Spring Security 一根难啃的骨头

public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    // 访问 /login /register 不需要认证
    http.authorizeHttpRequests(auth -> auth
            .requestMatchers("/login", "/register").permitAll()
            .anyRequest().authenticated()
    );
  
    // 使用默认表单页面登录 (不用自己实现登录页面)
    http.authenticationProvider(authenticationProvider())
      .formLogin(Customizer.withDefaults());
  
    // 指定 Session 模式: IF_REQUIRED 
    http.sessionManagement(session -> session
            .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
            .maximumSessions(1)
            .expiredUrl("/login?expired")
    );

    return http.build();
}

@Bean
public SecurityFilterChain securityFilterChain(
        HttpSecurity http,
        JwtAuthFilter jwtAuthenticationFilter) throws Exception {
  
    // 禁止 CSRF, 任何请求都可以发送到服务器
    http.csrf(AbstractHttpConfigurer::disable);
  
    // 指定无状态 Session
    http.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

    http.authorizeHttpRequests(auth -> auth
            .requestMatchers("/api/users/login", "/api/users/register").permitAll()
            .anyRequest().authenticated()
    );
  
    // 添加自定义的 JWT 验证逻辑, 验证请求中的 JWT Token 是否有效
    http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

    return http.build();
}

$ curl -X POST -H "Content-Type: application/json" -d
'{"username":"user1","password":"ps123"}' http://localhost:8080/login -v
...
< HTTP/1.1 200
< X-XSS-Protection: 0
{"token":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0dXNlciIsImlhdCI6MTczOTU1OTk0NywiZXhwIjoxNzM5NjQ2MzQ3fQ.3o4g5OJVQSzrCJtoqNvnsV-PdgOMeGVdSuGhEuQy3WM"}

@PostMapping("/login")
public JwtResponse login(UserDTO.LoginRequest request) {
    // userService.login() 处理认证逻辑 校对密码
    // 若成功, 返回给用户 JWT Token
    return userService.login(request);
}

@PostMapping("/login")
public ResponseEntity<UserDTO.JwtResponse> login(UserDTO.LoginRequest request) {
    // 1. 封装用户名密码
    UsernamePasswordAuthenticationToken authRequest =
            new UsernamePasswordAuthenticationToken(
      request.getUsername(), 
      request.getPassword());
    // 2. 调用 AuthenticationManager 进行认证
    // 如果认证不通过，authenticate(...) 会抛出异常, 由全局异常处理器处理
    Authentication authentication = authenticationManager.authenticate(authRequest);
    // 3. 如果认证通过，生成 JWT
    String jwt = jwtUtils.generateToken(authentication);
    // 4. 返回 JWT 给客户端（可放在 Body，也可放在 Header）
    return ResponseEntity.ok(new UserDTO.JwtResponse(jwt));
}

public interface AuthenticationManager {
    Authentication authenticate(Authentication authentication) 
      throws AuthenticationException;
}

public interface Authentication extends Principal, Serializable {
    Collection<? extends GrantedAuthority> getAuthorities();

    Object getCredentials();

    Object getDetails();

    Object getPrincipal();

    boolean isAuthenticated();

    void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException;
}

@Component
public class JwtAuthFilter extends OncePerRequestFilter {
  
    // 注意这个函数的名字
    @Override
    protected void doFilterInternal(
            @NonNull HttpServletRequest request,
            @NonNull HttpServletResponse response,
            @NonNull FilterChain filterChain)
            throws ServletException, IOException {

        // 从 Authorization 请求头中获取 JWT Token
         String jwt = parseJwt(request);

        // 验证 token 是否有效
        if (jwt != null && jwtUtils.validateToken(jwt)) {...}
      
        // 转发到下一个 filter
        filterChain.doFilter(request, response);
    }

    private String parseJwt(HttpServletRequest request) {
        String headerAuth = request.getHeader("Authorization");
        if (StringUtils.hasText(headerAuth) && headerAuth.startsWith("Bearer ")) {
            return headerAuth.substring(7);
        }
        return null;
    }
}

http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

@Slf4j
@Configuration
@RequiredArgsConstructor
public class SecurityConfig {
    private final UserRepository userRepository;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        return username -> {
            User user = userRepository.findByUsername(username)
                    .orElseThrow(() -> new UsernameNotFoundException("用户不存在"));

            log.info("用户信息: {}", user);

            // 把自己的 User 转换成 Spring Security 提供的 UserDetails 对象
            return new org.springframework.security.core.userdetails.User(
                    user.getUsername(),
                    user.getPasswordHash(),
                    Collections.emptyList()
            );
        };
    }

    @Bean
    public DaoAuthenticationProvider daoAuthenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        // 加入 DaoAuthenticationProvider 的两个小弟
        provider.setUserDetailsService(userDetailsService());
        provider.setPasswordEncoder(passwordEncoder());
        return provider;
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth
                .requestMatchers("/login", "/home").permitAll()
                .anyRequest().authenticated()
        );

        http.authenticationProvider(daoAuthenticationProvider())
          .formLogin(Customizer.withDefaults());

        http.sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                .maximumSessions(1)
                .expiredUrl("/login?expired")
        );

        return http.build();
    }
}

Global AuthenticationManager configured with an AuthenticationProvider bean. UserDetailsService beans will not be used by Spring Security for automatically configuring username/password login. Consider removing the AuthenticationProvider bean. Alternatively, consider using the UserDetailsService in a manually instantiated DaoAuthenticationProvider. If the current configuration is intentional, to turn off this warning, increase the logging level of 'org.springframework.security.config.annotation.authentication.configuration.InitializeUserDetailsBeanManagerConfigurer' to ERROR

http.authenticationProvider(daoAuthenticationProvider())
  .formLogin(Customizer.withDefaults());

http.formLogin(Customizer.withDefaults());

http.sessionManagement(session -> session
    .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
    .maximumSessions(1)
    .expiredUrl("/login?expired")
);

@Component
public class SessionValidationFilter extends OncePerRequestFilter {
    @Autowired
    private HttpSession session;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        if (session.getAttribute("SPRING_SECURITY_CONTEXT") == null) {
            response.sendRedirect("/login?expired");
            return;
        }
        filterChain.doFilter(request, response);
    }
}

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    // ...
    // 注册过滤器
    http.addFilterBefore(new SessionValidationFilter(), UsernamePasswordAuthenticationFilter.class);
    return http.build();
}

public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    // 修改这个语句
    http.authenticationProvider(daoAuthenticationProvider())
      .formLogin(Customizer.withDefaults());
  ...
}

public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    // 配置 URL 访问权限
    http.authorizeHttpRequests(auth -> {
        auth.requestMatchers("/login", "/css/**", "/js/**").permitAll();
        auth.anyRequest().authenticated();
    });

    // 配置表单登录
    http.formLogin(form -> {
        form.loginPage("/login");
        form.loginProcessingUrl("/login");
        form.defaultSuccessUrl("/home", true);
        form.permitAll();
    });

    // 配置登出
    http.logout(logout -> {
        logout.logoutUrl("/logout");
        logout.logoutSuccessUrl("/login?logout");
        logout.permitAll();
    });

    return http.build();
}

@Component
public class MyService {
}

@Configuration
public class AppConfig {
    @Bean
    public MyService myService() {
        return new MyService();
    }
}