@EnableRedisHttpSession(redisNamespace = "spring:session:myframe", maxInactiveIntervalInSeconds = 1700
        , flushMode = FlushMode.ON_SAVE)

/**
     * redis獲取sessionRepository
     * RedisIndexedSessionRepository實(shí)現(xiàn) FindByIndexNameSessionRepository接口
     */
    @Autowired
    //不加@Lazy這個(gè)會(huì)報(bào)什么循環(huán)引用...
    // Circular reference involving containing bean '.RedisHttpSessionConfiguration' 
    @Lazy   
    private FindByIndexNameSessionRepository<? extends Session> sessionRepository;

/**
     * 是spring session為Spring Security提供的,
     * 用于在集群環(huán)境下控制會(huì)話并發(fā)的會(huì)話注冊(cè)表實(shí)現(xiàn)
     * @return
     */
    @Bean
    public SpringSessionBackedSessionRegistry sessionRegistry(){
        return new SpringSessionBackedSessionRegistry<>(sessionRepository);
    }

public class CustomSessionInformationExpiredStrategy implements SessionInformationExpiredStrategy {

    @Override
    public void onExpiredSessionDetected(SessionInformationExpiredEvent event) throws IOException {
        if (log.isDebugEnabled()) {
           log.debug("{} {}", event.getSessionInformation(), MessageConstant.SESSION_EVICT);
        }
        HttpServletResponse response = event.getResponse();
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        response.setCharacterEncoding(StandardCharsets.UTF_8.toString());
        String responseJson = JackJsonUtil.object2String(ResponseFactory.fail(CodeMsgEnum.SESSION_EVICT, MessageConstant.SESSION_EVICT));
        response.getWriter().write(responseJson);
    }
}

.csrf().disable()
//登錄互踢
.sessionManagement()
//在這里設(shè)置session的認(rèn)證策略無(wú)效
//.sessionAuthenticationStrategy(new ConcurrentSessionControlAuthenticationStrategy(httpSessionConfig.sessionRegistry()))
.maximumSessions(1)
.sessionRegistry(sessionRegistry())
.maxSessionsPreventsLogin(false) //false表示不阻止登錄，就是新的覆蓋舊的
//session失效后要做什么（提示前端什么內(nèi)容）
.expiredSessionStrategy(new CustomSessionInformationExpiredStrategy()); 

public LoginFilter(UserVerifyAuthenticationProvider authenticationManager,
                       CustomAuthenticationSuccessHandler successHandler,
                       CustomAuthenticationFailureHandler failureHandler,
                       SpringSessionBackedSessionRegistry springSessionBackedSessionRegistry) {
        //設(shè)置認(rèn)證管理器(對(duì)登錄請(qǐng)求進(jìn)行認(rèn)證和授權(quán))
        this.authenticationManager = authenticationManager;
        //設(shè)置認(rèn)證成功后的處理類
        this.setAuthenticationSuccessHandler(successHandler);
        //設(shè)置認(rèn)證失敗后的處理類
        this.setAuthenticationFailureHandler(failureHandler);
        //配置session認(rèn)證策略（將springSecurity包裝redis Session作為參數(shù)傳入）
        ConcurrentSessionControlAuthenticationStrategy sessionStrategy = new
                ConcurrentSessionControlAuthenticationStrategy(springSessionBackedSessionRegistry);
        //最多允許一個(gè)session
        sessionStrategy.setMaximumSessions(1);
        this.setSessionAuthenticationStrategy(sessionStrategy);
        //可以自定義登錄請(qǐng)求的url
        super.setFilterProcessesUrl("/myLogin");
    }

@Configuration
@EnableWebSecurity
//RedisFlushMode有兩個(gè)參數(shù)：ON_SAVE（表示在response commit前刷新緩存），IMMEDIATE（表示只要有更新，就刷新緩存）
//yml和注解兩者只選其一(同時(shí)配置，只有注解配置生效)
@EnableRedisHttpSession(redisNamespace = "spring:session:myframe", maxInactiveIntervalInSeconds = 5000
        , flushMode = FlushMode.ON_SAVE)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserVerifyAuthenticationProvider authenticationManager;//認(rèn)證用戶類

    @Autowired
    private CustomAuthenticationSuccessHandler successHandler;//登錄認(rèn)證成功處理類

    @Autowired
    private CustomAuthenticationFailureHandler failureHandler;//登錄認(rèn)證失敗處理類

    @Autowired
    private MyFilterInvocationSecurityMetadataSource securityMetadataSource;//返回當(dāng)前URL允許訪問(wèn)的角色列表
    @Autowired
    private MyAccessDecisionManager accessDecisionManager;//除登錄登出外所有接口的權(quán)限校驗(yàn)


