protected void configure(HttpSecurity http) throws Exception {
     this.logger.debug("Using default configure(HttpSecurity). If subclassed this will potentially override subclass configure(HttpSecurity).");
     ((HttpSecurity)((HttpSecurity)((AuthorizedUrl)http.
	     authorizeRequests()
	     .anyRequest())
	     .authenticated()
	     .and())
	     .formLogin()
	     .and())
	     .httpBasic();
 }

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.formLogin()
            .loginPage("/login.html") //登錄頁(yè)面
            .loginProcessingUrl("/user/login") // 默認(rèn)處理登錄的請(qǐng)求
            .successForwardUrl("/success")  //登錄成功后跳轉(zhuǎn)到哪個(gè)URL
            .defaultSuccessUrl("/index",true)// 登錄成功后跳轉(zhuǎn)路徑
            .failureForwardUrl("/fail") //登錄失敗后跳轉(zhuǎn)到哪個(gè)URL
            .permitAll();

}

.usernameParameter("userName")  //自定義獲取用戶登錄名
.passwordParameter("password")  //自定義獲取用戶登錄密碼

 http.authorizeRequests()
               .antMatchers("/static/**","/images/**","/css/**","/js/**")//可以直接放行
               .permitAll()//匹配上述請(qǐng)求的直接放行
               .anyRequest().authenticated();//其他請(qǐng)求都需要認(rèn)證

http.authorizeRequests()
     .antMatchers("/static/**","/images/**","/css/**","/js/**")//可以直接放行
     .permitAll()
     .antMatchers("/findAll").hasAuthority("admin") // 用戶訪問(wèn)findAll 必須有 admin 權(quán)限
     .anyRequest().authenticated();//其他請(qǐng)求都需要認(rèn)證

http.authorizeRequests()
    .antMatchers("/static/**","/images/**","/css/**","/js/**")//可以直接放行
    .permitAll()
    .antMatchers("/findAll").hasAuthority("admin") // 用戶訪問(wèn)findAll 必須有 admin 權(quán)限
    .antMatchers("/find").hasAnyAuthority("admin","sale") // 用戶訪問(wèn) find ,擁有admin或者sale之一即可
    .anyRequest().authenticated();//其他請(qǐng)求都需要認(rèn)證

http.authorizeRequests()
     .antMatchers("/static/**","/images/**","/css/**","/js/**")//可以直接放行
     .permitAll()
     .antMatchers("/findAll").hasAuthority("admin") // 用戶訪問(wèn)findAll 必須有 admin 權(quán)限
     .antMatchers("/find").hasAnyAuthority("admin","sale") // 用戶訪問(wèn) find ,擁有admin或者sale之一即可
     .antMatchers("/sale/**").hasRole("sale") // 需要用戶具有sale角色
     .anyRequest().authenticated();//其他請(qǐng)求都需要認(rèn)證

http.authorizeRequests()
     .antMatchers("/static/**","/images/**","/css/**","/js/**")//可以直接放行
     .permitAll()
     .antMatchers("/findAll").hasAuthority("admin") // 用戶訪問(wèn)findAll 必須有 admin 權(quán)限
     .antMatchers("/find").hasAnyAuthority("admin","sale") // 用戶訪問(wèn) find ,擁有admin或者sale之一即可
     .antMatchers("/sale/**").hasRole("sale") // 需要用戶具有sale角色
     .antMatchers("/product/**").hasAnyRole("admin","product") //用戶具有admin或者product角色之一即可
     .anyRequest().authenticated();//其他請(qǐng)求都需要認(rèn)證

 http.exceptionHandling().accessDeniedPage("/unauth.html");

http.logout().logoutUrl("/logout")  //退出登錄請(qǐng)求
			.logoutSuccessUrl("/index") //注銷成功后跳轉(zhuǎn)地址
			.permitAll();

.deleteCookies("remember-me","sign")
.invalidateHttpSession(true)

@SpringBootApplication
@MapperScan("com.jane.mapper")
@EnableGlobalMethodSecurity(securedEnabled=true,prePostEnabled = true)
public class Securitydemo1Application {
    public static void main(String[] args) {
        SpringApplication.run(Securitydemo1Application.class, args);
    }
}

// 測(cè)試注解： 
@RequestMapping("testSecured") 
@ResponseBody 
@Secured({"ROLE_normal","ROLE_admin"}) 
public String helloUser() { 
	return "hello,user"; 
}

@RequestMapping("/preAuthorize") 
@ResponseBody 
//@PreAuthorize("hasRole('ROLE_admin')") 
@PreAuthorize("hasAnyAuthority('menu:system')") 
public String preAuthorize(){ 
	System.out.println("preAuthorize"); 
	return "preAuthorize"; 
}

@RequestMapping("/testPostAuthorize") 
@ResponseBody 
@PostAuthorize("hasAnyAuthority('menu:system')") 
public String preAuthorize(){ 
	System.out.println("test--PostAuthorize"); 
	return "PostAuthorize"; 
}

@RequestMapping("getAll") 
@PreAuthorize("hasRole('ROLE_admin')") 
@PostFilter("filterObject.username == 'admin1'") 
@ResponseBody public List<UserInfo> getAllUser(){ 
	ArrayList<UserInfo> list = new ArrayList<>(); 
	list.add(new UserInfo(1l,"admin1","6666")); 
	list.add(new UserInfo(2l,"admin2","888")); 
	return list; 
}

@RequestMapping("getTestPreFilter") 
@PreAuthorize("hasRole('ROLE_admin')") 
@PreFilter(value = "filterObject.id%2==0") 
@ResponseBody public List<UserInfo> getTestPreFilter(@RequestBody List<UserInfo> list){ 
	list.forEach(t-> { System.out.println(t.getId()+"\t"+t.getUsername()); }); 
	return list; 
}