@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    // 開啟授權(quán)保護(hù)
    http.authorizeHttpRequests(authorize -> authorize
            // 所有 /user/** 路徑下的請求需要 ADMIN 角色
            .requestMatchers("/user/**").hasRole("ADMIN")
            // 對所有請求開啟授權(quán)保護(hù)
            .anyRequest()
            // 已認(rèn)證的請求自動(dòng)被授權(quán)
            .authenticated());
    // 其他配置省略...
}

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    LambdaQueryWrapper<User> lambdaQueryWrapper = new LambdaQueryWrapper<>();
    lambdaQueryWrapper.eq(User::getUsername, username);
    User user = userMapper.selectOne(lambdaQueryWrapper);
    if (user == null) {
        throw new UsernameNotFoundException(username);
    } else {
        return org.springframework.security.core.userdetails.User.withUsername(user.getUsername())
                .password(user.getPassword())
                .disabled(!user.getEnabled())
            	// 設(shè)置用戶的憑據(jù)是否過期，false 表示憑據(jù)未過期
                .credentialsExpired(false)
            	// 設(shè)置賬戶是否被鎖定，false 表示賬戶未鎖定
                .accountLocked(false)
                // 為用戶分配 ADMIN 角色
                .roles("ADMIN")
                .build();
    }
}

public class MyAccessDeniedHandler implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response,
                       AccessDeniedException accessDeniedException) throws IOException, ServletException {
        // 創(chuàng)建結(jié)果對象
        HashMap<String, Object> result = new HashMap<>();
        result.put("code", -1);
        result.put("message", "沒有訪問該資源的權(quán)限");
        // 轉(zhuǎn)換成JSON字符串
        String json = JSON.toJSONString(result);
        // 返回響應(yīng)
        response.setContentType("application/json;charset=utf-8");
        response.getWriter().println(json);
    }
}

http.exceptionHandling(exception -> {
    // 請求未認(rèn)證的處理
    exception.authenticationEntryPoint(new MyAuthenticationEntryPoint());
    // 請求未授權(quán)的處理
    exception.accessDeniedHandler(new MyAccessDeniedHandler());
});