Spring Security 框架最佳实践

@Override
public UserDetails loadUserByUsername(String username) {
    // 从数据库查用户 → 返回 UserDetails（含加密密码 + 权限）
}

// 注册时：
user.setPassword(passwordEncoder.encode(rawPassword));
// 登录时（框架自动调用）：
passwordEncoder.matches(rawPassword, encodedPassword); // true/false

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
String username = auth.getName();

sequenceDiagram
    participant User
    participant Filter as FilterChain (Spring Security)
    participant Provider as AuthenticationProvider
    participant Service as UserDetailsService
    participant Encoder as PasswordEncoder
    User->>Filter: 提交用户名/密码
    Filter->>Provider: 调用 authenticate()
    Provider->>Service: loadUserByUsername(username)
    Service-->>Provider: 返回 UserDetails（含加密密码）
    Provider->>Encoder: matches(输入密码, 数据库加密密码)
    alt 匹配成功
        Encoder-->>Provider: true
        Provider-->>Filter: 返回认证成功 Authentication
        Filter->>User: 登录成功，跳转
    else 匹配失败
        Encoder-->>Provider: false
        Provider-->>Filter: 抛出异常
        Filter->>User: 登录失败
    end

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/login", "/register", "/css/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")           // 自定义登录页
                .defaultSuccessUrl("/home")    // 登录成功跳转
                .permitAll()
            )
            .logout(logout -> logout
                .logoutSuccessUrl("/login?logout")
                .permitAll()
            );
        return http.build();
    }
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(); // 推荐使用 BCrypt
    }
}

@Component
public class MyUserServiceImpl implements UserDetailsService {
    @Autowired
    private UserMapper userMapper;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userMapper.findUserByName(username);
        if (user == null) throw new UsernameNotFoundException("用户不存在");
        // ✅ 直接返回数据库中的加密密码（注册时已加密存储！）
        return User.builder()
            .username(user.getUsername())
            .password(user.getSupwd()) // ← 不要再 encode!
            .roles("USER") // 或者 .authorities(getAuthorities())
            .build();
    }
}

@Service
public class ArticleService {
    @PreAuthorize("hasRole('ADMIN')") // 需要 ADMIN 角色
    public void deleteArticle(Long id) {
        // ...
    }
    @PreAuthorize("hasAuthority('article:edit')") // 需要具体权限
    public void editArticle(Article article) {
        // ...
    }
    @PostAuthorize("returnObject.owner == authentication.name")
    public Article getArticle(Long id) {
        // 返回后检查：只有文章主人才能看
    }
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity // ← 启用 @PreAuthorize 等注解
public class SecurityConfig { ... }

<!-- 只有 ADMIN 能看到 -->
<div sec:authorize="hasRole('ADMIN')">
    <a href="/admin" rel="external nofollow" >管理后台</a>
</div>
<!-- 显示当前用户名 -->
<span sec:authentication="name"></span>

<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity6</artifactId>
</dependency>

@Component
public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, 
                                        HttpServletResponse response, 
                                        Authentication authentication) throws IOException {
        response.sendRedirect("/home?loginSuccess");
    }
}

.formLogin(form -> form
    .successHandler(mySuccessHandler)
    .failureHandler(myFailureHandler)
)

@Component
public class MyAccessDeniedHandler implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException {
        response.sendRedirect("/403");
    }
}

.exceptionHandling(ex -> ex
    .accessDeniedHandler(myAccessDeniedHandler)
)

src/
├── controller/
│   └── LoginController.java       // 登录页、首页
├── service/
│   └── MyUserServiceImpl.java     // loadUserByUsername
├── config/
│   └── SecurityConfig.java        // 权限配置 + PasswordEncoder
└── entity/
    └── User.java                  // 用户实体（含加密密码字段）