飞天班第13节：SpringSecurity权限控制

protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests(authorize -> authorize
            .anyRequest().authenticated()
        )
        .formLogin(withDefaults())
        .httpBasic(withDefaults());
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

	// 定义授权规则
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		// htpp的方法基本分为4个类别：过滤器，登录注销规则，安全配置，OAuth2配置
		// 一般我们只配置规则即可
		// 首页允许所有人访问
		http.authorizeRequests().antMatchers("/").permitAll()
			.antMatchers("/level1/**").hasRole("vip1")
			.antMatchers("/level2/**").hasRole("vip2")
			.antMatchers("/level3/**").hasRole("vip3");
	}
}

http.formLogin();

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

	// 授权规则
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		// htpp的方法基本分为4个类别：过滤器，登录注销规则，安全配置，OAuth2配置
		// 一般我们只配置规则即可
		// 首页允许所有人访问
		http.authorizeRequests().antMatchers("/").permitAll()
			.antMatchers("/level1/**").hasRole("vip1")
			.antMatchers("/level2/**").hasRole("vip2")
			.antMatchers("/level3/**").hasRole("vip3");

//		表单登录用户和密码的默认参数名是username和password
//		默认的登录页请求是/login(Get请求)
//		默认的提交登录请求是/login(Post请求)
//		认证失败默认会跳转到/login?error(Get请求)
		http.formLogin();
	}

	// 认证用户
	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
		// 内存中定义用户
		auth.inMemoryAuthentication()
				.withUser("jude").password("123456").roles("vip1","vip2","vip3")
				.and()
				.withUser("guest").password("123456").roles("vip1");
	}
}

// 认证用户
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  // 内存中定义用户
  auth.inMemoryAuthentication()
    .withUser("jude").password(new BCryptPasswordEncoder(11).encode("123456")).roles("vip1","vip2","vip3")
    .and()
    .withUser("guest").password(new BCryptPasswordEncoder(11).encode("123456")).roles("vip1");
}

// 认证用户
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  // 内存中定义用户信息,指定加密方式，要前后一致
  auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder(11))
    .withUser("jude").password(new BCryptPasswordEncoder(11).encode("123456")).roles("vip1","vip2","vip3")
    .and()
    .withUser("guest").password(new BCryptPasswordEncoder(11).encode("123456")).roles("vip1");
}
}

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
   @Autowired
    UserServiceImpl userService;
  
  	//请求授权验证
    @Override
    protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                .antMatchers("/","/index","/favicon.ico","/bootstrap/**","/css/**","/editormd/**","/images/**","/js/**","/layer/**").permitAll()
                .antMatchers("/register","/toLogin","/login").permitAll()
                .antMatchers("/swagger-ui.html","/v2/api-docs","/swagger-resources/**").permitAll() // 默认UI的swagger请求
                .antMatchers("/doc.html").permitAll() // bootstrap-ui 的请求
                .antMatchers("/**").authenticated();   // 其他请求登录后可以访问
      
      // 登录配置
        http.formLogin()
                .usernameParameter("username")
                .passwordParameter("password")
                .loginPage("/toLogin")
                .loginProcessingUrl("/login") // 登陆表单提交请求
                .defaultSuccessUrl("/index"); // 设置默认登录成功后跳转的页面

        // 注销配置
        http.headers().contentTypeOptions().disable();
        http.headers().frameOptions().disable(); // 图片跨域
        http.csrf().disable();// 关闭csrf功能:跨站请求伪造,默认只能通过post方式提交logout请求
        http.logout().logoutSuccessUrl("/"); // 注销成功跳转到首页

        // 记住我配置
        http.rememberMe().rememberMeParameter("remember");
    } 
    
  	// 用户认证验证
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
       auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
    }

    // 密码加密方式
    @Bean
    public PasswordEncoder passwordEncoder(){
       return new BCryptPasswordEncoder();
    }
}  

import org.springframework.security.core.userdetails.UserDetailsService;

@Service
public class UserServiceImpl extends ServiceImpl<UserMapper, User> implements UserService,UserDetailsService {
    @Autowired
    UserService userService;
    @Autowired
    UserRoleService roleService;
    @Autowired
    HttpSession session;

    // 用户登录逻辑和验证处理
    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
        // 通过用户名查询用户
        User user = userService.getOne(new QueryWrapper<User>().eq("username", s));

        // 放入session
        session.setAttribute("loginUser",user);

