Spring Security6.3.x的使用指南与注意事项

<dependency>
    <groupid>org.springframework.boot</groupid>
    <artifactid>spring-boot-starter-security</artifactid>
    <version>3.2.0</version> <!-- spring boot 3.2.x 通常包含 spring security 6.3.x -->
</dependency>

import org.springframework.context.annotation.bean;
import org.springframework.context.annotation.configuration;
import org.springframework.security.config.annotation.web.builders.httpsecurity;
import org.springframework.security.config.annotation.web.configuration.enablewebsecurity;
import org.springframework.security.core.userdetails.user;
import org.springframework.security.core.userdetails.userdetails;
import org.springframework.security.core.userdetails.userdetailsservice;
import org.springframework.security.crypto.bcrypt.bcryptpasswordencoder;
import org.springframework.security.crypto.password.passwordencoder;
import org.springframework.security.provisioning.inmemoryuserdetailsmanager;
import org.springframework.security.web.securityfilterchain;
@configuration
@enablewebsecurity // 启用 spring security web 支持
public class securityconfig {
    // 核心配置：定义安全过滤器链 (securityfilterchain)
    @bean
    public securityfilterchain securityfilterchain(httpsecurity http) throws exception {
        http
            // 授权配置 (核心)
            .authorizehttprequests(authorize -> authorize
                .requestmatchers("/", "/home", "/public/**", "/css/**", "/js/**", "/images/**").permitall() // 允许所有人访问
                .requestmatchers("/user/**").hasrole("user") // 需要 user 角色
                .requestmatchers("/admin/**").hasrole("admin") // 需要 admin 角色
                .anyrequest().authenticated() // 其他所有请求都需要认证
            )
            // 表单登录配置
            .formlogin(formlogin -> formlogin
                //.loginpage("/login") // 自定义登录页路径。不指定则使用默认登录页
                .permitall() // 允许所有人访问登录页
                .defaultsuccessurl("/dashboard") // 登录成功后的默认跳转页
            )
            // 退出登录配置
            .logout(logout -> logout
                .logouturl("/logout") // 退出登录的 url (默认也是 /logout)
                .logoutsuccessurl("/login?logout") // 退出成功后的跳转页
                .permitall()
            )
            // 异常处理 (如访问拒绝)
            .exceptionhandling(exceptionhandling -> exceptionhandling
                .accessdeniedpage("/access-denied") // 自定义访问拒绝页
            )
            // 启用 http basic 认证 (可选，常用于 api)
            //.httpbasic(customizer.withdefaults())
            // 启用 csrf 保护 (默认启用，对于 api 可能需要禁用)
            //.csrf(csrf -> csrf.disable()); // 谨慎禁用！
        return http.build();
    }
    // 配置内存用户存储 (仅用于演示/测试，生产环境用数据库)
    @bean
    public userdetailsservice userdetailsservice(passwordencoder passwordencoder) {
        userdetails user = user.builder()
            .username("user")
            .password(passwordencoder.encode("password")) // 必须加密！
            .roles("user")
            .build();
        userdetails admin = user.builder()
            .username("admin")
            .password(passwordencoder.encode("adminpass"))
            .roles("user", "admin")
            .build();
        return new inmemoryuserdetailsmanager(user, admin);
    }
    // 配置密码编码器 (强制要求，不能使用明文！)
    @bean
    public passwordencoder passwordencoder() {
        return new bcryptpasswordencoder(); // 推荐 bcrypt
        // 其他选项： pbkdf2passwordencoder, scryptpasswordencoder, argon2passwordencoder, delegatingpasswordencoder
    }
}

.rememberme(remember -> remember
    .key("uniqueandsecretkey")
    .tokenvalidityseconds(86400) // 1天
)

@service
public class jpauserdetailsservice implements userdetailsservice {
    private final userrepository userrepository;
    public jpauserdetailsservice(userrepository userrepository) {
        this.userrepository = userrepository;
    }
    @override
    public userdetails loaduserbyusername(string username) throws usernamenotfoundexception {
        return userrepository.findbyusername(username)
                .map(securityuser：：new) // 将你的领域用户转换为 userdetails
                .orelsethrow(() -> new usernamenotfoundexception("user not found： " + username));
    }
}

@bean
public passwordencoder passwordencoder() {
    return passwordencoderfactories.createdelegatingpasswordencoder(); // 推荐：支持多种编码，默认 bcrypt
    // 或 return new bcryptpasswordencoder();
}

@configuration
@enablemethodsecurity
public class methodsecurityconfig {
    // ...
}

@service
public class userservice {
    @preauthorize("hasrole('admin') or #id == authentication.principal.id") // spel 示例：允许管理员或用户自己访问
    public user getuserbyid(long id) {
        // ...
    }
    @preauthorize("hasauthority('user_delete')")
    public void deleteuser(long id) {
        // ...
    }
}

<dependency>
    <groupid>org.springframework.boot</groupid>
    <artifactid>spring-boot-starter-oauth2-resource-server</artifactid>
</dependency>

spring.security.oauth2.resourceserver.jwt.issuer-uri=https：//your-auth-server.com/realms/your-realm
# 或者
# spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https：//your-auth-server.com/jwks

@bean
securityfilterchain resourceserversecurityfilterchain(httpsecurity http) throws exception {
    http
        .securitymatcher("/api/**") // 只对 /api/** 路径应用此安全配置
        .authorizehttprequests(authorize -> authorize
            .anyrequest().authenticated() // api 端点都需要认证
        )
        .oauth2resourceserver(oauth2 -> oauth2
            .jwt(customizer.withdefaults()) // 使用 jwt 作为承载令牌格式
            // .opaquetoken(customizer.withdefaults()) // 使用不透明令牌
        );
    return http.build();
}

@getmapping("/api/userinfo")
public map<string, object> getuserinfo(@authenticationprincipal jwt jwt) {
    return map.of(
        "username", jwt.getsubject(),
        "email", jwt.getclaimasstring("email"),
        "scopes", jwt.getclaimasstringlist("scope")
    );
}