/**
 * 創(chuàng)建驗證碼生成器
 */
@Component
public class SmsCodeGenerator {
    public String generate() {
        return RandomStringUtils.randomNumeric(4);
    }
}
/**
 * 驗證碼發(fā)送器
 */
@Component
public class SmsCodeSender {
    public void send(String mobile, String code) {
        System.out.println("向手機" + mobile + "發(fā)送短信驗證碼" + code);
    }
}
/**
 * 發(fā)送短信接口
 */
@RestController
public class ValidateCodeController {
    @Autowired
    private SmsCodeGenerator smsCodeGenerator;
    @Resource
    private SmsCodeSender smsCodeSender;
    @Resource
    private RedisTemplate redisTemplate;
    @GetMapping("/code/sms")
    public String createSmsCode(@RequestParam String mobile) throws IOException {
        //獲取驗證碼
        String smsCode = smsCodeGenerator.generate();
        //把驗證碼設置到redis
        redisTemplate.boundValueOps(SecurityConstants.getValidCodeKey(mobile)).set(smsCode, 300, TimeUnit.SECONDS);
        smsCodeSender.send("18360903475", "登錄驗證碼為：" + smsCode + ",五分鐘過期");
        return "驗證碼是 : " + smsCode;
    }
}

import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.SpringSecurityCoreVersion;
import java.util.Collection;
/**
 * 手機號碼認證 Token
 */
public class PhoneNumAuthenticationToken extends AbstractAuthenticationToken {
    private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
    /**
     * principal的作用有兩個, 在未登錄之前是用戶名，那么在登錄之后是用戶的信息。
     */
    private final Object principal;
    /**
     * 構造
     * @param principal 手機號碼
     */
    public PhoneNumAuthenticationToken(Object principal) {
        super(null);
        this.principal = principal;
        // 用于指示AbstractSecurityInterceptor是否應向AuthenticationManager提供身份驗證令牌
        setAuthenticated(false);
    }
    /**
     * 構造
     * @param principal 用戶信息
     * @param authorities 用戶權限列表
     */
    public PhoneNumAuthenticationToken(Object principal,Collection<? extends GrantedAuthority> authorities) {
        super(authorities);
        this.principal = principal;
        // 用于指示AbstractSecurityInterceptor是否應向AuthenticationManager提供身份驗證令牌
        setAuthenticated(true);
    }
    /**
     * 正常這個是返回密碼,但手機登錄沒有密碼,不用管
     */
    @Override
    public Object getCredentials() {
        return null;
    }
    /**
     * 獲取手機號或用戶信息
     */
    @Override
    public Object getPrincipal() {
        return this.principal;
    }
}

/**
 * 手機號碼攔截器, 獲取手機號碼
 */
public class PhoneNumAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
    public PhoneNumAuthenticationFilter() {
        super(new AntPathRequestMatcher("/phoneLogin", "POST"));
    }
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        if (!Objects.equals(request.getMethod(),"POST")) {
            throw new AuthenticationServiceException("身份驗證方法需為:'POST'請求");
        }
        // 獲取手機號
        String phoneNum = Optional.ofNullable(request.getParameter(Constants.PHONE_NUM_PARAMETER)).map(String::trim).orElse("");
        // new 手機號碼驗證Token
        PhoneNumAuthenticationToken authRequest = new PhoneNumAuthenticationToken(phoneNum);
        // 身份驗證詳細信息
        authRequest.setDetails(super.authenticationDetailsSource.buildDetails(request));
        return this.getAuthenticationManager().authenticate(authRequest);
    }
}

