<dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

@Data
@AllArgsConstructor
@NoArgsConstructor
public class LoginUser implements UserDetails, Serializable {
    private User user;
    //返回權(quán)限信息
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return null;
    }
    //返回用戶密碼
    @Override
    public String getPassword() {
        return user.getPassword();
    }
       //返回用戶賬號
    @Override
    public String getUsername() {
        return user.getLoginname();
    }
    @Override
    public boolean isAccountNonExpired() {
        return true;
    }
    @Override
    public boolean isAccountNonLocked() {
        return true;
    }
    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }
    @Override
    public boolean isEnabled() {
        return true;
    }
}

@Service
public class UserDetailServiceImpl implements UserDetailsService {
    @Autowired
    TbUserMapper tbUserMapper;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //根據(jù)用戶名從數(shù)據(jù)庫中查詢數(shù)據(jù)信息
        QueryWrapper<TbUser> queryWrapper=new QueryWrapper<>();
        queryWrapper.eq("username",username);
        TbUser tbUser = tbUserMapper.selectOne(queryWrapper);
        //查詢不到該用戶信息拋異常
        if(tbUser==null){
            throw new RuntimeException("用戶名或者密碼錯誤");
        }
       //封裝成UserDetails返回
        return new MyUser(tbUser);
    }
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }
}

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Bean
    PasswordEncoder password(){
        return new BCryptPasswordEncoder();
    }
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()//關(guān)閉csrf
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) //不通過session獲取SecurityContext
                .and()
                .authorizeRequests()
                .antMatchers("/user/login").anonymous() //對于登錄接口允許匿名訪問
                .anyRequest().authenticated(); //除上面外的所有請求全部需要鑒權(quán)認證
UsernamePasswordAuthenticationFilter.class);
    }
}

 
    @Autowired
    RedisTemplate redisTemplate;
    @Autowired
    AuthenticationManager authenticationManager;
   @PostMapping("/user/login")
    public Result login(@RequestBody TbUser tbUser){
        //通過AuthenticationManager的authenticate方法來進行用戶認證
        UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken=new UsernamePasswordAuthenticationToken(tbUser.getUsername(),tbUser.getPassword());
        Authentication authenticate = authenticationManager.authenticate(usernamePasswordAuthenticationToken);
        if(authenticate==null){
            return Result.error("401","登錄校驗失敗");
        }
        else {
            //獲取用戶信息
            MyUser myUser = (MyUser) authenticate.getPrincipal();
            //獲取用戶id
            Long id = myUser.getTbUser().getId();
            //根據(jù)用戶id生成token
            String token = JwtUtil.generateToken(id);
            //將token放在數(shù)據(jù)庫中
            redisTemplate.opsForValue().set(String.valueOf(id),myUser,30, TimeUnit.MINUTES);
            return Result.success(token);
        }
    }

@Component
public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
    @Autowired
    RedisTemplate redisTemplate;
    @Override
    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
        //獲取請求頭中的token
        String token = httpServletRequest.getHeader("token");
        //如果token為空直接放行，由于用戶信息沒有存放在SecurityContextHolder.getContext()中所以后面的過濾器依舊認證失敗符合要求
        if(!StringUtils.hasText(token)){
            filterChain.doFilter(httpServletRequest,httpServletResponse);
            return;
        }
        Long userId;
        try {
            //通過jwt工具類解析token獲得userId,如果token過期或非法就會拋異常
            DecodedJWT decodedJWT = JwtUtil.decodeToken(token);
            userId = decodedJWT.getClaim("userId").asLong();
        }catch (Exception e){
            e.printStackTrace();
            throw new RuntimeException("token非法");
        }
        //根據(jù)userId從redis中獲取用戶信息，如果沒有該用戶就代表該用戶沒有登錄過
        MyUser myUser = (MyUser) redisTemplate.opsForValue().get(String.valueOf(userId));
        if(Objects.isNull(myUser)){
            throw new RuntimeException("用戶未登錄");
        }
        //將用戶信息存放在SecurityContextHolder.getContext()，后面的過濾器就可以獲得用戶信息了。
        UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken=new UsernamePasswordAuthenticationToken(myUser,null,null);
        SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
        filterChain.doFilter(httpServletRequest,httpServletResponse);
    }
}

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Autowired
    private JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter;
 //自定義過濾器放在UsernamePasswordAuthenticationFilter過濾器之前
            http.addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
    }
}