        //创建一个新的UserDetails对象，最后验证登陆的需要
        UserDetails userDetails=null;
        if(user!=null){
            //System.out.println("未加密："+user.getPassword());
            //String BCryptPassword = new BCryptPasswordEncoder().encode(user.getPassword());
            // 登录后会将登录密码进行加密，然后比对数据库中的密码，数据库密码需要加密存储！
            String password = user.getPassword();

            //创建一个集合来存放权限
            Collection<GrantedAuthority> authorities = getAuthorities(user);
            //实例化UserDetails对象
            userDetails=new org.springframework.security.core.userdetails.User(s,password,
                            true,
                            true,
                            true,
                            true, authorities);
        }
        return userDetails;
    }

    // 获取角色信息
    private Collection<GrantedAuthority> getAuthorities(User user){
        List<GrantedAuthority> authList = new ArrayList<GrantedAuthority>();
        UserRole role = roleService.getById(user.getRoleId());
        //注意：这里每个权限前面都要加ROLE_。否在最后验证不会通过
        authList.add(new SimpleGrantedAuthority("ROLE_"+role.getName()));
        return authList;
    }

public class RoleBasedVoter implements AccessDecisionVoter<Object> {
    @Override
    public boolean supports(ConfigAttribute configAttribute) {
        return true;
    }

    @Override
    public boolean supports(Class<?> aClass) {
        return true;
    }

    @Override
    public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
        if(authentication == null) { // 用户认证信息为空
            return ACCESS_DENIED;   // 禁止访问 -1
        }
      	// 请求的URL
        FilterInvocation fi = (FilterInvocation) object;
        String url = fi.getRequestUrl();
        // 放行的url
        if(url.startsWith("/register") || url.startsWith("/login") || url.startsWith("/toLogin")){
            return ACCESS_GRANTED;
        }
        int result = ACCESS_ABSTAIN; // 放弃 0
        // 当前认证用户的角色权限集合，都是ROLE_ 开头
        Collection<? extends GrantedAuthority> authorities = extractAuthorities(authentication);

        // 从Redis或者DB动态加载当前url的访问ROLE,add到attributes，实现动态
        attributes.addAll(SecurityConfig.createList("ROLE_1","ROLE_2","ROLE_3"));

        for (ConfigAttribute attribute : attributes) {
            if(attribute.getAttribute()==null){
                continue;
            }
            if (this.supports(attribute)) {
                result = ACCESS_DENIED;

                // Attempt to find a matching granted authority
                for (GrantedAuthority authority : authorities) {
                    if (attribute.getAttribute().equals(authority.getAuthority())) {
                        return ACCESS_GRANTED; // 已授权 1
                    }
                }
            }
        }
        return result;
    }

    private Collection<? extends GrantedAuthority> extractAuthorities(
            Authentication authentication) {
        return authentication.getAuthorities();
    }
}

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    UserServiceImpl userService;

    //请求授权验证
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // .denyAll();    //拒绝访问
        // .authenticated();    //需认证通过
        // .permitAll();    //无条件允许访问
        // 访问权限
        http.authorizeRequests()
                .antMatchers("/","/index").permitAll()
                .antMatchers("/register","/login","/toLogin").permitAll()
                .antMatchers("/*").authenticated();
      
        http.authorizeRequests().accessDecisionManager(accessDecisionManager()); 

        // 登录配置
        http.formLogin()
                .usernameParameter("username")
                .passwordParameter("password")
                .loginPage("/toLogin")
                .loginProcessingUrl("/login") // 登陆表单提交请求
                .defaultSuccessUrl("/index"); // 设置默认登录成功后跳转的页面

        // 注销配置
        http.headers().contentTypeOptions().disable();
        http.headers().frameOptions().disable(); // 图片跨域
        http.csrf().disable();// 关闭csrf功能:跨站请求伪造,默认只能通过post方式提交logout请求
        http.logout().logoutSuccessUrl("/"); // 注销成功跳转到首页

        // 记住我配置
        http.rememberMe().rememberMeParameter("remember");
    }

    // 用户认证验证
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
    }

    // 密码加密方式
    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AccessDecisionManager accessDecisionManager() {
        List<AccessDecisionVoter<? extends Object>> decisionVoters
                = Arrays.asList(
                new WebExpressionVoter(),
                new RoleBasedVoter(),
                new AuthenticatedVoter());
        return new UnanimousBased(decisionVoters);
    }

