@EnableWebFluxSecurity
public class WebSecurityConfig {
    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        RedirectServerAuthenticationEntryPoint loginPoint = new RedirectServerAuthenticationEntryPoint("/xinyue-server-a/account/index");
        http.authorizeExchange().pathMatchers("/xinyue-server-a/easyui/**","/xinyue-server-a/js/**","/xinyue-server-a/account/index","/xinyue-server-a/account/login").permitAll()    
        .and().formLogin().loginPage("/xinyue-server-a/account/authen").authenticationEntryPoint(loginPoint)
        .and().authorizeExchange().anyExchange().authenticated()
        .and().csrf().disable();
        SecurityWebFilterChain chain = http.build();
        return chain;
    }
}

 http.authorizeExchange().pathMatchers("/xinyue-server-a/easyui/**","/xinyue-server-a/js/**","/xinyue-server-a/account/index","/xinyue-server-a/account/login").permitAll()    

.and().formLogin().loginPage("/xinyue-server-a/account/authen").authenticationEntryPoint(loginPoint)

 .and().authorizeExchange().anyExchange().authenticated()

<script type="text/javascript">
	function postAjax(url, json, success) {
		$.ajax({
			type : "POST",
			url : url,
			data : JSON.stringify(json),
			dataType : "json",
			contentType : "application/json",
			success : function(data) {
				if (data.code == 0) {
					success(data);
				} else {
					alert("服務(wù)器異常,請聯(lián)系開發(fā)者");
				}
			},
			error : function(data) {
				alert(url + "請求錯(cuò)誤：" + JSON.stringify(data));
			}
		});
	}
	function submitForm() {
		$("#errorTips").html("");
		var username = $("#username").val();
		var password = $("#password").val();
		var url = "/xinyue-server-a/account/login";
		var json = {
			"username" : username,
			"password" : password
		};
		postAjax(
				url,
				json,
				function(data) {
					if (data.code == 0) { //如果登陸成功，發(fā)送認(rèn)證請求
						var authUrl = "/xinyue-server-a/account/authen";
						var param = {};
						postAjax(
								authUrl,
								param,
								function(data) {
									if (data.code == 0) {//認(rèn)證成功之后，跳轉(zhuǎn)請求
										window.location.href = "/xinyue-server-a/account/main";
									} else {
										$("#errorTips").html(data.msg);
									}
								});
					} else {
						$("#errorTips").html(data.msg);
					}
				});
	}
</script>

    @RequestMapping("login")
    @ResponseBody
    public Object login(HttpServletResponse response) {
        JSONObject userInfo = new JSONObject();
        userInfo.put("username", "xinyues");
        List<String> roles = new ArrayList<>();
        roles.add("Admin");
        roles.add("Dev");
        userInfo.put("roles", roles);//添加角色信息
        response.addHeader("AccountInfo", userInfo.toJSONString());//將信息放入響應(yīng)的包頭
        JSONObject result = new JSONObject();
        result.put("code", 0);
        return result;
    }

@Service
public class AuthenticationGatewayFilterFactory extends AbstractGatewayFilterFactory<Object> {
    private Logger logger = LoggerFactory.getLogger(AuthenticationGatewayFilterFactory.class);
    @Override
    public GatewayFilter apply(Object config) {
        return (exchange, chain) -> chain.filter(exchange).then(Mono.fromRunnable(() -> {
                List<String> gmAccountInfoJsons = exchange.getResponse().getHeaders().get("AccountInfo");
                exchange.getResponse().getHeaders().remove("AccountInfo");//移除包頭中的用戶信息不需要返回給客戶端
                if(gmAccountInfoJsons != null && gmAccountInfoJsons.size() > 0) {
                    String gmAccountInfoJson = gmAccountInfoJsons.get(0);//獲取header中的用戶信息
                    //將信息放在session中，在后面認(rèn)證的請求中使用
                    exchange.getSession().block().getAttributes().put("AccountInfo", gmAccountInfoJson);
                }
                logger.debug("登陸返回信息:{}",gmAccountInfoJsons);
        }));
    }
}

public class XinyueAuthenticationConverter extends ServerFormLoginAuthenticationConverter{
    @Override
    public Mono<Authentication> convert(ServerWebExchange exchange) {
       //從session中獲取登陸用戶信息
       String value = exchange.getSession().block().getAttribute("AccountInfo");
       if(value == null) {
           return Mono.empty();
       } else {
           List<SimpleGrantedAuthority> simpleGrantedAuthorities = new ArrayList<>();
           //獲取權(quán)限信息
           List<String> roels = JSON.parseObject(value).getJSONArray("roles").toJavaList(String.class);
               roels.forEach(role->{
                  //這里必須添加前綴，參考：AuthorityReactiveAuthorizationManager.hasRole(role)
                   SimpleGrantedAuthority auth = new SimpleGrantedAuthority("ROLE_" + role);
                   simpleGrantedAuthorities.add(auth);
               });
            //添加用戶信息到spring security之中。
           XinyueAccountAuthentication  xinyueAccountAuthentication = new XinyueAccountAuthentication(null, value, simpleGrantedAuthorities);
           return Mono.just(xinyueAccountAuthentication);
       }
    }
}

        SecurityWebFilterChain chain = http.build();
        Iterator<WebFilter>  weIterable = chain.getWebFilters().toIterable().iterator();
        while(weIterable.hasNext()) {
            WebFilter f = weIterable.next();
            if(f instanceof AuthenticationWebFilter) {
              AuthenticationWebFilter webFilter = (AuthenticationWebFilter) f;
              //將自定義的AuthenticationConverter添加到過濾器中
              webFilter.setServerAuthenticationConverter(new XinyueAuthenticationConverter());      
            }
        }

    @Bean
    public ReactiveAuthenticationManager reactiveAuthenticationManager() {
        return new ReactiveAuthenticationManagerAdapter((authentication)->{
            if(authentication instanceof XinyueAccountAuthentication) {
                XinyueAccountAuthentication gmAccountAuthentication = (XinyueAccountAuthentication) authentication;
                if(gmAccountAuthentication.getPrincipal() != null) {
                    authentication.setAuthenticated(true);
                    return authentication;
                } else {
                    return authentication;
                }
            } else {
                return authentication;
            }
        });
    }

.and().authorizeExchange().pathMatchers("/xinyue-server-a/account/main").hasRole("Manager")

.and().authorizeExchange().pathMatchers("/xinyue-server-a/account/main").hasRole("Dev")

.and().authorizeExchange().pathMatchers("/xinyue-server-a/account/main").access(new XinyueReactiveAuthorizationManager("Manager", "Dev"))

    @Override
    public Mono<AuthorizationDecision> check(Mono<Authentication> authentication, AuthorizationContext object) {
        return authentication
                .filter(a -> a.isAuthenticated())
                .flatMapIterable( a -> a.getAuthorities())
                .map( g-> g.getAuthority())
                .any(c->{
                    //檢測權(quán)限是否匹配
                    String[] roles = c.split(",");
                    for(String role:roles) {
                        if(authorities.contains(role)) {
                            return true;
                        }
                    }
                    return false;
                })
                .map( hasAuthority -> new AuthorizationDecision(hasAuthority))
                .defaultIfEmpty(new AuthorizationDecision(false));
    }