注解+拦截器实现权限控制

@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
public @interface NoNeedLogin {
}

@Component
public class AuthenticationInterceptor extends HandlerInterceptorAdapter {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        boolean isHandlerMethod = handler instanceof HandlerMethod;
        if (!isHandlerMethod) {
            return true;
        }
        boolean isNoNeedLogin = ((HandlerMethod) handler).getMethodAnnotation(NoNeedLogin.class)!=null;
        if (isNoNeedLogin) {
            return true;
        }
        return false;
    }
}

@Configuration
public class WebAppConfig implements WebMvcConfigurer {

    @Autowired
    private AuthenticationInterceptor authenticationInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(authenticationInterceptor);
    }
}

    @ResponseBody
    @GetMapping("needLogin")
    public String needLogin() {
        return "needLogin";
    }

    @NoNeedLogin
    @ResponseBody
    @GetMapping("noNeedLogin")
    public String noNeedLogin() {
        return "noNeedLogin";
    }