<!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt-impl -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.12.6</version>
    <scope>runtime</scope>
</dependency>

<!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt-jackson -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.12.6</version>
    <scope>runtime</scope>
</dependency>

<!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt-impl -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.12.6</version>
    <scope>runtime</scope>
</dependency>

<!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt-jackson -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.12.6</version>
    <scope>runtime</scope>
</dependency>

@Configuration
@EnableWebSecurity		// 該注解啟用 Spring Security 的 web 安全功能。
public class SecurityConfig {
}

@Bean
public UserDetailsService userDetailsService() {
	// 創(chuàng)建基于內(nèi)存的用戶(hù)信息管理器
    InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
    manager.createUser(
	    // 創(chuàng)建UserDetails對(duì)象，用于管理用戶(hù)名、用戶(hù)密碼、用戶(hù)角色、用戶(hù)權(quán)限等內(nèi)容
	    User.withDefaultPasswordEncoder().username("user").password("user123").roles("USER").build()
    ); 		
    // 如果自己配置的有賬號(hào)密碼, 那么上面講的 user 和 隨機(jī)字符串 的默認(rèn)密碼就不能用了
    return manager;
}

@Service
public class UserDetailsServiceImpl implements UserDetailsService {
    @Autowired
    UserMapper userMapper;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        QueryWrapper<User> queryWrapper = new QueryWrapper<User>();
        queryWrapper.eq("username", username);	// 這里不止可以用username，你可以自定義，主要根據(jù)你自己寫(xiě)的查詢(xún)邏輯
        User user = userMapper.selectOne(queryWrapper);
        if (user == null) {
            throw new UsernameNotFoundException(username);
        }
        return new UserDetailsImpl(user);	// UserDetailsImpl 是我們實(shí)現(xiàn)的類(lèi)
    }
}

@Data
@AllArgsConstructor
@NoArgsConstructor	// 這三個(gè)注解可以幫我們自動(dòng)生成 get、set、有參、無(wú)參構(gòu)造函數(shù)
public class UserDetailsImpl implements UserDetails {
    private User user;	// 通過(guò)有參構(gòu)造函數(shù)填充賦值的
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return List.of();
    }
    @Override
    public String getPassword() {
        return user.getPassword();
    }
    @Override
    public String getUsername() {
        return user.getUsername();
    }
    @Override
    public boolean isAccountNonExpired() {  // 檢查賬戶(hù)是否 沒(méi)過(guò)期。
        return true;
    }
    @Override
    public boolean isAccountNonLocked() {   // 檢查賬戶(hù)是否 沒(méi)有被鎖定。
        return true;
    }
    @Override
    public boolean isCredentialsNonExpired() {  //檢查憑據(jù)（密碼）是否 沒(méi)過(guò)期。
        return true;
    }
    @Override
    public boolean isEnabled() {    // 檢查賬戶(hù)是否啟用。
        return true;
    }
    // 這個(gè)方法是 @Data注解 會(huì)自動(dòng)幫我們生成，用來(lái)獲取 loadUserByUsername 中最后我們返回的創(chuàng)建UserDetailsImpl對(duì)象時(shí)傳入的User。
    // 如果你的字段包含 username和password 的話可以用強(qiáng)制類(lèi)型轉(zhuǎn)換, 把 UserDetailsImpl 轉(zhuǎn)換成 User。如果不能強(qiáng)制類(lèi)型轉(zhuǎn)換的話就需要用到這個(gè)方法了
	public User getUser() {	
	        return user;	
	    }
	}

