<dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
 
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
 
        <dependency>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>1.3.1</version>
        </dependency>
 
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <scope>runtime</scope>
        </dependency>
 
        <dependency>
            <groupId>com.github.penggle</groupId>
            <artifactId>kaptcha</artifactId>
            <version>2.3.2</version>
        </dependency>
 
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

@Configuration
public class CaptchaConfig {
 
    @Bean
    public Producer captcha() {
        // 配置圖形驗證碼的基本參數(shù)
        Properties properties = new Properties();
        // 圖片寬度
        properties.setProperty("kaptcha.image.wth", "150");
        // 圖片長度
        properties.setProperty("kaptcha.image.height", "50");
        // 字符集
        properties.setProperty("kaptcha.textproducer.char.string", "0123456789");
        // 字符長度
        properties.setProperty("kaptcha.textproducer.char.length", "4");
        Config config = new Config(properties);
        // 使用默認(rèn)的圖形驗證碼實現(xiàn)，當(dāng)然也可以自定義實現(xiàn)
        DefaultKaptcha defaultKaptcha = new DefaultKaptcha();
        defaultKaptcha.setConfig(config);
        return defaultKaptcha;
    }
 
}

@Controller
public class CaptchaController {
 
    @Autowired
    private Producer captchaProducer;
 
    @GetMapping("/captcha.jpg")
    public vo getCaptcha(HttpServletRequest request, HttpServletResponse response) throws IOException {
        // 設(shè)置內(nèi)容類型
        response.setContentType("image/jpeg");
        // 創(chuàng)建驗證碼文本
        String capText = captchaProducer.createText();
        
        // 將驗證碼文本設(shè)置到session
        request.getSession().setAttribute("captcha", capText);
        
        // 創(chuàng)建驗證碼圖片
        BufferedImage bi = captchaProducer.createImage(capText);
        // 獲取響應(yīng)輸出流
        ServletOutputStream out = response.getOutputStream();
        // 將圖片驗證碼數(shù)據(jù)寫到響應(yīng)輸出流
        ImageIO.write(bi, "jpg", out);
        
        // 推送并關(guān)閉響應(yīng)輸出流
        try {
            out.flush();
        } finally {
            out.close();
        }
    }
 
}

public class VerificationCodeException extends AuthenticationException {
 
    public VerificationCodeException() {
        super("圖形驗證碼校驗失敗");
    }
 
}

/**
 * 添加額外的用戶認(rèn)證信息
 */  
public class MyWebAuthenticationDetails extends WebAuthenticationDetails {
 
    private String imageCode;
 
    private String savedImageCode;
 
    public String getImageCode() {
        return imageCode;
    }
 
    public String getSavedImageCode() {
        return savedImageCode;
    }
 
    /**
     * 補充用戶提交的驗證碼和session保存的驗證碼
     */  
    public MyWebAuthenticationDetails(HttpServletRequest request) {
        super(request);
        this.imageCode = request.getParameter("captcha");
        //獲取session對象
        HttpSession session = request.getSession();
        
        this.savedImageCode = (String) session.getAttribute("captcha");
        if (!StringUtils.isEmpty(this.savedImageCode)) {
            // 隨手清除驗證碼，不管是失敗還是成功，所以客戶端應(yīng)在登錄失敗時刷新驗證碼
            session.removeAttribute("captcha");
        }
    }
 
}

@Component
public class MyWebAuthenticationDetailsSource implements AuthenticationDetailsSource<HttpServletRequest,WebAuthenticationDetails> {
 
    /**
     * 創(chuàng)建一個WebAuthenticationDetails對象
     */  
    @Overre
    public WebAuthenticationDetails buildDetails(HttpServletRequest request) {
 
        return new MyWebAuthenticationDetails(request);
    }
 
}

/**
 * 在常規(guī)的數(shù)據(jù)庫認(rèn)證之上,添加圖形驗證碼功能
 */
@Component
public class MyAuthenticationProver extends DaoAuthenticationProver {
 
    /**
     * 構(gòu)造方法注入UserDetailService和PasswordEncoder
     */
    public MyAuthenticationProver(UserDetailsService userDetailsService, PasswordEncoder passwordEncoder) {
        this.setUserDetailsService(userDetailsService);
        this.setPasswordEncoder(passwordEncoder);
    }
 
    /**
     * 在常規(guī)的認(rèn)證之上,添加額外的圖形驗證碼功能
     */
    @Overre
    protected vo additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken) throws AuthenticationException {
        //獲取token令牌中關(guān)聯(lián)的details對象，并將其轉(zhuǎn)換為我們自定義的MyWebAuthenticationDetails
        MyWebAuthenticationDetails details = (MyWebAuthenticationDetails) usernamePasswordAuthenticationToken.getDetails();
        String imageCode = details.getImageCode();
        String savedImageCode = details.getSavedImageCode();
        
        // 檢驗圖形驗證碼
        if (StringUtils.isEmpty(imageCode) || StringUtils.isEmpty(savedImageCode) || !imageCode.equals(savedImageCode)) {
            throw new VerificationCodeException();
        }
 
        //在正常的認(rèn)證檢查之前，添加額外的關(guān)于圖形驗證碼的校驗
        super.additionalAuthenticationChecks(userDetails, usernamePasswordAuthenticationToken);
    }
 
}

@SuppressWarnings("all")
@EnableWebSecurity(debug = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
    @Autowired
    private AuthenticationDetailsSource<HttpServletRequest, WebAuthenticationDetails> myWebAuthenticationDetailsSource;
 
    @Autowired
    private AuthenticationProver authenticationProver;
 
    @Overre
    protected vo configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/admin/api/**")
                .hasRole("ADMIN")
                .antMatchers("/user/api/**")
                .hasRole("USER")
                .antMatchers("/app/api/**", "/captcha.jpg")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
            	//這里關(guān)聯(lián)配置自定義的AuthenticationDetailsSource
                .authenticationDetailsSource(myWebAuthenticationDetailsSource)
                .failureHandler(new SecurityAuthenticationFailureHandler())
                .successHandler(new SecurityAuthenticationSuccessHandler())
                .loginPage("/myLogin.html")
                .loginProcessingUrl("/login")
                .permitAll()
                .and()
                .csrf()
                .disable();
    }
 
    //在這里關(guān)聯(lián)我們自定義的AuthenticationProver
    @Overre
    protected vo configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProver(authenticationProver);
    }
 
    @Bean
    public PasswordEncoder passwordEncoder() {
 
        return NoOpPasswordEncoder.getInstance();
    }
 
}

<body>
        <div class="login">
            <h2>Access Form</h2>
            <div class="login-top">
                <h1>登錄驗證</h1>
                <form action="/login" method="post">
                    <input type="text" name="username" placeholder="username" />
                    <input type="password" name="password" placeholder="password" />
                    <div style="display: flex;">
                        <!-- 新增圖形驗證碼的輸入框 -->
                        <input type="text" name="captcha" placeholder="captcha" />
                        <!-- 圖片指向圖形驗證碼API -->
                        <img src="/captcha.jpg" alt="captcha" height="50px" wth="150px" style="margin-left: 20px;">
                    </div>
                    <div class="forgot">
                        <a href="#" rel="external nofollow"  rel="external nofollow" >忘記密碼</a>
                        <input type="submit" value="登錄" >
                    </div>
                </form>
            </div>
            <div class="login-bottom">
                <h3>新用戶&nbsp;<a href="#" rel="external nofollow"  rel="external nofollow" >注&nbsp;冊</a></h3>
            </div>
        </div>
    </body>