<!-- Spring Security 依賴 -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
    <version>2.7.18</version>
</dependency>
 
<!-- 谷歌 Kaptcha 圖形驗(yàn)證碼 -->
<dependency>
    <groupId>com.github.penggle</groupId>
    <artifactId>kaptcha</artifactId>
    <version>2.3.2</version>
</dependency>

package com.pjb.securitydemo.config;
 
import com.pjb.securitydemo.filter.VerificationCodeFilter;
import com.pjb.securitydemo.handler.LoginFailureHandler;
import com.pjb.securitydemo.handler.LoginSuccessHandler;
import com.pjb.securitydemo.handler.PermissionDeniedHandler;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 
/**
 * Spring Security 配置類
 * @author pan_junbiao
 **/
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter
{
    @Autowired
    private LoginSuccessHandler loginSuccessHandler;
 
    @Autowired
    private LoginFailureHandler loginFailureHandler;
 
    @Autowired
    private PermissionDeniedHandler permissionDeniedHandler;
 
    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        http.authorizeRequests() //返回一個(gè)URL攔截注冊(cè)器
                .antMatchers("/captcha.jpg").permitAll() //公開其權(quán)限
                .anyRequest() //匹配所有的請(qǐng)求
                .authenticated() //所有匹配的URL都需要被認(rèn)證才能訪問
                .and() //結(jié)束當(dāng)前標(biāo)簽，讓上下文回到 HttpSecurity
                .formLogin() //啟動(dòng)表單認(rèn)證
                .loginPage("/myLogin.html") //自定義登錄頁面
                .loginProcessingUrl("/auth/form") //指定處理登錄請(qǐng)求路徑
                .permitAll() //使登錄頁面不設(shè)限訪問
                //.defaultSuccessUrl("/index") //登錄認(rèn)證成功后的跳轉(zhuǎn)頁面
                .successHandler(loginSuccessHandler) //指定登錄成功時(shí)的處理
                .failureHandler(loginFailureHandler) //指定登錄失敗時(shí)的處理
                .and()
                .exceptionHandling().accessDeniedHandler(permissionDeniedHandler) //403無權(quán)時(shí)的返回操作
                .and().csrf().disable(); //關(guān)閉CSRF的防御功能
        
        //圖形驗(yàn)證碼過濾器（核心代碼）：將自定義過濾器添加在UsernamePasswordAuthenticationFilter之前
        http.addFilterBefore(new VerificationCodeFilter(), UsernamePasswordAuthenticationFilter.class);
    }
 
    /**
     * 內(nèi)存中添加登錄賬號(hào)
     */
    @Bean
    public UserDetailsService userDetailsService()
    {
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(User.withUsername("admin").password("123456").roles("ADMIN").build());
        manager.createUser(User.withUsername("user").password("123456").roles("USER").build());
        manager.createUser(User.withUsername("panjunbiao").password("123456").roles("USER").build());
        return manager;
    }
 
    /**
     * 密碼編譯器
     * 由于5.x版本之后默認(rèn)啟用了委派密碼編譯器，
     * 因而按照以往的方式設(shè)置內(nèi)存密碼將會(huì)讀取異常，
     * 所以需要暫時(shí)將密碼編碼器設(shè)置為 NoOpPasswordEncoder
     */
    @Bean
    public PasswordEncoder passwordEncoder()
    {
        return NoOpPasswordEncoder.getInstance();
    }
}

package com.pjb.securitydemo.handler;
 
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.stereotype.Component;
 
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
 
/**
 * 登錄成功處理類
 */
@Component
public class LoginSuccessHandler implements AuthenticationSuccessHandler
{
    @Override
    public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException
    {
        //重定向至首頁
        httpServletResponse.sendRedirect("/");
    }
}

package com.pjb.securitydemo.handler;
 
import com.pjb.securitydemo.exception.VerificationCodeException;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.CredentialsExpiredException;
import org.springframework.security.authentication.DisabledException;
import org.springframework.security.authentication.LockedException;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.stereotype.Component;
 
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
 
/**
 * 登錄失敗處理類
 */
@Component
public class LoginFailureHandler implements AuthenticationFailureHandler
{
    @Override
    public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException authenticationException) throws IOException, ServletException
    {
        //獲取登錄失敗原因
        String errorMessage = "";
        if(authenticationException instanceof BadCredentialsException){
            errorMessage = "用戶名或密碼不正確";
        }else if(authenticationException instanceof DisabledException){
            errorMessage = "賬號(hào)被禁用";
        }else if(authenticationException instanceof UsernameNotFoundException){
            errorMessage = "用戶名不存在";
        }else if(authenticationException instanceof CredentialsExpiredException){
            errorMessage = "密碼已過期";
        }else if(authenticationException instanceof LockedException) {
            errorMessage = "賬號(hào)被鎖定";
        }else if(authenticationException instanceof VerificationCodeException){
            errorMessage = "無效的圖形驗(yàn)證碼";
        }else{
            errorMessage = "未知異常";
        }
 