/**
 * 短信驗證碼驗證過濾器
 */
@Component
public class SmsCodeFilter extends OncePerRequestFilter {
    @Resource
    private StringRedisTemplate stringRedisTemplate;
    @Resource
    private CustomizeAuthencationFailureHandler customizeAuthencationFailureHandler;
    @Override
    protected void doFilterInternal(HttpServletRequest request,HttpServletResponse response,FilterChain filterChain) throws ServletException, IOException {
        /**
         * uri = /phoneLogin 即手機號碼登錄才攔截
         */
        if (Objects.equals(Constants.SMS_LOGIN_URI,request.getRequestURI())) {
            try{
                // 驗證手機驗證碼
                validateProcess(request);
            }catch (AuthenticationException ex) {
                customizeAuthencationFailureHandler.onAuthenticationFailure(request, response, ex);
                return;
            }
        }
        filterChain.doFilter(request, response);
    }
    /**
     * 驗證手機驗證碼
     */
    private void validateProcess(HttpServletRequest request){
        // 獲取手機號
        String msgCode = stringRedisTemplate.opsForValue().get(Constants.SMS_CODE_SESSION_KEY);
        String code = request.getParameter(Constants.MSG_CODE);
        if(Strings.isBlank(code)) {
            throw new InternalAuthenticationServiceException("短信驗證碼不能為空.");
        }
        if(null == msgCode) {
            throw new InternalAuthenticationServiceException("短信驗證碼已失效.");
        }
        if(!code.equals(msgCode)) {
            throw new InternalAuthenticationServiceException("短信驗證碼錯誤.");
        }
    }
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    /**
     * 數據源
     */
    @Resource
    private DataSource dataSource;
    /**
     * 用戶信息服務
     */
    @Resource
    private UserAuthentication userAuthentication;
    /**
     * 成功處理
     */
    @Resource
    private CustomizeAuthencationSuccessHandler customizeAuthencationSuccessHandler;
    /**
     * 失敗處理
     */
    @Resource
    private CustomizeAuthencationFailureHandler customizeAuthencationFailureHandler;
    /**
     * 用戶登出處理
     */
    @Resource
    private UserLogoutSuccessHandler userLogoutSuccessHandler;
    /**
     * 多用戶登錄處理
     */
    @Resource
    private MutilpleSessionHandler mutilpleSessionHandler;
    /**
     * 密碼編碼器
     */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    /**
     * 手機號碼登錄驗證處理
     */
    @Resource
    private DaoPhoneNumAuthenticationProvider daoPhoneNumAuthenticationProvider;
    /**
     * 信息驗證碼過濾器
     */
    @Resource
    private SmsCodeFilter smsCodeFilter;
    /**
     * 把AuthenticationManager公開
     */
    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
    /**
     * 配置自定義驗證查詢/加密工具
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userAuthentication).passwordEncoder(passwordEncoder());
    }
    /**
     * 手機號碼登錄攔截器
     */
    @Bean
    public PhoneNumAuthenticationFilter phoneNumAuthenticationFilter() throws Exception {
        // 手機號碼攔截器, 獲取手機號碼
        PhoneNumAuthenticationFilter phoneNumAuthenticationFilter = new PhoneNumAuthenticationFilter();
        phoneNumAuthenticationFilter.setAuthenticationManager(authenticationManagerBean());
        //使用手機號登錄失敗了如何處理
        phoneNumAuthenticationFilter.setAuthenticationFailureHandler(customizeAuthencationFailureHandler);
        // 使用手機號登錄成功了如何處理
        phoneNumAuthenticationFilter.setAuthenticationSuccessHandler(customizeAuthencationSuccessHandler);
        return phoneNumAuthenticationFilter;
    }
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // 加入短信驗證碼過濾器
            .addFilterBefore(smsCodeFilter, UsernamePasswordAuthenticationFilter.class)
            // 加入手機號碼登錄過濾器
            .addFilterAfter(phoneNumAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
            // 加入手機號碼登錄驗證提供者
            .authenticationProvider(daoPhoneNumAuthenticationProvider)
            // 表單登錄
            .formLogin()
            // 未登錄跳轉登錄頁面
            .loginPage("/login.html")
            // 指定登錄路徑
            .loginProcessingUrl("/login")
            // 用戶登錄成功的處理
            .successHandler(customizeAuthencationSuccessHandler)
            // 用戶登錄失敗的處理
            .failureHandler(customizeAuthencationFailureHandler)
            // 因為用戶傳入過來的token, 需要再次進行校驗
            .userDetailsService(userAuthentication)
            .tokenValiditySeconds(3600)
			// .alwaysRemember(true)
            // 認證配置
            .and()
            .authorizeRequests()
            //不攔截的Url
            .antMatchers("/login.html", "/image/code", "/smsCode", "/css/**", "/js/**", "/phoneLogin").permitAll()
            .anyRequest()  //所有的請求
            .authenticated()   //認證之后就可以訪問
            // 多端登錄限制,限制一個賬號同時只能一個人登錄
            .and()
            .sessionManagement()
            .maximumSessions(1)
            .expiredSessionStrategy(mutilpleSessionHandler)
            .and()
            // 登出配置
            .and()
            .logout()
            .logoutUrl("/logout")
            // 登出成功處理
            .logoutSuccessHandler(userLogoutSuccessHandler)
            .and()
            .csrf().disable();
    }
}