<dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
 <groupId>com.fasterxml.jackson.core</groupId>
 <artifactId>jackson-core</artifactId>
 <version>2.12.1</version>
</dependency>
<dependency>
 <groupId>com.auth0</groupId>
 <artifactId>java-jwt</artifactId>
 <version>3.12.1</version>
</dependency>

@Data
public class User implements UserDetails {

 private static final long serialVersionUID = 1L;

 private String username;

 private String password;

 private Collection<? extends GrantedAuthority> authorities;

 ...
}

@Service
public class UserService implements UserDetailsService {
 
 @Autowired
 UserMapper userMapper;

 @Override
 @Transactional
 public User loadUserByUsername(String username) {
  return userMapper.getByUsername(username);
 }

 ...
}

@Component
public class JwtTokenProvider {

 private static final long JWT_EXPIRATION = 5 * 60 * 1000L; // 五分鐘過(guò)期

 public static final String TOKEN_PREFIX = "Bearer "; // token 的開(kāi)頭字符串

 private String jwtSecret = "XXX 密鑰，打死也不能告訴別人";

 ...
}

public String generateToken(Authentication authentication) {
 User userPrincipal = (User) authentication.getPrincipal(); // 獲取用戶(hù)對(duì)象
 Date expireDate = new Date(System.currentTimeMillis() + JWT_EXPIRATION); // 設(shè)置過(guò)期時(shí)間
 try {
  Algorithm algorithm = Algorithm.HMAC256(jwtSecret); // 指定加密方式
  return JWT.create().withExpiresAt(expireDate).withClaim("username", userPrincipal.getUsername()) 
    .sign(algorithm); // 簽發(fā) JWT
 } catch (JWTCreationException jwtCreationException) {
  return null;
 }
}

public boolean validateToken(String authToken) {
 try {
  Algorithm algorithm = Algorithm.HMAC256(jwtSecret); // 和簽發(fā)保持一致
  JWTVerifier verifier = JWT.require(algorithm).build();
  verifier.verify(authToken);
  return true;
 } catch (JWTVerificationException jwtVerificationException) {
  return false;
 }
}

public String getUsernameFromJWT(String authToken) {
 try {
  DecodedJWT jwt = JWT.decode(authToken);
  return jwt.getClaim("username").asString();
 } catch (JWTDecodeException jwtDecodeException) {
  return null;
 }
}

public class LoginFilter extends UsernamePasswordAuthenticationFilter {

 @Override
 public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
  if (!request.getMethod().equals("POST")) {
   throw new AuthenticationServiceException("登錄接口方法不支持: " + request.getMethod());
  }
  if (request.getContentType().equals(MediaType.APPLICATION_JSON_VALUE)) {
   Map<String, String> loginData = new HashMap<>();
   try {
    loginData = new ObjectMapper().readValue(request.getInputStream(), Map.class);
   } catch (IOException e) {
   }
   String username = loginData.get(getUsernameParameter());
   String password = loginData.get(getPasswordParameter());
   if (username == null) {
    username = "";
   }
   if (password == null) {
    password = "";
   }
   username = username.trim();
   UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username,
     password);
   setDetails(request, authRequest);
   return this.getAuthenticationManager().authenticate(authRequest);
  } else {
   return super.attemptAuthentication(request, response);
  }
 }

}

@Component
public class LoginSuccessHandler implements AuthenticationSuccessHandler {

 @Autowired
 private JwtTokenProvider jwtTokenProvider;

 @Override
 public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
   Authentication authentication) throws IOException, ServletException {

  ResponseData responseData = new ResponseData();
  String token = jwtTokenProvider.generateToken(authentication);
  responseData.setData(JwtTokenProvider.TOKEN_PREFIX + token);
  response.setContentType("application/json;charset=utf-8");
  ObjectMapper mapper = new ObjectMapper();
  mapper.writeValue(response.getWriter(), responseData);
 }

}

@Component
public class LoginFailureHandler implements AuthenticationFailureHandler {

