@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) {
        http
            // ...
            .formLogin(Customizer.withDefaults())
            .oneTimeTokenLogin(Customizer.withDefaults());
        return http.build();
    }

}

@Component // ①
public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
    private final MailSender mailSender;
    private final OneTimeTokenGenerationSuccessHandler redirectHandler = new RedirectOneTimeTokenGenerationSuccessHandler("/ott/sent");

    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) throws IOException, ServletException {
        UriComponentsBuilder builder = UriComponentsBuilder.fromHttpUrl(UrlUtils.buildFullRequestUrl(request))
                .replacePath(request.getContextPath())
                .replaceQuery(null)
                .fragment(null)
                .path("/login/ott")
                .queryParam("token", oneTimeToken.getTokenValue()); // ②
        String magicLink = builder.toUriString();
        String email = getUserEmail(oneTimeToken.getUsername()); // ③
        this.mailSender.send(email, "Your Spring Security One Time Token", "Use the following link to sign in into the application: " + magicLink); // ④
        this.redirectHandler.handle(request, response, oneTimeToken); // ⑤
    }

    private String getUserEmail() {
        // ...
    }
}

@Controller
public class PageController {

    @GetMapping("/ott/sent")
    String ottSent() {
        return "my-template";
    }

}

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) {
        http
            // ...
            .formLogin(Customizer.withDefaults())
            .oneTimeTokenLogin((ott) -> ott
                .defaultSubmitPageUrl("/ott/submit")
            );
        return http.build();
    }

}

@Component
public class MagicLinkGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
    // ...
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) {
        http
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .formLogin(Customizer.withDefaults())
            .oneTimeTokenLogin((ott) -> ott
                // 禁用默認(rèn)提交頁面
                .showDefaultSubmitPage(false)
                // 自定義提交頁面URL
                .defaultSubmitPageUrl("/ott/submit")
            );
        return http.build();
    }

}

@Controller
public class MyController {

    // 自定義默認(rèn)提交頁面入口
    @GetMapping("/ott/submit")
    public String ottSubmitPage() {
        return "my-ott-submit";
    }

}

@Component
public class MagicLinkGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
    // ...
        
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) throws IOException, ServletException {
        UriComponentsBuilder builder = UriComponentsBuilder.fromHttpUrl(UrlUtils.buildFullRequestUrl(request))
                .replacePath(request.getContextPath())
                .replaceQuery(null)
                .fragment(null)
                .path("/ott/submit")
                .queryParam("token", oneTimeToken.getTokenValue()); // ②
        String magicLink = builder.toUriString();
        String email = getUserEmail(oneTimeToken.getUsername()); // ③
        this.mailSender.send(email, "Your Spring Security One Time Token", "Use the following link to sign in into the application: " + magicLink); // ④
        this.redirectHandler.handle(request, response, oneTimeToken); // ⑤
    }
    
    // ...
}

// Java示例
@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) {
        http
            // ...
            .formLogin(Customizer.withDefaults())
            .oneTimeTokenLogin((ott) -> ott
                .tokenGeneratingUrl("/ott/my-generate-url")
            );
        return http.build();
    }
}

@Configuration 
@EnableWebSecurity 
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) {
        http.formLogin(Customizer.withDefaults())
            .oneTimeTokenLogin(Customizer.withDefaults());
        return http.build();
    }
    @Bean
    public OneTimeTokenService oneTimeTokenService() {
        return new MyCustomOneTimeTokenService();
    }
}

@Configuration 
@EnableWebSecurity 
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) {
        http.formLogin(Customizer.withDefaults())
            .oneTimeTokenLogin((ott) -> ott
                .tokenService(new MyCustomOneTimeTokenService())
            );
        return http.build();
    }
}

