public interface SecurityContext extends Serializable { // 获取Authentication对象 Authentication getAuthentication();
 // 放入Authentication对象 void setAuthentication(Authentication authentication);}复制代码

public class SecurityContextHolder {
 public static void clearContext() {  strategy.clearContext(); }
 public static SecurityContext getContext() {  return strategy.getContext(); }        public static void setContext(SecurityContext context) {  strategy.setContext(context); }
}复制代码

public interface Authentication extends Principal, Serializable {  Collection<? extends GrantedAuthority> getAuthorities(); Object getCredentials(); Object getDetails(); Object getPrincipal(); boolean isAuthenticated(); void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException;}复制代码

public interface AuthenticationManager { // 认证方法 Authentication authenticate(Authentication authentication)   throws AuthenticationException;}复制代码

<dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-security</artifactId>        </dependency>
        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-web</artifactId>        </dependency>
        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-validation</artifactId>        </dependency>                <dependency>            <groupId>io.jsonwebtoken</groupId>            <artifactId>jjwt</artifactId>            <version>0.9.0</version>        </dependency>                <dependency>            <groupId>com.baomidou</groupId>            <artifactId>mybatis-plus-boot-starter</artifactId>            <version>3.3.0</version>        </dependency>                <dependency>            <groupId>mysql</groupId>            <artifactId>mysql-connector-java</artifactId>            <version>5.1.47</version>        </dependency>复制代码

@Bean    public PasswordEncoder passwordEncoder() {        return new BCryptPasswordEncoder();    }复制代码

@Bean    public AuthenticationManager authenticationManager() throws Exception {        return super.authenticationManager();    }复制代码

public class CustomUserDetailsService implements UserDetailsService {    @Autowired    private UserService userService;    @Autowired    private RoleInfoService roleInfoService;    @Override    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {        log.debug("开始登陆验证，用户名为: {}",s);
        // 根据用户名验证用户        QueryWrapper<UserInfo> queryWrapper = new QueryWrapper<>();        queryWrapper.lambda().eq(UserInfo::getLoginAccount,s);        UserInfo userInfo = userService.getOne(queryWrapper);        if (userInfo == null) {            throw new UsernameNotFoundException("用户名不存在，登陆失败。");        }
        // 构建UserDetail对象        UserDetail userDetail = new UserDetail();        userDetail.setUserInfo(userInfo);        List<RoleInfo> roleInfoList = roleInfoService.listRoleByUserId(userInfo.getUserId());        userDetail.setRoleInfoList(roleInfoList);        return userDetail;    }}复制代码

@Override    public ApiResult login(String loginAccount, String password) {        // 1 创建UsernamePasswordAuthenticationToken        UsernamePasswordAuthenticationToken usernameAuthentication = new UsernamePasswordAuthenticationToken(loginAccount, password);        // 2 认证        Authentication authentication = this.authenticationManager.authenticate(usernameAuthentication);        // 3 保存认证信息        SecurityContextHolder.getContext().setAuthentication(authentication);        // 4 生成自定义token        UserDetail userDetail = (UserDetail) authentication.getPrincipal();        AccessToken accessToken = jwtProvider.createToken((UserDetails) authentication.getPrincipal());
        // 5 放入缓存        caffeineCache.put(CacheName.USER, userDetail.getUsername(), userDetail);        return ApiResult.ok(accessToken);    }复制代码

// AbstractUserDetailsAuthenticationProvider
public Authentication authenticate(Authentication authentication){
  // 校验未认证的Authentication对象里面有没有用户名  String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"    : authentication.getName();           boolean cacheWasUsed = true;     // 从缓存中去查用户名为XXX的对象  UserDetails user = this.userCache.getUserFromCache(username);
     // 如果没有就进入到这个方法  if (user == null) {   cacheWasUsed = false;
   try {                // 调用我们重写UserDetailsService的loadUserByUsername方法                // 拿到我们自己组装好的UserDetails对象    user = retrieveUser(username,      (UsernamePasswordAuthenticationToken) authentication);   }   catch (UsernameNotFoundException notFound) {    logger.debug("User '" + username + "' not found");
    if (hideUserNotFoundExceptions) {     throw new BadCredentialsException(messages.getMessage(       "AbstractUserDetailsAuthenticationProvider.badCredentials",       "Bad credentials"));    }    else {     throw notFound;    }   }
   Assert.notNull(user,     "retrieveUser returned null - a violation of the interface contract");  }        try {         // 校验账号是否禁用   preAuthenticationChecks.check(user);         // 校验数据库查出来的密码，和我们传入的密码是否一致   additionalAuthenticationChecks(user,     (UsernamePasswordAuthenticationToken) authentication);  }

}复制代码

@Bean    public JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter() {        return new JwtAuthenticationTokenFilter();    }
@Override    protected void configure(HttpSecurity http) throws Exception {        http.addFilterBefore(jwtAuthenticationTokenFilter(),                        UsernamePasswordAuthenticationFilter.class);    }复制代码

@Override    protected void doFilterInternal(@NotNull HttpServletRequest request,                                    @NotNull HttpServletResponse response,                                    @NotNull FilterChain chain) throws ServletException, IOException {        log.info("JWT过滤器通过校验请求头token进行自动登录...");
        // 拿到Authorization请求头内的信息        String authToken = jwtProvider.getToken(request);
        // 判断一下内容是否为空且是否为(Bearer )开头        if (StrUtil.isNotEmpty(authToken) && authToken.startsWith(jwtProperties.getTokenPrefix())) {            // 去掉token前缀(Bearer )，拿到真实token            authToken = authToken.substring(jwtProperties.getTokenPrefix().length());
            // 拿到token里面的登录账号            String loginAccount = jwtProvider.getSubjectFromToken(authToken);
            if (StrUtil.isNotEmpty(loginAccount) && SecurityContextHolder.getContext().getAuthentication() == null) {                // 缓存里查询用户，不存在需要重新登陆。                UserDetail userDetails = caffeineCache.get(CacheName.USER, loginAccount, UserDetail.class);
                // 拿到用户信息后验证用户信息与token                if (userDetails != null && jwtProvider.validateToken(authToken, userDetails)) {
                    // 组装authentication对象，构造参数是Principal Credentials 与 Authorities                    // 后面的拦截器里面会用到 grantedAuthorities 方法                    UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, userDetails.getPassword(), userDetails.getAuthorities());
                    // 将authentication信息放入到上下文对象中                    SecurityContextHolder.getContext().setAuthentication(authentication);
                    log.info("JWT过滤器通过校验请求头token自动登录成功, user : {}", userDetails.getUsername());                }            }        }
        chain.doFilter(request, response);    }复制代码