 @Override
 public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
   AuthenticationException exception) throws IOException, ServletException {
  response.setContentType("application/json;charset=utf-8");
  ResponseData respBean = setResponseData(exception);
  ObjectMapper mapper = new ObjectMapper();
  mapper.writeValue(response.getWriter(), respBean);
 }

 private ResponseData setResponseData(AuthenticationException exception) {
  if (exception instanceof LockedException) {
   return ResponseData.build("用戶(hù)已被鎖定");
  } else if (exception instanceof CredentialsExpiredException) {
   return ResponseData.build("密碼已過(guò)期");
  } else if (exception instanceof AccountExpiredException) {
   return ResponseData.build("用戶(hù)名已過(guò)期");
  } else if (exception instanceof DisabledException) {
   return ResponseData.build("賬戶(hù)不可用");
  } else if (exception instanceof BadCredentialsException) {
   return ResponseData.build("驗(yàn)證失敗");
  }
  return ResponseData.build("登錄失敗，請(qǐng)聯(lián)系管理員");
 }

}

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

 @Autowired
 private JwtTokenProvider jwtProvider;

 @Override
 protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
   throws ServletException, IOException {
  try {
   String jwt = getJwtFromRequest(request);
   UsernamePasswordAuthenticationToken authentication = verifyToken(jwt);
   if (authentication != null) {
    authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
   }
   SecurityContextHolder.getContext().setAuthentication(authentication);
  } catch (Exception e) {
   logger.error("無(wú)法給 Security 上下文設(shè)置用戶(hù)驗(yàn)證對(duì)象", e);
  }

  filterChain.doFilter(request, response);
 }

 private String getJwtFromRequest(HttpServletRequest request) {
  String bearerToken = request.getHeader("Authorization");
  if (bearerToken == null || !bearerToken.startsWith(JwtTokenProvider.TOKEN_PREFIX)) {
   logger.info("請(qǐng)求頭不含 JWT token，調(diào)用下個(gè)過(guò)濾器");
   return null;
  }

  return bearerToken.split(" ")[1].trim();
 }

 // 驗(yàn)證token，并生成認(rèn)證后的token
 private UsernamePasswordAuthenticationToken verifyToken(String token) {
  if (token == null) {
   return null;
  }
  // 認(rèn)證失敗，返回null
  if (!jwtProvider.validateToken(token)) {
   return null;
  }
  // 提取用戶(hù)名
  String username = jwtProvider.getUsernameFromJWT(token);
  UserDetails userDetails = new User(username);

  // 構(gòu)建認(rèn)證過(guò)的token
  return new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
 }
}

@Component
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {

 private static final Logger logger = LoggerFactory.getLogger(JwtAuthenticationEntryPoint.class);
 
 @Override
 public void commence(HttpServletRequest request, HttpServletResponse response,
   AuthenticationException authException) throws IOException, ServletException {
  logger.error("驗(yàn)證為通過(guò). 提示信息 - {}", authException.getMessage());
  response.sendError(HttpServletResponse.SC_UNAUTHORIZED, authException.getMessage());
 }

}

@Configuration
@EnableWebSecurity
public class KanpmSecurityConfig extends WebSecurityConfigurerAdapter {

 @Autowired
 UserDetailsService userDetailsService;

 @Autowired
 private JwtAuthenticationEntryPoint unauthorizedHandler;

 @Autowired
 private JwtAuthenticationFilter jwtAuthenticationFilter;

 @Bean
 public LoginFilter loginFilter(LoginSuccessHandler loginSuccessHandler, LoginFailureHandler loginFailureHandler)
   throws Exception {
  LoginFilter loginFilter = new LoginFilter();
  loginFilter.setAuthenticationSuccessHandler(loginSuccessHandler);
  loginFilter.setAuthenticationFailureHandler(loginFailureHandler);
  loginFilter.setAuthenticationManager(authenticationManagerBean());
  loginFilter.setFilterProcessesUrl("/auth/login");
  return loginFilter;
 }

 @Bean
 @Override
 public AuthenticationManager authenticationManagerBean() throws Exception {
  return super.authenticationManagerBean();
 }

 @Bean
 public PasswordEncoder passwordEncoder() {
  return new BCryptPasswordEncoder();
 }

 ...
}

@Override
public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
 authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}

@Override
protected void configure(HttpSecurity http) throws Exception {
 http.csrf().disable().anyRequest().authenticated().and()
   .exceptionHandling().authenticationEntryPoint(unauthorizedHandler);

 http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
 .addFilterAt(loginFilter(new LoginSuccessHandler(), new LoginFailureHandler()),
   UsernamePasswordAuthenticationFilter.class);
}