// 从Redis或者DB动态加载当前url的访问ROLE,add到attributes，实现动态
attributes.addAll(SecurityConfig.createList("ROLE_管理员","ROLE_2","ROLE_3"));

public class WebSecurity {
    public boolean check(Authentication authentication, HttpServletRequest request) {
        if(authentication == null) { // 用户认证信息为空
            return false;   // 禁止访问 -1
        }
        // 请求的URI
        String uri = request.getRequestURI();

        // 当前认证用户的角色权限集合，都是ROLE_ 开头
        Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
        // 从Redis或者DB动态加载当前访问的URI 查询对应的ROLE,add到attributes，实现动态
        List<ConfigAttribute> attributes = SecurityConfig.createList("ROLE_1","ROLE_2","ROLE_3");

        for (ConfigAttribute attribute : attributes) {
            if(attribute.getAttribute()==null){
                continue;
            }
            // Attempt to find a matching granted authority
            for (GrantedAuthority authority : authorities) {
                if (attribute.getAttribute().equals(authority.getAuthority())) {
                    return true; // 已授权 1
                }
            }
        }
        return false;
    }
}

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    UserServiceImpl userService;

    //请求授权验证
    @Override
    protected void configure(HttpSecurity http) throws Exception {

        // .denyAll();    //拒绝访问
        // .authenticated();    //需认证通过
        // .permitAll();    //无条件允许访问
        // 访问权限
        http.authorizeRequests()
                .antMatchers("/","/index").permitAll()
                .antMatchers("/register","/login","/toLogin").permitAll()
                .antMatchers("/swagger-ui.html","/v2/api-docs","/swagger-resources/**").permitAll() // 默认UI的swagger请求
                .antMatchers("/doc.html").permitAll() // bootstrap-ui 的请求
                .antMatchers("/*").authenticated();   // 其他请求登录后可以访问

        http.authorizeRequests().antMatchers("/*").access("@webSecurity.check(authentication,request)");
        
        // 登录配置
        http.formLogin()
                .usernameParameter("username")
                .passwordParameter("password")
                .loginPage("/toLogin")
                .loginProcessingUrl("/login") // 登陆表单提交请求
                .defaultSuccessUrl("/index"); // 设置默认登录成功后跳转的页面

        // 注销配置
        http.headers().contentTypeOptions().disable();
        http.headers().frameOptions().disable(); // 图片跨域
        http.csrf().disable();// 关闭csrf功能:跨站请求伪造,默认只能通过post方式提交logout请求
        http.logout().logoutSuccessUrl("/"); // 注销成功跳转到首页

        // 记住我配置
        http.rememberMe().rememberMeParameter("remember");
    }

    // 用户认证验证
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
    }

    // 密码加密方式
    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

    @Bean
    public WebSecurity webSecurity(){
        return new WebSecurity();
    }
}

 List<ConfigAttribute> attributes = SecurityConfig.createList("ROLE_管理员","ROLE_2","ROLE_3");

public class MyFilterInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
    private FilterInvocationSecurityMetadataSource  superMetadataSource;
     private final AntPathMatcher antPathMatcher = new AntPathMatcher();
    
    // 这里的需要从DB或者Redis加载
    private  Map<String,String> urlRoleMap = new HashMap<String,String>();

    public MyFilterInvocationSecurityMetadataSource(FilterInvocationSecurityMetadataSource expressionBasedFilterInvocationSecurityMetadataSource){
        this.superMetadataSource = expressionBasedFilterInvocationSecurityMetadataSource;
        // TODO 从数据库加载权限配置,就是urlRoleMap
        urlRoleMap.put("/open/**","ROLE_ANONYMOUS");
        urlRoleMap.put("/health","ROLE_ANONYMOUS");
        urlRoleMap.put("/restart","ROLE_ADMIN");
        urlRoleMap.put("/demo","ROLE_USER");
    }

    @Override
    public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
        FilterInvocation fi = (FilterInvocation) object;
        String url = fi.getRequestUrl();

        for(Map.Entry<String,String> entry:urlRoleMap.entrySet()){
            if(antPathMatcher.match(entry.getKey(),url)){ // 获取当前请求url的访问角色
                return org.springframework.security.access.SecurityConfig.createList(entry.getValue());
            }
        }

        // 返回代码定义的默认配置,
        return superMetadataSource.getAttributes(object);
    }

    @Override
    public Collection<ConfigAttribute> getAllConfigAttributes() {
        return null;
    }

    @Override
    public boolean supports(Class<?> aClass) {
        return FilterInvocation.class.isAssignableFrom(aClass);
    }
}