        //設(shè)置響應(yīng)編碼
        httpServletResponse.setContentType("application/json;charset=utf-8");
        PrintWriter out = httpServletResponse.getWriter();
        out.write(errorMessage);
    }
}

package com.pjb.securitydemo.handler;
 
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.stereotype.Component;
 
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
 
/**
 * 403無權(quán)限處理類
 */
@Component
public class PermissionDeniedHandler implements AccessDeniedHandler
{
    @Override
    public void handle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AccessDeniedException e) throws IOException, ServletException
    {
        httpServletResponse.setContentType("application/json;charset=utf-8");
        PrintWriter out = httpServletResponse.getWriter();
        out.write("403無權(quán)限");
    }
}

package com.pjb.securitydemo.config;
 
import com.google.code.kaptcha.Producer;
import com.google.code.kaptcha.impl.DefaultKaptcha;
import com.google.code.kaptcha.util.Config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
 
import java.util.Properties;
 
/**
 * 谷歌Kaptcha圖形驗(yàn)證碼配置類
 */
@Configuration
public class KaptchaConfig
{
    @Bean
    public Producer captcha()
    {
        //配置圖形驗(yàn)證碼的基本參數(shù)
        Properties properties = new Properties();
        //圖片寬度
        properties.setProperty("kaptcha.image.width","150");
        //圖片長度
        properties.setProperty("kaptcha.image.height","50");
        //字符集（從哪些字符中產(chǎn)生）
        properties.setProperty("kaptcha.textproducer.char.string", "0123456789");
        //字符長度
        properties.setProperty("kaptcha.textproducer.char.length", "4");
        //字體顏色
        properties.put("kaptcha.textproducer.font.color", "red");
        // 文字間隔，這里設(shè)置為10px
        properties.put("kaptcha.textproducer.char.space", "10");
 
        // 背景顏色漸變開始
        properties.put("kaptcha.background.clear.from", "yellow");
        // 背景顏色漸變結(jié)束
        properties.put("kaptcha.background.clear.to", "green");
 
        //初始化配置
        Config config = new Config(properties);
 
        //使用默認(rèn)的圖形驗(yàn)證碼實(shí)現(xiàn)，當(dāng)然也可以自定義實(shí)現(xiàn)
        DefaultKaptcha defaultKaptcha = new DefaultKaptcha();
        defaultKaptcha.setConfig(config);
        return defaultKaptcha;
    }
}

package com.pjb.securitydemo.controller;
 
import com.google.code.kaptcha.Producer;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
 
import javax.imageio.ImageIO;
import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.awt.image.BufferedImage;
import java.io.IOException;
 
/**
 * 驗(yàn)證碼控制器
 */
@Controller
public class CaptchaController
{
    @Autowired
    private Producer captchaProducer;
 
    @GetMapping("/captcha.jpg")
    public void getCaptcha(HttpServletRequest request, HttpServletResponse response) throws IOException
    {
        //設(shè)置內(nèi)容類型
        response.setContentType("image/jpeg");
        //創(chuàng)建驗(yàn)證碼文本
        String capText = captchaProducer.createText();
 
        //將驗(yàn)證碼文本保存到Session中
        request.getSession().setAttribute("captcha", capText);
        //創(chuàng)建驗(yàn)證碼圖片
        BufferedImage bufferedImage = captchaProducer.createImage(capText);
        //獲取響應(yīng)輸出流
        ServletOutputStream out = response.getOutputStream();
        //將圖片驗(yàn)證碼數(shù)據(jù)寫入響應(yīng)輸出流
        ImageIO.write(bufferedImage,"jpg",out);
        //推送并關(guān)閉響應(yīng)輸出流
        try
        {
            out.flush();
        }
        finally
        {
            out.close();
        }
    }
}

package com.pjb.securitydemo.exception;
 
import org.springframework.security.core.AuthenticationException;
 
/**
 * 驗(yàn)證碼校驗(yàn)失敗的異常類
 */
public class VerificationCodeException extends AuthenticationException
{
    public VerificationCodeException()
    {
        super("圖形驗(yàn)證碼校驗(yàn)失敗");
    }
}

package com.pjb.securitydemo.filter;
 
import com.pjb.securitydemo.exception.VerificationCodeException;
import com.pjb.securitydemo.handler.LoginFailureHandler;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;
 
