import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;

public class CustomAuthenticationFailureHandler implements AuthenticationFailureHandler {

    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
                                        AuthenticationException exception) throws IOException, ServletException {
        // 在這里處理認(rèn)證失敗的情況
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        response.getWriter().write("登錄失敗: " + exception.getMessage());
    }
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        // ... 其他配置 ...
        .formLogin()
            .failureHandler(new CustomAuthenticationFailureHandler()) // 設(shè)置自定義認(rèn)證失敗處理器
            // ... 其他表單登錄配置 ...
        // ... 其他HTTP安全配置 ...
    ;
}

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;

public class CustomAccessDeniedHandler implements AccessDeniedHandler {

    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response,
                       AccessDeniedException accessDeniedException) throws IOException, ServletException {
        // 在這里處理授權(quán)失敗的情況
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        response.getWriter().write("權(quán)限不足: " + accessDeniedException.getMessage());
    }
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        // ... 其他配置 ...
        .exceptionHandling()
            .accessDeniedHandler(new CustomAccessDeniedHandler()) // 設(shè)置自定義授權(quán)失敗處理器
        // ... 其他異常處理配置 ...
        // ... 其他HTTP安全配置 ...
    ;
}

@Component
public class AuthenticationEntryPointImpl implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse
            response, AuthenticationException authException) throws IOException,
            ServletException {
        ResponseResult result = new
                ResponseResult(HttpStatus.UNAUTHORIZED.value(), "認(rèn)證失敗請重新登錄");
        String json = JSON.toJSONString(result);
        WebUtils.renderString(response, json);
    }
}

@Component
public class AccessDeniedHandlerImpl implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response,
                       AccessDeniedException accessDeniedException) throws IOException,
            ServletException {
        ResponseResult result = new ResponseResult(HttpStatus.FORBIDDEN.value(),
                "權(quán)限不足");
        String json = JSON.toJSONString(result);
        WebUtils.renderString(response, json);
    }
}

@Configuration //配置類
@EnableWebSecurity // 開啟Spring Security的功能 代替了 implements WebSecurityConfigurerAdapter
public class SecurityConfig {
    @Autowired
    AuthenticationConfiguration authenticationConfiguration;//獲取AuthenticationManager
    @Autowired
    JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter;
    @Autowired
    AccessDeniedHandlerImpl accessDeniedHandler;
    @Autowired
    AuthenticationEntryPointImpl authenticationEntryPoint;


    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }

    /**
     * 配置Spring Security的過濾鏈。
     *
     * @param http 用于構(gòu)建安全配置的HttpSecurity對象。
     * @return 返回配置好的SecurityFilterChain對象。
     * @throws Exception 如果配置過程中發(fā)生錯誤，則拋出異常。
     */
    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                // 禁用CSRF保護(hù)
                .csrf(csrf -> csrf.disable())
                // 設(shè)置會話創(chuàng)建策略為無狀態(tài)
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                // 配置授權(quán)規(guī)則                 指定user/login路徑.允許匿名訪問(未登錄可訪問已登陸不能訪問). 其他路徑需要身份認(rèn)證
                .authorizeHttpRequests(auth -> auth.requestMatchers("/user/login").anonymous().anyRequest().authenticated())
                //開啟跨域訪問
                .cors(AbstractHttpConfigurer::disable)
                // 添加JWT認(rèn)證過濾器
                .addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
                // 配置異常處理
                .exceptionHandling(exception -> exception.accessDeniedHandler(accessDeniedHandler).authenticationEntryPoint(authenticationEntryPoint));


        // 構(gòu)建并返回安全過濾鏈
        return http.build();
    }