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
            // 開(kāi)啟授權(quán)保護(hù)
            .authorizeHttpRequests(authorize -> authorize
                    // 不需要認(rèn)證的地址有哪些
                    .requestMatchers("/blog/**", "/public/**", "/about").permitAll()	// ** 通配符
                    // 對(duì)所有請(qǐng)求開(kāi)啟授權(quán)保護(hù)
                    .anyRequest().
                    // 已認(rèn)證的請(qǐng)求會(huì)被自動(dòng)授權(quán)
                    authenticated()
            )
            // 使用默認(rèn)的登陸登出頁(yè)面進(jìn)行授權(quán)登陸
            .formLogin(Customizer.withDefaults())
            // 啟用“記住我”功能的。允許用戶(hù)在關(guān)閉瀏覽器后，仍然保持登錄狀態(tài)，直到他們主動(dòng)注銷(xiāo)或超出設(shè)定的過(guò)期時(shí)間。
            .rememberMe(Customizer.withDefaults());
    // 關(guān)閉 csrf CSRF（跨站請(qǐng)求偽造）是一種網(wǎng)絡(luò)攻擊，攻擊者通過(guò)欺騙已登錄用戶(hù)，誘使他們?cè)诓恢榈那闆r下向受信任的網(wǎng)站發(fā)送請(qǐng)求。
    http.csrf(csrf -> csrf.disable());
    return http.build();
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Autowired
    private JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter;
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf(CsrfConfigurer::disable) // 基于token，不需要csrf
                .sessionManagement((session) -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) // 基于token，不需要session
                .authorizeHttpRequests((authz) -> authz
                        .requestMatchers("/login/",  "/getPicCheckCode").permitAll() // 放行api
                        .requestMatchers(HttpMethod.OPTIONS).permitAll()
                        .anyRequest().authenticated()
                )
                .addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }
}

@Configuration
public class SecurityConfig {
    @Bean
    public PasswordEncoder passwordEncoder() {
        // 也可用有參構(gòu)造，取值范圍是 4 到 31，默認(rèn)值為 10。數(shù)值越大，加密計(jì)算越復(fù)雜
        return new BCryptPasswordEncoder();	
    }
}

@Autowired
private PasswordEncoder passwordEncoder;
public void registerUser(String username, String rawPassword) {
    String encryptedPassword = passwordEncoder.encode(rawPassword);
    // 保存用戶(hù)信息到數(shù)據(jù)庫(kù)，包括加密后的密碼
}

public boolean login(String username, String rawPassword) {
    // 從數(shù)據(jù)庫(kù)中獲取用戶(hù)信息，包括加密后的密碼
    String storedEncryptedPassword = // 從數(shù)據(jù)庫(kù)獲取;
    return passwordEncoder.matches(rawPassword, storedEncryptedPassword);
}

fetch('/api/protected-endpoint', {
    method: 'GET',
    headers: {
        'Authorization': `Bearer ${token}`
    }
});

import org.springframework.web.filter.OncePerRequestFilter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
public class CustomFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, 
                                    FilterChain filterChain) throws ServletException, IOException {
        // 自定義過(guò)濾邏輯，例如記錄請(qǐng)求日志
        System.out.println("Request URI: " + request.getRequestURI());
        // 繼續(xù)執(zhí)行過(guò)濾鏈
        filterChain.doFilter(request, response);
    }
}

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.addFilterBefore(new CustomFilter(), UsernamePasswordAuthenticationFilter.class);
        // 其他配置...
        return http.build();
    }
}

@Component
public class JwtUtil {
    public static final long JWT_TTL = 60 * 60 * 1000L * 24 * 14;  // 有效期14天
    public static final String JWT_KEY = "SDFGjhdsfalshdfHFdsjkdsfds121232131afasdfac";
    public static String getUUID() {
        return UUID.randomUUID().toString().replaceAll("-", "");
    }
    public static String createJWT(String subject) {
        JwtBuilder builder = getJwtBuilder(subject, null, getUUID());
        return builder.compact();
    }
    private static JwtBuilder getJwtBuilder(String subject, Long ttlMillis, String uuid) {
        SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
        SecretKey secretKey = generalKey();
        long nowMillis = System.currentTimeMillis();
        Date now = new Date(nowMillis);
        if (ttlMillis == null) {
            ttlMillis = JwtUtil.JWT_TTL;
        }
        long expMillis = nowMillis + ttlMillis;
        Date expDate = new Date(expMillis);
        return Jwts.builder()
                .id(uuid)
                .subject(subject)
                .issuer("sg")
                .issuedAt(now)
                .signWith(secretKey)
                .expiration(expDate);
    }
    public static SecretKey generalKey() {
        byte[] encodeKey = Base64.getDecoder().decode(JwtUtil.JWT_KEY);
        return new SecretKeySpec(encodeKey, 0, encodeKey.length, "HmacSHA256");
    }
    public static Claims parseJWT(String jwt) throws Exception {
        SecretKey secretKey = generalKey();
        return Jwts.parser()
                .verifyWith(secretKey)
                .build()
                .parseSignedClaims(jwt)
                .getPayload();
    }
}

