<?xml version="1.0" encoding="UTF-8"?><project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">    <modelVersion>4.0.0</modelVersion>
    <parent>        <groupId>org.springframework.boot</groupId>        <artifactId>spring-boot-starter-parent</artifactId>        <version>2.7.18</version>        <relativePath/>    </parent>
    <groupId>com.yu</groupId>    <artifactId>spring-boot-security2-demo</artifactId>    <version>0.0.1-SNAPSHOT</version>    <name>spring-boot-security2-demo</name>    <description>Spring Boot集成Spring Security样例</description>
    <properties>        <java.version>8</java.version>    </properties>
    <dependencies>        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-web</artifactId>        </dependency>        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-security</artifactId>        </dependency>    </dependencies>
</project>

@AutoConfiguration@ConditionalOnClass(DefaultAuthenticationEventPublisher.class)@EnableConfigurationProperties(SecurityProperties.class)@Import({ SpringBootWebSecurityConfiguration.class, SecurityDataConfiguration.class })public class SecurityAutoConfiguration {
	@Bean	@ConditionalOnMissingBean(AuthenticationEventPublisher.class)	public DefaultAuthenticationEventPublisher authenticationEventPublisher(ApplicationEventPublisher publisher) {		return new DefaultAuthenticationEventPublisher(publisher);	}
}

@Configuration(proxyBeanMethods = false)@ConditionalOnWebApplication(type = Type.SERVLET)class SpringBootWebSecurityConfiguration {
	@Configuration(proxyBeanMethods = false)	@ConditionalOnDefaultWebSecurity	static class SecurityFilterChainConfiguration {
		@Bean		@Order(SecurityProperties.BASIC_AUTH_ORDER)		SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {			http.authorizeRequests().anyRequest().authenticated();			http.formLogin();			http.httpBasic();			return http.build();		}
	}
	@Configuration(proxyBeanMethods = false)	@ConditionalOnMissingBean(name = BeanIds.SPRING_SECURITY_FILTER_CHAIN)	@ConditionalOnClass(EnableWebSecurity.class)	@EnableWebSecurity	static class WebSecurityEnablerConfiguration {
	}
}

@Retention(RetentionPolicy.RUNTIME)@Target(ElementType.TYPE)@Documented@Import({ WebSecurityConfiguration.class, SpringWebMvcImportSelector.class, OAuth2ImportSelector.class,		HttpSecurityConfiguration.class })@EnableGlobalAuthentication@Configurationpublic @interface EnableWebSecurity {
	/**	 * Controls debugging support for Spring Security. Default is false.	 * @return if true, enables debug support with Spring Security	 */	boolean debug() default false;
}

@Configuration(proxyBeanMethods = false)public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAware {@Bean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)	public Filter springSecurityFilterChain() throws Exception {		boolean hasConfigurers = this.webSecurityConfigurers != null && !this.webSecurityConfigurers.isEmpty();		boolean hasFilterChain = !this.securityFilterChains.isEmpty();		Assert.state(!(hasConfigurers && hasFilterChain),				"Found WebSecurityConfigurerAdapter as well as SecurityFilterChain. Please select just one.");		if (!hasConfigurers && !hasFilterChain) {			WebSecurityConfigurerAdapter adapter = this.objectObjectPostProcessor					.postProcess(new WebSecurityConfigurerAdapter() {					});			this.webSecurity.apply(adapter);		}		for (SecurityFilterChain securityFilterChain : this.securityFilterChains) {			this.webSecurity.addSecurityFilterChainBuilder(() -> securityFilterChain);			for (Filter filter : securityFilterChain.getFilters()) {				if (filter instanceof FilterSecurityInterceptor) {					this.webSecurity.securityInterceptor((FilterSecurityInterceptor) filter);					break;				}			}		}		for (WebSecurityCustomizer customizer : this.webSecurityCustomizers) {			customizer.customize(this.webSecurity);		}		return this.webSecurity.build();	}}

