@Configuration
public class InMemorySecurityConfig {
    // 手動配置用戶信息
    @Bean
    public UserDetailsService users() {
        UserDetails user = User.withUsername("user")
                .password("{noop}user") // {noop}表示不加密
                .roles("USER")
                .build();
        UserDetails admin = User.withUsername("admin")
                .password("{noop}admin")
                .roles("ADMIN")
                .build();
		//可以繼續(xù)追加其它用戶...
        UserDetails anonymous = User.withUsername("anonymous")
                .password("{noop}anonymous")
                .roles("ANONYMOUS")
                .build();
        return new InMemoryUserDetailsManager(user, admin, anonymous);
    }
    // 配置安全策略 并配置/admin/** 只允許ADMIN角色用戶訪問
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.
                authorizeHttpRequests(authorize -> authorize
                        .requestMatchers("/admin/**").hasRole("ADMIN")
                        .anyRequest().authenticated()
                )
                .formLogin(withDefaults())
                .logout(withDefaults())
        ;
        return http.build();
    }
}

@Controller
public class DemoMemoryController {
    //返回用戶信息及角色權(quán)限
    @GetMapping("/")
    public ResponseEntity<Map<String, Object>> index(Authentication authentication) {
        String username = authentication.getName();//用戶名
        Object principal =authentication.getPrincipal();//身份
        // 獲取用戶擁有的權(quán)限列表
        List<String> roles = authentication.getAuthorities().stream()
                .map(GrantedAuthority::getAuthority)
                .collect(Collectors.toList());
        //返回用戶信息
        return ResponseEntity.ok(Map.of(
                "username", username,
                "principal", principal,
                "roles", roles));
    }
	//測試管理員權(quán)限
    @GetMapping("/admin/view")
    public ResponseEntity<String> admin() {
        return ResponseEntity.ok("管理員ADMIN角色訪問ok");
    }
}

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}
@Bean
public UserDetailsService users(PasswordEncoder encoder) {
    UserDetails user = User.builder()
            .username("user")
            .password(encoder.encode("secret"))
            .roles("USER")
            .build();
    return new InMemoryUserDetailsManager(user);
}

# 不同前綴對應(yīng)不同編碼器
{noop} → NoOpPasswordEncoder (明文)
{bcrypt} → BCryptPasswordEncoder
{pbkdf2} → Pbkdf2PasswordEncoder
{scrypt} → SCryptPasswordEncoder
{sha256} → StandardPasswordEncoder