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    UserServiceImpl userService;

    //请求授权验证
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 访问权限
        http.authorizeRequests()
                .antMatchers("/","/index").permitAll()
                .antMatchers("/register","/login","/toLogin").permitAll()
                .withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() {
                    @Override
                    public <O extends FilterSecurityInterceptor> O postProcess(O fsi) {
                        fsi.setSecurityMetadataSource(mySecurityMetadataSource(fsi.getSecurityMetadataSource()));
                        return fsi;
                    }
                });
      // 登录配置
        http.formLogin()
                .usernameParameter("username")
                .passwordParameter("password")
                .loginPage("/toLogin")
                .loginProcessingUrl("/login") // 登陆表单提交请求
                .defaultSuccessUrl("/index"); // 设置默认登录成功后跳转的页面

        // 注销配置
        http.headers().contentTypeOptions().disable();
        http.headers().frameOptions().disable(); // 图片跨域
        http.csrf().disable();// 关闭csrf功能:跨站请求伪造,默认只能通过post方式提交logout请求
        http.logout().logoutSuccessUrl("/"); // 注销成功跳转到首页

        // 记住我配置
        http.rememberMe().rememberMeParameter("remember");
    }
  
  // 用户认证验证
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
    }

    // 密码加密方式
    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }
  
    @Bean
    public MyFilterInvocationSecurityMetadataSource mySecurityMetadataSource(FilterInvocationSecurityMetadataSource filterInvocationSecurityMetadataSource) {
        MyFilterInvocationSecurityMetadataSource securityMetadataSource = new MyFilterInvocationSecurityMetadataSource(filterInvocationSecurityMetadataSource);
        return securityMetadataSource;
    }
}      

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {    
  @Autowired
  private DataSource dataSource;

  @Bean
  UserDetailsService myUserDetailService() {
    return new MyUserDetailsService();
  }

  @Bean
  public PersistentTokenRepository persistentTokenRepository() {
    JdbcTokenRepositoryImpl persistentTokenRepository = new JdbcTokenRepositoryImpl();
    persistentTokenRepository.setDataSource(dataSource);
    return persistentTokenRepository;
  }
}

create table persistent_logins (
  username varchar(64) not null, 
  series varchar(64) primary key, 
	token varchar(64) not null, 
  last_used timestamp not null
)

// 记住我设置，当服务重启后，用户不会被拦截到登录页面也可以访问资源，客户端token是存在cookie中的，所以清除了cookie就要重新登录了
http.rememberMe()
  .tokenRepository(persistentTokenRepository()) // 配置token持久化仓库
  .tokenValiditySeconds(604800) // 过期时间七天，单位秒
  .userDetailsService(userConfig); // 自动登录逻辑处理

// 开启注销，其实spring security默认已经开启的了
http.logout();

// 注销,默认开启的注销功能
http.logout().logoutSuccessUrl("/");    // 注销成功跳转到首页

@GetMapping("/login")
public String login(){
  return "login";
}

@Override
protected void configure(HttpSecurity http) throws Exception {
...    
http.formLogin()
			.loginPage("/login");

// 自定义的登录页需要配置 rememberMe 的参数名,就可以绑定到我们前端的！
// 记住我功能
http.rememberMe().rememberMeParameter("remember");
}

// 如果注销404，因为 Security 默认是防止 csrf 跨站伪请求！
 http.csrf().disable(); // 可能会让我们系统不安全

@Component
public class JWTAuthenticationFilter extends OncePerRequestFilter {
  @Autowired
  private JWTUtils jwt;
  @Autowired
  private MyUserDetailsService userDetailService;
  @Autowired
  private BCryptPasswordEncoder encoder;

  @Override
  protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
    //获取Http头中的Authentication
    String authentication = httpServletRequest.getHeader("Authentication");
    if (!StringUtils.isNullOrEmpty(authentication)){
      //解析JWT
      Map<String, Object> claims = jwt.parseToken(authentication);

      //如果解析后不为空，并且Security上下文中没有获取到验证信息（说明没有登录过，因为是无状态的，所以不会保存验证信息。）
      if (claims!=null && SecurityContextHolder.getContext().getAuthentication()==null){
        String username = (String) claims.get("username");
        String password = (String) claims.get("password");

        //重新经过userDetailService验证一次用户名和密码，因为JWT验证无法确保用户是否修改了密码，有被盗风险，或者可以加入IP验证。
        UserDetails userDetails = userDetailService.loadUserByUsername(username);
        if (userDetails!=null){
          if (encoder.matches(password,userDetails.getPassword())){
            UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, userDetails.getPassword(), userDetails.getAuthorities());
            //token.setDetails(new WebAuthenticationDetailsSource().buildDetails(httpServletRequest));

