Java一分钟之-Spring Security：身份验证与授权

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    // ...
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication()
        .withUser("user").password("{noop}password").roles("USER");
}

@Bean
public AuthenticationFailureHandler customFailureHandler() {
    return (request, response, exception) -> {
        // 登录失败处理逻辑
    };
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
        .antMatchers("/admin/**").hasRole("ADMIN")
        .antMatchers("/user/**").hasRole("USER")
        .anyRequest().authenticated()
        .and()
        // ...
}

@Bean
public AccessDecisionManager accessDecisionManager() {
    return new AccessDecisionManager() {...};
}

public class JwtTokenFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {
        // 解析、验证JWT并设置SecurityContextHolder
    }
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.addFilterBefore(jwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);
    // ...
}

@Bean
public AuthenticationEntryPoint authenticationEntryPoint() {
    return (request, response, authException) -> {
        // 自定义未授权处理逻辑
    };
}

@Bean
public AccessDeniedHandler accessDeniedHandler() {
    return (request, response, accessDeniedException) -> {
        // 自定义权限不足处理逻辑
    };
}

http.exceptionHandling()
    .authenticationEntryPoint(authenticationEntryPoint())
    .accessDeniedHandler(accessDeniedHandler());