@Configuration(proxyBeanMethods = false)class HttpSecurityConfiguration {
	@Bean(HTTPSECURITY_BEAN_NAME)	@Scope("prototype")	HttpSecurity httpSecurity() throws Exception {		WebSecurityConfigurerAdapter.LazyPasswordEncoder passwordEncoder = new WebSecurityConfigurerAdapter.LazyPasswordEncoder(				this.context);		AuthenticationManagerBuilder authenticationBuilder = new WebSecurityConfigurerAdapter.DefaultPasswordEncoderAuthenticationManagerBuilder(				this.objectPostProcessor, passwordEncoder);		authenticationBuilder.parentAuthenticationManager(authenticationManager());		authenticationBuilder.authenticationEventPublisher(getAuthenticationEventPublisher());		HttpSecurity http = new HttpSecurity(this.objectPostProcessor, authenticationBuilder, createSharedObjects());		// @formatter:off		http			.csrf(withDefaults())			.addFilter(new WebAsyncManagerIntegrationFilter())			.exceptionHandling(withDefaults())			.headers(withDefaults())			.sessionManagement(withDefaults())			.securityContext(withDefaults())			.requestCache(withDefaults())			.anonymous(withDefaults())			.servletApi(withDefaults())			.apply(new DefaultLoginPageConfigurer<>());		http.logout(withDefaults());		// @formatter:on		applyDefaultConfigurers(http);		return http;	}}

@AutoConfiguration@ConditionalOnClass(AuthenticationManager.class)@ConditionalOnBean(ObjectPostProcessor.class)@ConditionalOnMissingBean(		value = { AuthenticationManager.class, AuthenticationProvider.class, UserDetailsService.class,				AuthenticationManagerResolver.class },		type = { "org.springframework.security.oauth2.jwt.JwtDecoder",				"org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector",				"org.springframework.security.oauth2.client.registration.ClientRegistrationRepository",				"org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository" })public class UserDetailsServiceAutoConfiguration {	@Bean	@Lazy	public InMemoryUserDetailsManager inMemoryUserDetailsManager(SecurityProperties properties,			ObjectProvider<PasswordEncoder> passwordEncoder) {		SecurityProperties.User user = properties.getUser();		List<String> roles = user.getRoles();		return new InMemoryUserDetailsManager(User.withUsername(user.getName())			.password(getOrDeducePassword(user, passwordEncoder.getIfAvailable()))			.roles(StringUtils.toStringArray(roles))			.build());	}	private String getOrDeducePassword(SecurityProperties.User user, PasswordEncoder encoder) {		String password = user.getPassword();		if (user.isPasswordGenerated()) {			logger.warn(String.format(					"%n%nUsing generated security password: %s%n%nThis generated password is for development use only. "							+ "Your security configuration must be updated before running your application in "							+ "production.%n",					user.getPassword()));		}		if (encoder != null || PASSWORD_ALGORITHM_PATTERN.matcher(password).matches()) {			return password;		}		return NOOP_PASSWORD_PREFIX + password;	}

#UserDetailsServiceAutoConfiguration.inMemoryUserDetailsManager方法中获取user对象SecurityProperties.User user = properties.getUser();#SecurityProperties中的User类public static class User {		private String name = "user";		private String password = UUID.randomUUID().toString();		private List<String> roles = new ArrayList<>();	}

@AutoConfiguration(after = SecurityAutoConfiguration.class)@ConditionalOnWebApplication(type = Type.SERVLET)@EnableConfigurationProperties(SecurityProperties.class)@ConditionalOnClass({ AbstractSecurityWebApplicationInitializer.class, SessionCreationPolicy.class })public class SecurityFilterAutoConfiguration {
	private static final String DEFAULT_FILTER_NAME = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME;
	@Bean	@ConditionalOnBean(name = DEFAULT_FILTER_NAME)	public DelegatingFilterProxyRegistrationBean securityFilterChainRegistration(			SecurityProperties securityProperties) {		DelegatingFilterProxyRegistrationBean registration = new DelegatingFilterProxyRegistrationBean(				DEFAULT_FILTER_NAME);		registration.setOrder(securityProperties.getFilter().getOrder());		registration.setDispatcherTypes(getDispatcherTypes(securityProperties));		return registration;	}
	private EnumSet<DispatcherType> getDispatcherTypes(SecurityProperties securityProperties) {		if (securityProperties.getFilter().getDispatcherTypes() == null) {			return null;		}		return securityProperties.getFilter()			.getDispatcherTypes()			.stream()			.map((type) -> DispatcherType.valueOf(type.name()))			.collect(Collectors.toCollection(() -> EnumSet.noneOf(DispatcherType.class)));	}
}