    /**
     * redis獲取sessionRepository
     * RedisIndexedSessionRepository實(shí)現(xiàn) FindByIndexNameSessionRepository接口
     */
    @Autowired
    //不加@Lazy這個(gè)會(huì)報(bào)什么循環(huán)引用...
    // Circular reference involving containing bean '.RedisHttpSessionConfiguration'
    @Lazy
    private FindByIndexNameSessionRepository<? extends Session> sessionRepository;


    /**
     * 是spring session為Spring Security提供的,
     * 用于在集群環(huán)境下控制會(huì)話并發(fā)的會(huì)話注冊(cè)表實(shí)現(xiàn)
     * @return
     */
    @Bean
    public SpringSessionBackedSessionRegistry sessionRegistry(){
        return new SpringSessionBackedSessionRegistry<>(sessionRepository);
    }

    /**
     * 密碼加密
     * @return
     */
    @Bean
    @ConditionalOnMissingBean(PasswordEncoder.class)
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    /**
     * 配置 HttpSessionIdResolver Bean
     * 登錄之后將會(huì)在 Response Header x-auth-token 中 返回當(dāng)前 sessionToken
     * 將token存儲(chǔ)在前端 每次調(diào)用的時(shí)候 Request Header x-auth-token 帶上 sessionToken
     */
    @Bean
    public HttpSessionIdResolver httpSessionIdResolver() {
        return HeaderHttpSessionIdResolver.xAuthToken();
    }
    /**
     * Swagger等靜態(tài)資源不進(jìn)行攔截
     */
    @Override
    public void configure(WebSecurity web) {
        web.ignoring().antMatchers(
                "/*.html",
                "/favicon.ico",
                "/**/*.html",
                "/**/*.css",
                "/**/*.js",
                "/error",
                "/webjars/**",
                "/resources/**",
                "/swagger-ui.html",
                "/swagger-resources/**",
                "/v2/api-docs");
    }
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                //配置一些不需要登錄就可以訪問(wèn)的接口,這里配置失效了，放到了securityMetadataSource里面
                //.antMatchers("/demo/**", "/about/**").permitAll()
                //任何尚未匹配的URL只需要用戶進(jìn)行身份驗(yàn)證
                .anyRequest().authenticated()
                //登錄后的接口權(quán)限校驗(yàn)
                .withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() {
                    @Override
                    public <O extends FilterSecurityInterceptor> O postProcess(O object) {
                        object.setAccessDecisionManager(accessDecisionManager);
                        object.setSecurityMetadataSource(securityMetadataSource);
                        return object;
                    }
                })
                .and()
                //配置登出處理
                .logout().logoutUrl("/logout")
                .logoutSuccessHandler(new CustomLogoutSuccessHandler())
                .clearAuthentication(true)
                .and()
                //用來(lái)解決匿名用戶訪問(wèn)無(wú)權(quán)限資源時(shí)的異常
                .exceptionHandling().authenticationEntryPoint(new CustomAuthenticationEntryPoint())
                //用來(lái)解決登陸認(rèn)證過(guò)的用戶訪問(wèn)無(wú)權(quán)限資源時(shí)的異常
                .accessDeniedHandler(new CustomAccessDeniedHandler())
                .and()
                //配置登錄過(guò)濾器
                .addFilter(new LoginFilter(authenticationManager, successHandler, failureHandler, sessionRegistry()))

                .csrf().disable()
                //登錄互踢
                .sessionManagement()
                //在這里設(shè)置session的認(rèn)證策略無(wú)效
                //.sessionAuthenticationStrategy(new ConcurrentSessionControlAuthenticationStrategy(httpSessionConfig.sessionRegistry()))
                .maximumSessions(1)
                .sessionRegistry(sessionRegistry())
                .maxSessionsPreventsLogin(false) //false表示不阻止登錄，就是新的覆蓋舊的
                //session失效后要做什么（提示前端什么內(nèi)容）
                .expiredSessionStrategy(new CustomSessionInformationExpiredStrategy());
        //配置頭部
        http.headers()
                .contentTypeOptions()
                .and()
                .xssProtection()
                .and()
                //禁用緩存
                .cacheControl()
                .and()
                .httpStrictTransportSecurity()
                .and()
                //禁用頁(yè)面鑲嵌frame劫持安全協(xié)議  // 防止iframe 造成跨域
                .frameOptions().disable();
    }

}

@Lazy
private FindByIndexNameSessionRepository<? extends Session> sessionRepository;