@Component
public class MyWebConfig implements WebMvcConfigurer {
  private final UserTokenInterceptor userTokenInterceptor;
  private final SecurityInterceptor securityInterceptor;
  public MyWebConfig(
      UserTokenInterceptor userTokenInterceptor, SecurityInterceptor securityInterceptor) {
    this.userTokenInterceptor = userTokenInterceptor;
    this.securityInterceptor = securityInterceptor;
  }
  @Override
  public void addInterceptors(InterceptorRegistry registry) {
    // 定義排除swagger訪問的路徑配置
    String[] swaggerExcludes =
        new String[] {"/swagger-ui.html", "/swagger-resources/**", "/webjars/**"};
    registry
        .addInterceptor(userTokenInterceptor)
        .addPathPatterns("/**")
        .excludePathPatterns(
            "/user/login", "/static/**", "/*.html", "/*.ico", "/*.json", "/*.png", "/heartbeat/**")
        .excludePathPatterns(swaggerExcludes);
    registry
        .addInterceptor(securityInterceptor)
        .addPathPatterns("/maintain/**", "/user/**")
        .excludePathPatterns("/user/login");
  }
}

2.UserTokenInterceptor ，securityInterceptor分別處理不同的請求攔截，執(zhí)行不同的攔截邏輯。

2個(gè)處理的類請求上可以有交集，2個(gè)處理類都執(zhí)行。

@Component
public class UserTokenInterceptor implements HandlerInterceptor {
  private final EmpInfoService empInfoService;
  public UserTokenInterceptor(EmpInfoService empInfoService) {
    this.empInfoService = empInfoService;
  }
  @Override
  public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
      throws Exception {
    // 校驗(yàn)handler是否是HandlerMethod
    if (!(handler instanceof HandlerMethod)) {
      return true;
    }
    // 從請求頭中獲取token
    String token = request.getHeader("Authorization");
    /**
     * update:2021/11/30 ShengJieLi
     * 增加邏輯：Authorization的值不為本系統(tǒng)生成的token時(shí)，解密Authorization，獲取token并驗(yàn)證
     */
    if (StrUtil.isNotEmpty(token)) {
      EmpInfo securityEmployee = empInfoService.queryToken(token);
      if(securityEmployee != null){
        // token有效
        String ref = empInfoService.isRef(token);
        if (StrUtil.isNotBlank(ref)) {
          response.setHeader("Access-Control-Expose-Headers", "token");
          response.addHeader("token", ref);
        }
      }else{
        //Authorization為PBE加密數(shù)據(jù)
        securityEmployee = empInfoService.analyticQueryToken(token,response);
      }
      if (securityEmployee != null) {
        // token有效
        // 將User對象放入到ThreadLocal中
        UserLocal.set(securityEmployee);
        return true;
      }
      return false;
    }
//    String s = JSONUtil.toJsonStr(ResponseResult.error(ErrorCode.TOKEN_ERROR));
//    response.setContentType("text/html;charset=UTF-8");
//    JSONUtil.toJsonStr(s, response.getWriter());
//    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
    InterceptorExceptionResolver.interceptorError(response,ErrorCode.TOKEN_ERROR);
    //update 結(jié)束
    return false;
  }
  @Override
  public void afterCompletion(
      HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
      throws Exception {
    // 響應(yīng)結(jié)束后刪除對象
    UserLocal.remove();
  }
}

@SecurityGrade({"SUPER_ADMIN", "SYSTEM_ADMIN"})
public class SecurityController {
  private final EmpInfoService empInfoService;
  public SecurityController(EmpInfoService empInfoService) {
    this.empInfoService = empInfoService;
  }
  @GetMapping("getUserInformation")
  @ApiOperation("登陸用戶信息")
  @NoAuthorization
  public ResponseResult getUserInformation(@ApiIgnore HttpServletResponse response) {
    return empInfoService.getUserInformation(response);
  }
}

3.關(guān)于注解的使用

@SecurityGrade({"SUPER_ADMIN", "SYSTEM_ADMIN"})
public class SecurityController {
  private final EmpInfoService empInfoService;
  public SecurityController(EmpInfoService empInfoService) {
    this.empInfoService = empInfoService;
  }
  @GetMapping("getUserInformation")
  @ApiOperation("登陸用戶信息")
  @NoAuthorization
  public ResponseResult getUserInformation(@ApiIgnore HttpServletResponse response) {
    return empInfoService.getUserInformation(response);
  }
}

method.getMethodAnnotation(SecurityGrade.class) 獲得注解信息，methodAnnotation.value()獲得注解內(nèi)容"SUPER_ADMIN", "SYSTEM_ADMIN"。