            //在上下文中写入jwt解析后的信息，经过UsernamePasswordAuthenticationFilter时就会认为验证通过                        
            SecurityContextHolder.getContext().setAuthentication(token);
          }
        }
      }
    }
    filterChain.doFilter(httpServletRequest, httpServletResponse);
  }
}

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled=true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
  // 密码加密方式
  @Bean
  public BCryptPasswordEncoder encoder(){
    return new BCryptPasswordEncoder();
  }

  // 配置AuthenticationManager
  @Override
  @Bean
  public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
  }

  // 用户信息服务，测试可以直接用memory方式
  @Autowired
  private MyUserDetailsService myUserDetailsService;

  // 自定义过滤器用来解析JWT信息
  @Autowired
  private JWTAuthenticationFilter jwtAuthenticationFilter;

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    final CorsConfiguration corsConfiguration = new CorsConfiguration();
    corsConfiguration.setAllowCredentials(true);
    corsConfiguration.addAllowedHeader("*");
    corsConfiguration.addAllowedOrigin("*");
    corsConfiguration.addAllowedMethod("*");
    corsConfiguration.setMaxAge(18000L);
    source.registerCorsConfiguration("/**", corsConfiguration);
    // 配置访问权限 关闭csrf 允许跨域请求
    http.authorizeRequests().mvcMatchers("/login**").permitAll().anyRequest().authenticated();
    http.csrf().disable();
    http.cors().configurationSource(source);
    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    // 在Security里UsernamePasswordAuthenticationFilter之前，添加一个过滤器(自定义的)
    http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
  }
  
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      /* 继承org.springframework.security.core.userdetails.UserDetailsService;UserDetailsService，重写方法从数据库读取用户的账目密码信息构成一个用户令牌*/
      auth.userDetailsService(myUserDetailsService).passwordEncoder(encoder());
      // 内存方式固定用户名密码构成用户令牌
      /*
      auth.inMemoryAuthentication()
      .withUser("test").password(bCryptPasswordEncoder().encode("test123"))
      .authorities("admin")
          .and().passwordEncoder(bCryptPasswordEncoder());
      */
    }
}

import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTVerificationException;
import com.auth0.jwt.interfaces.DecodedJWT;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;

import java.util.Date;
import java.util.HashMap;
import java.util.Map;

@Component
public class JWTUtils {
  // 只有服务器上有的签名字符串
  public final Algorithm SIGN = Algorithm.HMAC256("dfds%*af13%^##fgfgs1");

  public String createToken(UserDetails user){
    Map<String,String> claims= new HashMap<>();
    claims.put("username", user.getUsername());
    claims.put("password", user.getPassword());
    return JWT.create()
      .withExpiresAt(new Date(System.currentTimeMillis() + 15 * 60 * 1000))  //设置过期时间
      .withClaim("principal",claims)
      .sign(SIGN);
  }

  public Map<String, Object> parseToken(String token){
    try{
      DecodedJWT verify = JWT.require(SIGN).build().verify(token);
      if (verify.getExpiresAt().after(new Date())){
        return verify.getClaim("principal").asMap();
      }
    }catch (JWTVerificationException ignored){
      return null;
    }
    return null;
  }
}

@Controller
public class HomeController {
  @Autowired
  private JWTUtils jwt;

  @Autowired
  private AuthenticationManager authenticationManager;


  @RequestMapping("/login")
  @ResponseBody
  public String login(@RequestParam(value = "username") String username,@RequestParam(value = "password") String password) throws Exception {
    try {
      //这里使用authenticationManager验证，最终还会用到Config中设置的userDetailsService的loadUserByUsername方法
      //也可以直接用userDetailsService进行验证，反正只是为了封装JWT信息
      UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password);
      authenticationManager.authenticate(token);
    }catch (BadCredentialsException e){
      throw new Exception("账号密码错误",e);
    }
    return jwt.createToken(User.builder().username(username).password(password).authorities("Login").build());
  }

  @RequestMapping("/hello")
  @ResponseBody
  @PreAuthorize("hasAuthority('admin')")
  public String hello(){
    return "hello";
  }
}

@Secured({"ROLE_user"})
void updateUser(User user);

@Secured({"ROLE_admin", "ROLE_user1"})
void updateUser();