567890abc1234567890abc1234 # 簽名密鑰，生產(chǎn)環(huán)境需修改并配置在配置中心
  expiration: 3600000 # 訪問(wèn)令牌有效期（1小時(shí)，與授權(quán)服務(wù)器配置一致）
# 服務(wù)器端口（授權(quán)服務(wù)器獨(dú)立部署，端口設(shè)為8080，避免與資源服務(wù)器沖突）
server:
  port: 8080

<!-- Spring Boot Web -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>
<!-- Spring Security -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<!-- OAuth2.0資源服務(wù)器依賴 -->
<dependency>
    <groupId>org.springframework.security.oauth</groupId>
    <artifactId>spring-security-oauth2</artifactId>
    <version>2.3.8.RELEASE</version>
</dependency>
<!-- JWT依賴（與授權(quán)服務(wù)器一致） -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.11.5</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>

import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
@Configuration
@EnableResourceServer // 啟用資源服務(wù)器
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    // 資源ID（唯一標(biāo)識(shí)，與授權(quán)服務(wù)器客戶端配置的資源范圍對(duì)應(yīng)）
    private static final String RESOURCE_ID = "all";
    // JWT簽名密鑰（與授權(quán)服務(wù)器完全一致，否則無(wú)法驗(yàn)證令牌）
    private static final String JWT_SECRET = "abc1234567890abc1234567890abc1234";
    // 配置令牌存儲(chǔ)（JWT），與授權(quán)服務(wù)器一致
    @Bean
    public TokenStore tokenStore() {
        return new JwtTokenStore(accessTokenConverter());
    }
    // 配置JWT令牌轉(zhuǎn)換器（設(shè)置簽名密鑰，用于驗(yàn)證令牌簽名）
    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        converter.setSigningKey(JWT_SECRET);
        return converter;
    }
    // 配置資源服務(wù)器核心信息（令牌存儲(chǔ)、資源ID）
    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources
                // 關(guān)聯(lián)資源ID（與授權(quán)服務(wù)器客戶端的scope對(duì)應(yīng)）
                .resourceId(RESOURCE_ID)
                // 關(guān)聯(lián)令牌存儲(chǔ)（用于驗(yàn)證令牌合法性）
                .tokenStore(tokenStore())
                // 令牌驗(yàn)證失敗時(shí)，返回401未授權(quán)響應(yīng)
                .stateless(true);
    }
    // 配置資源訪問(wèn)權(quán)限規(guī)則（根據(jù)用戶角色控制資源訪問(wèn)）
    @Override
    public void configure(org.springframework.security.config.annotation.web.builders.HttpSecurity http) throws Exception {
        http
                // 關(guān)閉CSRF防護(hù)（資源服務(wù)器無(wú)狀態(tài)，無(wú)需CSRF）
                .csrf().disable()
                // 關(guān)閉Session（適配微服務(wù)無(wú)狀態(tài)架構(gòu)）
                .sessionManagement().sessionCreationPolicy(org.springframework.security.config.http.SessionCreationPolicy.STATELESS).and()
                // 授權(quán)規(guī)則配置
                .authorizeRequests()
                // 公開(kāi)接口允許匿名訪問(wèn)（如健康檢查接口）
                .antMatchers("/health/**").permitAll()
                // 管理員接口僅允許ADMIN角色訪問(wèn)
                .antMatchers("/api/admin/**").hasRole("ADMIN")
                // 普通用戶接口允許USER或ADMIN角色訪問(wèn)
                .antMatchers("/api/user/**").hasAnyRole("USER", "ADMIN")
                // 其他所有資源需攜帶合法令牌才能訪問(wèn)
                .anyRequest().authenticated();
    }
}

# 服務(wù)器端口（資源服務(wù)器獨(dú)立部署，設(shè)為8081，與授權(quán)服務(wù)器8080區(qū)分）
server:
  port: 8081
# JWT配置（與授權(quán)服務(wù)器完全一致）
jwt:
  secret: abc1234567890abc1234567890abc1234
  expiration: 3600000
# OAuth2.0資源服務(wù)器配置
security:
  oauth2:
    resource:
      # 令牌驗(yàn)證端點(diǎn)（授權(quán)服務(wù)器的check_token端點(diǎn)，用于驗(yàn)證令牌合法性）
      token-info-uri: http://localhost:8080/oauth/check_token
      # 資源ID（與資源服務(wù)器配置的RESOURCE_ID一致）
      id: all

import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/api")
public class TestController {
    // 普通用戶接口（USER、ADMIN角色可訪問(wèn)）
    @GetMapping("/user/test")
    public String userTest() {
        // 獲取當(dāng)前登錄用戶信息
        UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        return "普通用戶接口訪問(wèn)成功！當(dāng)前登錄用戶：" + userDetails.getUsername() + "，角色：" + userDetails.getAuthorities();
    }
    // 管理員接口（僅ADMIN角色可訪問(wèn)）
    @GetMapping("/admin/test")
    public String adminTest() {
        UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        return "管理員接口訪問(wèn)成功！當(dāng)前登錄用戶：" + userDetails.getUsername() + "，角色：" + userDetails.getAuthorities();
    }
    // 回調(diào)接口（用于接收授權(quán)服務(wù)器頒發(fā)的授權(quán)碼，僅授權(quán)碼模式使用）
    @GetMapping("/callback")
    public String callback(String code) {
        // 此處可接收授權(quán)碼，后續(xù)可結(jié)合客戶端邏輯獲取access_token（實(shí)際場(chǎng)景中由客戶端處理）
        return "授權(quán)碼接收成功！code：" + code;
    }
}