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.IOException;
 
/**
 * 驗(yàn)證碼校驗(yàn)過濾器
 */
public class VerificationCodeFilter extends OncePerRequestFilter
{
    private AuthenticationFailureHandler authenticationFailureHandler = new LoginFailureHandler();
 
    @Override
    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException
    {
        //非登錄請(qǐng)求不校驗(yàn)驗(yàn)證碼
        String requestURI = httpServletRequest.getRequestURI();
        if(!"/auth/form".equals(requestURI))
        {
            filterChain.doFilter(httpServletRequest,httpServletResponse);
        }
        else
        {
            try
            {
                //驗(yàn)證碼校驗(yàn)
                verificationCode(httpServletRequest);
 
                //驗(yàn)證成功
                filterChain.doFilter(httpServletRequest,httpServletResponse);
            }
            catch (VerificationCodeException ex)
            {
                //驗(yàn)證失敗
                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, ex);
            }
        }
    }
 
    /**
     * 驗(yàn)證碼校驗(yàn)
     */
    public void verificationCode(HttpServletRequest httpServletRequest) throws VerificationCodeException
    {
        String requestCode = httpServletRequest.getParameter("captcha");
        HttpSession session = httpServletRequest.getSession();
        String savedCode = (String)session.getAttribute("captcha");
        if(!StringUtils.isEmpty(savedCode))
        {
            //隨手清除驗(yàn)證碼，無論是失敗，還是成功?？蛻舳藨?yīng)在登錄失敗時(shí)刷新驗(yàn)證碼
            session.removeAttribute("captcha");
        }
 
        //驗(yàn)證不通過，拋出異常
        if(StringUtils.isEmpty(requestCode) || StringUtils.isEmpty(savedCode) || !requestCode.equals(savedCode))
        {
            throw new VerificationCodeException();
        }
    }
}

package com.pjb.securitydemo.controller;
 
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
 
import javax.servlet.http.HttpServletRequest;
import java.security.Principal;
 
/**
 * 首頁控制器
 * @author pan_junbiao
 **/
@Controller
public class IndexController
{
    /**
     * 首頁
     */
    @RequestMapping("/")
    public String index(HttpServletRequest request)
    {
        //獲取當(dāng)前登錄人
        String userName = "未登錄";
        Principal principal = request.getUserPrincipal();
        if(principal!=null)
        {
            userName = principal.getName();
        }
 
        //返回頁面
        request.setAttribute("userName",userName);
        return "/index.html";
    }
 
}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>登錄</title>
    <meta name="author" content="pan_junbiao的博客">
</head>
<body>
<form name="myForm" action="/auth/form" method="post">
    <table align="center">
        <caption>用戶登錄</caption>
        <tr>
            <td>登錄賬戶：</td>
            <td>
                <input type="text" name="username" placeholder="請(qǐng)輸入登錄賬戶" value="panjunbiao" />
            </td>
        </tr>
        <tr>
            <td>登錄密碼：</td>
            <td>
                <input type="password" name="password" placeholder="請(qǐng)輸入登錄密碼" value="123456" />
            </td>
        </tr>
        <tr>
            <td>驗(yàn)證碼：</td>
            <td>
                <!-- 新增圖形驗(yàn)證碼的輸入框 -->
                <input type="text" name="captcha" placeholder="請(qǐng)輸入驗(yàn)證碼" />
 
                <!-- 圖片指向圖形驗(yàn)證碼API -->
                <img src="/captcha.jpg" alt="captch" height="50px" width="150px" style="margin-left:20px;" >
            </td>
        </tr>
        <!-- 以下是提交、取消按鈕 -->
        <tr>
            <td colspan="2" style="text-align: center; padding: 5px;">
                <input type="submit" value="提交" />
                <input type="reset" value="重置" />
            </td>
        </tr>
    </table>
</form>
</body>
</html>

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8">
    <title>首頁</title>
    <meta name="author" content="pan_junbiao的博客">
</head>
<body>
    <h1 style="color: red">Hello,Spring Security</h1>
    <p>博客信息：您好，歡迎訪問 pan_junbiao的博客</p>
    <p>博客地址：https://blog.csdn.net/pan_junbiao</p>
    <p th:text="'當(dāng)前登錄人：' + ${userName}"></p>
    <a href="/logout" rel="external nofollow"  onclick="return confirm('確認(rèn)注銷嗎？');">登出</a>
</body>
</html>