public static String getUUID() {
    return UUID.randomUUID().toString().replaceAll("-", "");
}

public static String createJWT(String subject) {
    JwtBuilder builder = getJwtBuilder(subject, null, getUUID());
    return builder.compact();
}

private static JwtBuilder getJwtBuilder(String subject, Long ttlMillis, String uuid) {
    //...
}

public static SecretKey generalKey() {
    byte[] encodeKey = Base64.getDecoder().decode(JwtUtil.JWT_KEY);
    return new SecretKeySpec(encodeKey, 0, encodeKey.length, "HmacSHA256");
}

public static Claims parseJWT(String jwt) throws Exception {
    SecretKey secretKey = generalKey();
    return Jwts.parserBuilder()
            .setSigningKey(secretKey)
            .build()
            .parseClaimsJws(jwt)
            .getBody();
}

import io.jsonwebtoken.Claims;
import org.jetbrains.annotations.NotNull;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;
@Component
public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
    @Autowired
    private UserMapper userMapper;
    @Override
    protected void doFilterInternal(HttpServletRequest request, @NotNull HttpServletResponse response, @NotNull FilterChain filterChain) throws ServletException, IOException {
        String token = request.getHeader("Authorization");
        if (!StringUtils.hasText(token) || !token.startsWith("Bearer ")) {
            filterChain.doFilter(request, response);
            return;
        }
        token = token.substring(7);
        String userid;
        try {
            Claims claims = JwtUtil.parseJWT(token);
            userid = claims.getSubject();
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
        User user = userMapper.selectById(Integer.parseInt(userid));
        if (user == null) {
            throw new RuntimeException("用戶(hù)名未登錄");
        }
        UserDetailsImpl loginUser = new UserDetailsImpl(user);
        UsernamePasswordAuthenticationToken authenticationToken =
                new UsernamePasswordAuthenticationToken(loginUser, null, null);
        // 如果是有效的jwt，那么設(shè)置該用戶(hù)為認(rèn)證后的用戶(hù)
        SecurityContextHolder.getContext().setAuthentication(authenticationToken);
        filterChain.doFilter(request, response);
    }
}

@Autowired
private UserMapper userMapper;

String token = request.getHeader("Authorization");
if (!StringUtils.hasText(token) || !token.startsWith("Bearer ")) {
    filterChain.doFilter(request, response);
    return;
}

token = token.substring(7); // 去掉 "Bearer " 前綴
String userid;
try {
    Claims claims = JwtUtil.parseJWT(token);
    userid = claims.getSubject();
} catch (Exception e) {
    throw new RuntimeException(e);
}

User user = userMapper.selectById(Integer.parseInt(userid));
if (user == null) {
    throw new RuntimeException("用戶(hù)名未登錄");
}

UserDetailsImpl loginUser = new UserDetailsImpl(user);
UsernamePasswordAuthenticationToken authenticationToken =
        new UsernamePasswordAuthenticationToken(loginUser, null, null);
SecurityContextHolder.getContext().setAuthentication(authenticationToken);

filterChain.doFilter(request, response);

http.addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);

@Bean
public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
    return authConfig.getAuthenticationManager();
}

