Spring Security6.3.x的使用指南与注意事项

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
    <version>3.2.0</version> <!-- Spring Boot 3.2.x 通常包含 Spring Security 6.3.x -->
</dependency>

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
@EnableWebSecurity // 启用 Spring Security Web 支持
public class SecurityConfig {
    // 核心配置：定义安全过滤器链 (SecurityFilterChain)
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            // 授权配置 (核心)
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/", "/home", "/public/**", "/css/**", "/js/**", "/images/**").permitAll() // 允许所有人访问
                .requestMatchers("/user/**").hasRole("USER") // 需要 USER 角色
                .requestMatchers("/admin/**").hasRole("ADMIN") // 需要 ADMIN 角色
                .anyRequest().authenticated() // 其他所有请求都需要认证
            )
            // 表单登录配置
            .formLogin(formLogin -> formLogin
                //.loginPage("/login") // 自定义登录页路径。不指定则使用默认登录页
                .permitAll() // 允许所有人访问登录页
                .defaultSuccessUrl("/dashboard") // 登录成功后的默认跳转页
            )
            // 退出登录配置
            .logout(logout -> logout
                .logoutUrl("/logout") // 退出登录的 URL (默认也是 /logout)
                .logoutSuccessUrl("/login?logout") // 退出成功后的跳转页
                .permitAll()
            )
            // 异常处理 (如访问拒绝)
            .exceptionHandling(exceptionHandling -> exceptionHandling
                .accessDeniedPage("/access-denied") // 自定义访问拒绝页
            )
            // 启用 HTTP Basic 认证 (可选，常用于 API)
            //.httpBasic(Customizer.withDefaults())
            // 启用 CSRF 保护 (默认启用，对于 API 可能需要禁用)
            //.csrf(csrf -> csrf.disable()); // 谨慎禁用！
        return http.build();
    }
    // 配置内存用户存储 (仅用于演示/测试，生产环境用数据库)
    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
        UserDetails user = User.builder()
            .username("user")
            .password(passwordEncoder.encode("password")) // 必须加密！
            .roles("USER")
            .build();
        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder.encode("adminpass"))
            .roles("USER", "ADMIN")
            .build();
        return new InMemoryUserDetailsManager(user, admin);
    }
    // 配置密码编码器 (强制要求，不能使用明文！)
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(); // 推荐 BCrypt
        // 其他选项： Pbkdf2PasswordEncoder, SCryptPasswordEncoder, Argon2PasswordEncoder, DelegatingPasswordEncoder
    }
}

.rememberMe(remember -> remember
    .key("uniqueAndSecretKey")
    .tokenValiditySeconds(86400) // 1天
)

@Service
public class JpaUserDetailsService implements UserDetailsService {
    private final UserRepository userRepository;
    public JpaUserDetailsService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return userRepository.findByUsername(username)
                .map(SecurityUser：：new) // 将你的领域用户转换为 UserDetails
                .orElseThrow(() -> new UsernameNotFoundException("User not found： " + username));
    }
}

@Bean
public PasswordEncoder passwordEncoder() {
    return PasswordEncoderFactories.createDelegatingPasswordEncoder(); // 推荐：支持多种编码，默认 BCrypt
    // 或 return new BCryptPasswordEncoder();
}

@Configuration
@EnableMethodSecurity
public class MethodSecurityConfig {
    // ...
}

@Service
public class UserService {
    @PreAuthorize("hasRole('ADMIN') or #id == authentication.principal.id") // SpEL 示例：允许管理员或用户自己访问
    public User getUserById(Long id) {
        // ...
    }
    @PreAuthorize("hasAuthority('USER_DELETE')")
    public void deleteUser(Long id) {
        // ...
    }
}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>

spring.security.oauth2.resourceserver.jwt.issuer-uri=https：//your-auth-server.com/realms/your-realm
# 或者
# spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https：//your-auth-server.com/jwks

@Bean
SecurityFilterChain resourceServerSecurityFilterChain(HttpSecurity http) throws Exception {
    http
        .securityMatcher("/api/**") // 只对 /api/** 路径应用此安全配置
        .authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated() // API 端点都需要认证
        )
        .oauth2ResourceServer(oauth2 -> oauth2
            .jwt(Customizer.withDefaults()) // 使用 JWT 作为承载令牌格式
            // .opaqueToken(Customizer.withDefaults()) // 使用不透明令牌
        );
    return http.build();
}

@GetMapping("/api/userinfo")
public Map<String, Object> getUserInfo(@AuthenticationPrincipal Jwt jwt) {
    return Map.of(
        "username", jwt.getSubject(),
        "email", jwt.getClaimAsString("email"),
        "scopes", jwt.getClaimAsStringList("scope")
    );
}