springsecurity6配置自定义路径身份认证的实现

package com.example.springscuritydemo.config;

import com.example.springscuritydemo.service.myservice;
import jakarta.servlet.http.httpservletrequest;
import org.springframework.security.authorization.authorizationdecision;
import org.springframework.security.authorization.authorizationmanager;
import org.springframework.security.core.authentication;
import org.springframework.security.web.access.intercept.requestauthorizationcontext;

import java.util.function.supplier;

public class customauthorizationmanager implements authorizationmanager<requestauthorizationcontext> {

    private final myservice myservice;

    public customauthorizationmanager(myservice myservice) {
        this.myservice = myservice;
    }

    @override
    public authorizationdecision check(supplier<authentication> authentication, requestauthorizationcontext context) {
        httpservletrequest request = context.getrequest();
        authentication auth = authentication.get();
        if (auth == null) {
            return new authorizationdecision(false);
        }
        return new authorizationdecision(myservice.haspermission(request, auth));
    }
}

package com.example.springscuritydemo.service;

import jakarta.servlet.http.httpservletrequest;
import org.springframework.security.core.authentication;

public interface myservice {
    boolean haspermission(httpservletrequest request, authentication authentication);
}

package com.example.springscuritydemo.service.impl;

import com.example.springscuritydemo.service.myservice;
import jakarta.servlet.http.httpservletrequest;
import org.springframework.security.core.authentication;
import org.springframework.security.core.grantedauthority;
import org.springframework.security.core.authority.simplegrantedauthority;
import org.springframework.security.core.userdetails.userdetails;
import org.springframework.stereotype.service;

import java.util.collection;
@service
public class myserviceimpl implements myservice {
    @override
    public boolean haspermission(httpservletrequest request, authentication authentication) {
        object obj = authentication.getprincipal();
        if (obj instanceof userdetails) {
            userdetails userdetails = (userdetails) obj;
            collection<? extends grantedauthority> authorities = userdetails.getauthorities();
            boolean contains = authorities.contains(new simplegrantedauthority(request.getrequesturi()));
            return contains;
        }
        return false;
    }
}

package com.example.springscuritydemo.config;

import com.example.springscuritydemo.handle.myaccessdeniedhandler;
import com.example.springscuritydemo.handle.myauthenticationsuccesshandler;
import com.example.springscuritydemo.service.myservice;
import org.springframework.beans.factory.annotation.autowired;
import org.springframework.context.annotation.bean;
import org.springframework.context.annotation.configuration;
import org.springframework.security.config.annotation.web.builders.httpsecurity;
import org.springframework.security.config.annotation.web.configuration.enablewebsecurity;
import org.springframework.security.crypto.bcrypt.bcryptpasswordencoder;
import org.springframework.security.crypto.password.passwordencoder;
import org.springframework.security.web.securityfilterchain;
import org.springframework.security.web.access.expression.webexpressionauthorizationmanager;

@enablewebsecurity
@configuration
public class securityconfig{
    @autowired
    private myaccessdeniedhandler myaccessdeniedhandler;
//    @autowired
//    private myauthenticationfailurehandler myauthenticationfailurehandler;
    private final myservice myservice;

    public securityconfig(myservice myservice) {
        this.myservice = myservice;
    }
    @bean
    public passwordencoder passwordencoder() {
        return new bcryptpasswordencoder();
    }
    @bean
    securityfilterchain securityfilterchain(httpsecurity http) throws exception {

        return  http
                .formlogin(formlogin -> formlogin.loginpage("/login.html")

                        .loginprocessingurl("/login")
                        //.successforwardurl("/tomain")
                        .successhandler(new myauthenticationsuccesshandler("/main.html"))
                         .failureurl("/toerror")
                        //.failurehandler(new myauthenticationfailurehandler("/error.html"))

                )
                .authorizehttprequests(auth -> auth.requestmatchers("/toerror","/login.html","/error.html").permitall()
                                //需要认证才能访问,是security的认证。不是jwt的认证登录后访问
                                
                        .requestmatchers("/js/**","/css/**","/img/**").permitall()

                        .requestmatchers("main1.html")
                        .access(new webexpressionauthorizationmanager("isauthenticated() and hasipaddress('192.168.10.6')"))

                        //其他路径需要身份认证
//                        .anyrequest().authenticated()
                                .anyrequest().access(new customauthorizationmanager(myservice))
                )
                .csrf(httpsecuritycsrfconfigurer -> httpsecuritycsrfconfigurer.disable())
                // 构建并返回安全过滤链
                .build();
    }

}