<!-- Spring Security啟動(dòng)器 -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<!-- Web依賴 -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
/**
 * Spring Security核心配置類
 */
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private UserService userService;
    /**
     * 配置靜態(tài)資源匿名放行
     */
    @Override
    public void configure(WebSecurity web) throws Exception {
        // 放行登錄頁(yè)、靜態(tài)資源、驗(yàn)證碼接口
        web.ignoring().antMatchers("/login.html", "/pages/**", "/validateCode/send4Login.do");
    }
    /**
     * 配置認(rèn)證來源（關(guān)聯(lián)自定義UserService）
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
    }
    /**
     * 配置HTTP請(qǐng)求安全（登錄、授權(quán)、退出）
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 自定義表單登錄
        http.formLogin()
                .loginPage("/login.html") // 自定義登錄頁(yè)
                .loginProcessingUrl("/login") // 登錄請(qǐng)求接口
                .usernameParameter("username") // 用戶名參數(shù)
                .passwordParameter("password") // 密碼參數(shù)
                .defaultSuccessUrl("/index.html"); // 登錄成功跳轉(zhuǎn)頁(yè)
        // 權(quán)限配置
        http.authorizeRequests()
                .antMatchers("/pages/b.html").hasAuthority("add") // 需add權(quán)限
                .antMatchers("/pages/c.html").hasRole("ADMIN") // 需ADMIN角色
                .anyRequest().authenticated(); // 其余資源需登錄
        // 退出登錄配置
        http.logout()
                .logoutUrl("/logout") // 退出接口
                .logoutSuccessUrl("/login.html"); // 退出成功跳轉(zhuǎn)頁(yè)
        // 關(guān)閉CSRF防護(hù)（前后端分離可關(guān)閉）
        http.csrf().disable();
    }
    /**
     * 密碼加密器（BCrypt加密）
     */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Component;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.Map;

@Component
public class UserService implements UserDetailsService {

    // 模擬數(shù)據(jù)庫(kù)用戶數(shù)據(jù)
    private static Map<String, UserInfo> userMap = new HashMap<>();

    @Autowired
    private BCryptPasswordEncoder passwordEncoder;

    // 初始化加密用戶數(shù)據(jù)
    static {
        userMap.put("admin", new UserInfo("admin", new BCryptPasswordEncoder().encode("admin")));
        userMap.put("user", new UserInfo("user", new BCryptPasswordEncoder().encode("123456")));
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 從數(shù)據(jù)庫(kù)查詢用戶
        UserInfo userInfo = userMap.get(username);
        if (userInfo == null) {
            throw new UsernameNotFoundException("用戶名不存在");
        }

        // 封裝權(quán)限/角色
        ArrayList<GrantedAuthority> authorities = new ArrayList<>();
        if ("admin".equals(username)) {
            authorities.add(new SimpleGrantedAuthority("add"));
            authorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
        }

        // 返回Spring Security規(guī)范用戶對(duì)象
        return new User(userInfo.getUsername(), userInfo.getPassword(), authorities);
    }
}

// 用戶實(shí)體類
class UserInfo {
    private String username;
    private String password;

    public UserInfo(String username, String password) {
        this.username = username;
        this.password = password;
    }

    // getter/setter
}

http.authorizeRequests()
        .antMatchers("/pages/b.html").hasAuthority("add") // 需add權(quán)限
        .antMatchers("/pages/c.html").hasRole("ADMIN") // 需ADMIN角色
        .anyRequest().authenticated();

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true) // 開啟權(quán)限注解
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
}

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/permission")
public class PermissionController {

    // 需add權(quán)限才可訪問
    @RequestMapping("/add")
    @PreAuthorize("hasAuthority('add')")
    public String add() {
        return "新增權(quán)限驗(yàn)證通過";
    }

    // 需ADMIN角色才可訪問
    @RequestMapping("/delete")
    @PreAuthorize("hasRole('ADMIN')")
    public String delete() {
        return "刪除權(quán)限驗(yàn)證通過";
    }
}

http.logout()
        .logoutUrl("/logout") // 退出請(qǐng)求路徑
        .logoutSuccessUrl("/login.html"); // 退出成功跳轉(zhuǎn)頁(yè)