@Autowired
private AuthenticationManager authenticationManager;
UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username, password);
// 從數(shù)據(jù)庫(kù)中對(duì)比查找，如果找到了會(huì)返回一個(gè)帶有認(rèn)證的封裝后的用戶(hù)，否則會(huì)報(bào)錯(cuò)，自動(dòng)處理。（這里我們假設(shè)我們配置的security是基于數(shù)據(jù)庫(kù)查找的）
Authentication authenticate = authenticationManager.authenticate(authenticationToken);	
// 獲取認(rèn)證后的用戶(hù)
User user = (User ) authenticate.getPrincipal();	// 如果強(qiáng)制類(lèi)型轉(zhuǎn)換報(bào)錯(cuò)的話，可以用我們實(shí)現(xiàn)的 `UserDetailsImpl` 類(lèi)中的 getUser 方法了
String jwt = JwtUtil.createJWT(user.getId().toString());

// SecurityContextHolder 是一個(gè)存儲(chǔ)安全上下文的工具類(lèi)，提供了一個(gè)全局訪問(wèn)點(diǎn)，用于獲取當(dāng)前請(qǐng)求的安全上下文。
// SecurityContext 是當(dāng)前線程的安全上下文，包含了當(dāng)前用戶(hù)的認(rèn)證信息（即 Authentication 對(duì)象）。
SecurityContext context = SecurityContextHolder.getContext();
Authentication authentication = context.getAuthentication();
User user = (User ) authenticate.getPrincipal();
// 另一種獲取 User 的方法
UsernamePasswordAuthenticationToken authenticationToken = (UsernamePasswordAuthenticationToken) SecurityContextHolder.getContext().getAuthentication();
UserDetailsImpl loginUser = (UserDetailsImpl) authenticationToken.getPrincipal();
User user = userDetails.getUser();

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .antMatchers("/admin/**").hasRole("ADMIN")  // 只有 ADMIN 角色可以訪問(wèn)
        .antMatchers("/user/**").hasAnyRole("USER", "ADMIN")  // USER 和 ADMIN 角色可以訪問(wèn)
        .anyRequest().authenticated();  // 其他請(qǐng)求需要認(rèn)證
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .antMatchers("/edit/**").hasAuthority("EDIT_PRIVILEGE")  // 僅具有 EDIT_PRIVILEGE 權(quán)限的用戶(hù)可以訪問(wèn)
        .anyRequest().authenticated();
}

public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
    }
}
// 讓我們實(shí)現(xiàn)的類(lèi)生效
http.formLogin(form ->
                form.successHandler(new MyAuthenticationSuccessHandler()));

public class MyAuthenticationFailureHandler implements AuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
    }
}
// 讓我們實(shí)現(xiàn)的類(lèi)生效
http.formLogin(form ->
        form.failureHandler(new MyAuthenticationFailureHandler()));

public class MyLogoutSuccessHandler implements LogoutSuccessHandler {
    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
    }
}
// 讓我們實(shí)現(xiàn)的類(lèi)生效
http.logout(logout -> {
               logout.logoutSuccessHandler(new MyLogoutSuccessHandler());
           });

// 重寫(xiě) AuthenticationEntryPoint 接口
public class MyAuthenticationEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
    }
}
// 讓我們重寫(xiě)的類(lèi)生效
http.exceptionHandling(exception -> {
    exception.authenticationEntryPoint(new MyAuthenticationEntryPoint());
});

// 重寫(xiě) SessionInformationExpiredStrategy 接口
public class MySessionInformationExpiredStrategy implements SessionInformationExpiredStrategy {
    @Override
    public void onExpiredSessionDetected(SessionInformationExpiredEvent event) throws IOException, ServletException {
    }
}
// 讓我們重寫(xiě)的類(lèi)生效
http.sessionManagement(session -> {
    session.maximumSessions(1).expiredSessionStrategy(new MySessionInformationExpiredStrategy());
});

// 重寫(xiě) AccessDeniedHandler 接口
public class MyAccessDeniedHandler implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, 
                       AccessDeniedException accessDeniedException) throws IOException, ServletException {
    }
}
// 在安全配置中注冊(cè)自定義的 AccessDeniedHandler
http.exceptionHandling(exception -> {
            exception.accessDeniedHandler(new MyAccessDeniedHandler());
        });
});