<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
    <version>3.2.0</version> <!-- Spring Boot 3.2.x 通常包含 Spring Security 6.3.x -->
</dependency>

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
@EnableWebSecurity // 啟用 Spring Security Web 支持
public class SecurityConfig {
    // 核心配置：定義安全過濾器鏈 (SecurityFilterChain)
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            // 授權(quán)配置 (核心)
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/", "/home", "/public/**", "/css/**", "/js/**", "/images/**").permitAll() // 允許所有人訪問
                .requestMatchers("/user/**").hasRole("USER") // 需要 USER 角色
                .requestMatchers("/admin/**").hasRole("ADMIN") // 需要 ADMIN 角色
                .anyRequest().authenticated() // 其他所有請求都需要認(rèn)證
            )
            // 表單登錄配置
            .formLogin(formLogin -> formLogin
                //.loginPage("/login") // 自定義登錄頁路徑。不指定則使用默認(rèn)登錄頁
                .permitAll() // 允許所有人訪問登錄頁
                .defaultSuccessUrl("/dashboard") // 登錄成功后的默認(rèn)跳轉(zhuǎn)頁
            )
            // 退出登錄配置
            .logout(logout -> logout
                .logoutUrl("/logout") // 退出登錄的 URL (默認(rèn)也是 /logout)
                .logoutSuccessUrl("/login?logout") // 退出成功后的跳轉(zhuǎn)頁
                .permitAll()
            )
            // 異常處理 (如訪問拒絕)
            .exceptionHandling(exceptionHandling -> exceptionHandling
                .accessDeniedPage("/access-denied") // 自定義訪問拒絕頁
            )
            // 啟用 HTTP Basic 認(rèn)證 (可選，常用于 API)
            //.httpBasic(Customizer.withDefaults())
            // 啟用 CSRF 保護(hù) (默認(rèn)啟用，對于 API 可能需要禁用)
            //.csrf(csrf -> csrf.disable()); // 謹(jǐn)慎禁用！
        return http.build();
    }
    // 配置內(nèi)存用戶存儲 (僅用于演示/測試，生產(chǎn)環(huán)境用數(shù)據(jù)庫)
    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
        UserDetails user = User.builder()
            .username("user")
            .password(passwordEncoder.encode("password")) // 必須加密！
            .roles("USER")
            .build();
        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder.encode("adminpass"))
            .roles("USER", "ADMIN")
            .build();
        return new InMemoryUserDetailsManager(user, admin);
    }
    // 配置密碼編碼器 (強(qiáng)制要求，不能使用明文！)
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(); // 推薦 BCrypt
        // 其他選項(xiàng)： Pbkdf2PasswordEncoder, SCryptPasswordEncoder, Argon2PasswordEncoder, DelegatingPasswordEncoder
    }
}

.rememberMe(remember -> remember
    .key("uniqueAndSecretKey")
    .tokenValiditySeconds(86400) // 1天
)

@Service
public class JpaUserDetailsService implements UserDetailsService {
    private final UserRepository userRepository;
    public JpaUserDetailsService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return userRepository.findByUsername(username)
                .map(SecurityUser：：new) // 將你的領(lǐng)域用戶轉(zhuǎn)換為 UserDetails
                .orElseThrow(() -> new UsernameNotFoundException("User not found： " + username));
    }
}

@Bean
public PasswordEncoder passwordEncoder() {
    return PasswordEncoderFactories.createDelegatingPasswordEncoder(); // 推薦：支持多種編碼，默認(rèn) BCrypt
    // 或 return new BCryptPasswordEncoder();
}

@Configuration
@EnableMethodSecurity
public class MethodSecurityConfig {
    // ...
}

@Service
public class UserService {
    @PreAuthorize("hasRole('ADMIN') or #id == authentication.principal.id") // SpEL 示例：允許管理員或用戶自己訪問
    public User getUserById(Long id) {
        // ...
    }
    @PreAuthorize("hasAuthority('USER_DELETE')")
    public void deleteUser(Long id) {
        // ...
    }
}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>

spring.security.oauth2.resourceserver.jwt.issuer-uri=https：//your-auth-server.com/realms/your-realm
# 或者
# spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https：//your-auth-server.com/jwks

@Bean
SecurityFilterChain resourceServerSecurityFilterChain(HttpSecurity http) throws Exception {
    http
        .securityMatcher("/api/**") // 只對 /api/** 路徑應(yīng)用此安全配置
        .authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated() // API 端點(diǎn)都需要認(rèn)證
        )
        .oauth2ResourceServer(oauth2 -> oauth2
            .jwt(Customizer.withDefaults()) // 使用 JWT 作為承載令牌格式
            // .opaqueToken(Customizer.withDefaults()) // 使用不透明令牌
        );
    return http.build();
}

@GetMapping("/api/userinfo")
public Map<String, Object> getUserInfo(@AuthenticationPrincipal Jwt jwt) {
    return Map.of(
        "username", jwt.getSubject(),
        "email", jwt.getClaimAsString("email"),
        "scopes", jwt.getClaimAsStringList("scope")
    );
}