@Configuration 
@EnableWebSecurity 
public class SecurityConfig {
    
        /**
     * 配置Security過濾鏈，用于處理一次性令牌登錄
     *
     * @param http 用于配置Web安全的HttpSecurity對(duì)象
     * @param userDetailsService 自定義的用戶信息查詢服務(wù)，實(shí)現(xiàn)了UserDetailsService接口
     * @param mailSender 郵件服務(wù)
     * @return 配置好的SecurityFilterChain對(duì)象
     */
    @Bean
    @Order(1)
    public SecurityFilterChain ottLoginSecurityFilterChain(HttpSecurity http, final OneTimeTokenService oneTimeTokenService, final UserDetailsServiceImpl userDetailsService, final JavaMailSender mailSender) throws Exception {
        http.formLogin(Customizer.withDefaults())
                // 配置請(qǐng)求授權(quán)，所有請(qǐng)求都需要認(rèn)證
                .authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated())
                // 禁用CSRF保護(hù)，適用于本例的簡(jiǎn)單演示場(chǎng)景，在生產(chǎn)環(huán)境中需謹(jǐn)慎考慮。若是前后端分離情況，需要禁用
                .csrf(CsrfConfigurer::disable)
                // 配置一次性令牌登錄
                .oneTimeTokenLogin(ott->ott
                        // （可選）設(shè)置一次性令牌生成的URL，默認(rèn)值：/ott/generate
                        .tokenGeneratingUrl("/ott/generate")
                        // （可選）設(shè)置一次性令牌生成和驗(yàn)證的服務(wù)，實(shí)現(xiàn)OneTimeTokenService接口，默認(rèn)值：InMemoryOneTimeTokenService實(shí)例
                        .tokenService(oneTimeTokenService)
                        // （必做）配置一次性令牌生成成功后的處理，默認(rèn)值：RedirectOneTimeTokenGenerationSuccessHandler實(shí)例
                        .tokenGenerationSuccessHandler(new CustomOneTimeTokenGenerationSuccessHandler(mailSender))
                        // （可選）設(shè)置是否顯示默認(rèn)的登錄提交頁面，默認(rèn)值：true
                        .showDefaultSubmitPage(true)
                        // （可選）設(shè)置默認(rèn)登錄提交頁面的URL，默認(rèn)值：/login/ott
                        .defaultSubmitPageUrl("/login/ott")
                        // （可選）配置認(rèn)證轉(zhuǎn)換器，用于將HTTP請(qǐng)求中的token轉(zhuǎn)換為OneTimeTokenAuthenticationToken認(rèn)證對(duì)象，默認(rèn)值：OneTimeTokenAuthenticationConverter實(shí)例
                        .authenticationConverter(new OneTimeTokenAuthenticationConverter())
                        // （可選）配置認(rèn)證提供者，用于驗(yàn)證OneTimeTokenAuthenticationToken認(rèn)證對(duì)象，默認(rèn)值：OneTimeTokenAuthenticationProvider實(shí)例
                        .authenticationProvider(new OneTimeTokenAuthenticationProvider(oneTimeTokenService, userDetailsService))
                        // （可選）配置認(rèn)證成功后的處理
                        .authenticationSuccessHandler(((request, response, authentication) -> {
                            System.out.println("認(rèn)證成功");
                        }))
                        // （可選）配置認(rèn)證失敗后的處理
                        .authenticationFailureHandler((request, response, exception) -> {
                            System.out.println("認(rèn)證失敗:"+exception.getMessage());
                            new DefaultRedirectStrategy().sendRedirect(request, response, "/login");
                        })
                        // （可選）設(shè)置一次性令牌登錄成功后的URL
                        // （必做）添加一個(gè) /login/ott 類型的HTTP接口
                        .loginProcessingUrl("/login/ott")

                );

        // 構(gòu)建并返回配置好的Security過濾鏈
        return http.build();
    }
    
    @Bean
    public OneTimeTokenService oneTimeTokenService() {
        // 創(chuàng)建自定義的OneTimeTokenService實(shí)例
        // 為了測(cè)試方便，直接使用內(nèi)置的InMemoryOneTimeTokenService
        return new InMemoryOneTimeTokenService();
    }
    
    static class CustomOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {

        private final RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
        private final JavaMailSender mailSender;

        public CustomOneTimeTokenGenerationSuccessHandler(JavaMailSender mailSender) {
            this.mailSender = mailSender;
        }

        @Override
        public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) throws IOException, ServletException {
            // 發(fā)送郵件或短信給用戶
            UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(UrlUtils.buildFullRequestUrl(request))
                    .replacePath(request.getContextPath())
                    .replaceQuery(null)
                    .fragment(null)
                    .path("/login/ott") // 設(shè)置默認(rèn)登錄提交頁面的URL
                    .queryParam("token", oneTimeToken.getTokenValue());
            String magicLink = builder.toUriString();
            // 發(fā)件人：從數(shù)據(jù)庫(kù)或配置文件中讀取，這里只是測(cè)試，直接寫死
            String from = "test@test.com";
            String email = getUserEmail(oneTimeToken.getUsername());

            SimpleMailMessage msg = new SimpleMailMessage();
            msg.setFrom(from);
            msg.setTo(email);
            msg.setSubject("Your Spring Security One Time Token");
            msg.setText("Use the following link to sign in into the application: " + magicLink);

            this.mailSender.send(msg);

            // 為了測(cè)試方便，重定向到token提交頁
            String redirectUrl = "/login/ott?token=" + oneTimeToken.getTokenValue();
            this.redirectStrategy.sendRedirect(request, response, redirectUrl);
        }

        private String getUserEmail(String username) {
            // TODO 獲取用戶郵箱地址
            return "test@test.com";
        }
    }
}

@RestController
public class OTTLoginController {

    private final RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
    @PostMapping("/login/ott")
    public void login(HttpServletRequest request, HttpServletResponse response) throws IOException {
        System.out.println("認(rèn)證成功后跳轉(zhuǎn)到主頁");
        this.redirectStrategy.sendRedirect(request,response,"/");
    }

}