<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>

@RestController
public class HelloController {
   @GetMapping("/hello")
   public String hello() {
      return "hello";
   }
}

Using generated security password: 40fb25e8-e147-40aa-8f77-f6eea3723e11

@ConfigurationProperties(prefix = "spring.security")
public class SecurityProperties {
}

spring:
  security:
    user:
      name: maqb
      password: 123

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Bean
    PasswordEncoder passwordEncoder(){
        return NoOpPasswordEncoder.getInstance();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth)throws Exception{
        auth.inMemoryAuthentication()
                .withUser("maqb")
                .password("456").roles("admin");
    }
}

    @Override
	public void configure(WebSecurity web)throws Exception{
        web.ignoring().antMatchers("/js/**","/css/**","/images/**");
    }

    @Override
    protected void configure(HttpSecurity http)throws Exception{
        http.authorizeRequests()
        .anyRequest().authenticated()
        .and()
        .formLogin().loginPage("/login.html").permitAll(); // 注意此处要放行login.html请求,否则会一直重定向
    }

.and().formLogin().loginPage("/login.html").permitAll(); 

   .and()
        .formLogin()
        .loginPage("/login.html")
        .loginProcessingUrl("/doLogin")
        .permitAll(); // 注意此处要放行login.html请求,否则会一直重定向

<form action="/doLogin" method="post">
    // ...略
</form>

<form action="/doLogin" method="post">
    <input type="text" name="username" id="name">
    <input type="password" name="password" id="pass">
    <button type="submit">
        <span>登录</span>
    </button>
</form>

                .and()
        .formLogin()
        .loginPage("/login.html")
        .loginProcessingUrl("/doLogin")
        .usernameParameter("name")
        .passwordParameter("passwd")
        .permitAll(); // 注意此处要放行login.html请求,否则会一直重定向

<form action="/doLogin" method="post">
    <input type="text" name="name" id="name">
    <input type="password" name="passwd" id="pass">
    <button type="submit">
        <span>登录</span>
    </button>
</form>

                .and()
        .formLogin()
        .loginPage("/login.html")
        .loginProcessingUrl("/doLog

    protected AbstractAuthenticationFilterConfigurer(){
        this.defaultSuccessHandler=new SavedRequestAwareAuthenticationSuccessHandler();
        this.successHandler=this.defaultSuccessHandler;
        this.setLoginPage("/login");
    }

    public void init(H http)throws Exception{
        super.init(http);
        this.initDefaultLoginFilter(http);
    }

    // 父类init
	public void init(B http)throws Exception{
        this.updateAuthenticationDefaults();
        this.updateAccessDefaults(http);
        this.registerDefaultAuthenticationEntryPoint(http);
    }

    protected final void updateAuthenticationDefaults(){
        if(this.loginProcessingUrl==null){
        this.loginProcessingUrl(this.loginPage);
        }
        // 略..
    }

                .and()
        .formLogin()
        .loginPage("/login.html")
        .loginProcessingUrl("/doLogin")
        .usernameParameter("name")
        .passwordParameter("passwd")

    public FormLoginConfigurer(){
        super(new UsernamePasswordAuthenticationFilter(),(String)null);
        this.usernameParameter("username");
        this.passwordParameter("password");
    }

    public FormLoginConfigurer<H> usernameParameter(String usernameParameter){
        ((UsernamePasswordAuthenticationFilter)this.getAuthenticationFilter()).setUsernameParameter(usernameParameter);
        return this;
        }

    public void setUsernameParameter(String usernameParameter){
        Assert.hasText(usernameParameter,"Username parameter must not be empty or null");
        this.usernameParameter=usernameParameter;
    }

    @Nullable
	protected String obtainUsername(HttpServletRequest request){
        return request.getParameter(this.usernameParameter);
    }

        http.logout()
        .logoutUrl("/logout")
        .logoutRequestMatcher(new AntPathRequestMatcher("/logout","GET"))
        .logoutSuccessUrl("/out")
        .deleteCookies()
        .clearAuthentication(true)
        .invalidateHttpSession(true)
        .permitAll();

                .successHandler((request,response,authentication)->{
        Object principal=authentication.getPrincipal();
        response.setContentType("application/json;charset=utf-8");
        PrintWriter out=response.getWriter();
        out.write(new ObjectMapper().writeValueAsString(principal));
        out.flush();
        out.close();
        })

                .failureHandler((request,response,exception)->{
        response.setContentType("application/json;charset=utf-8");
        PrintWriter out=response.getWriter();
        out.write(exception.getMessage());
        out.flush();
        out.close();
        })

		if (e instanceof LockedException) {
            respBean.setMsg("账户被锁定，请联系管理员!");
        }
        elseif(e instanceof CredentialsExpiredException) {
            respBean.setMsg("密码过期，请联系管理员!");
        }
        elseif(e instanceof AccountExpiredException) {
            respBean.setMsg("账户过期，请联系管理员!");
        }
        elseif(e instanceof DisabledException) {
            respBean.setMsg("账户被禁用，请联系管理员!");
        }
        elseif(e instanceof BadCredentialsException) {
            respBean.setMsg("用户名或者密码输入错误，请重新输入!");
        }

    public Authentication authenticate(Authentication authentication)
            throws AuthenticationException {
        Class<? extends Authentication> toTest = authentication.getClass();
        Authentication result = null;
        for (AuthenticationProvider provider : getProviders()) {
            if (!provider.supports(toTest)) {
                continue;
            }
            result = provider.authenticate(authentication);
            if (result != null) {
                copyDetails(authentication, result);
                break;
            }
        }
        if (result == null && parent != null) {
            result = parentResult = parent.authenticate(authentication);
        }
        if (result != null) {
            if (eraseCredentialsAfterAuthentication
                    && (result instanceof CredentialsContainer)) {
                ((CredentialsContainer) result).eraseCredentials();
            }
            if (parentResult == null) {
                eventPublisher.publishAuthenticationSuccess(result);
            }
            return result;
        }
        throw lastException;
    }

    public Authentication authenticate(Authentication authentication)
            throws AuthenticationException {
        Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
                () -> messages.getMessage(
                        "AbstractUserDetailsAuthenticationProvider.onlySupports",
                        "Only UsernamePasswordAuthenticationToken is supported"));

        // Determine username
        String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
                : authentication.getName();

        boolean cacheWasUsed = true;
        UserDetails user = this.userCache.getUserFromCache(username);

        if (user == null) {
            cacheWasUsed = false;

            try {
                user = retrieveUser(username,
                        (UsernamePasswordAuthenticationToken) authentication);
            } catch (UsernameNotFoundException notFound) {
                logger.debug("User '" + username + "' not found");

                if (hideUserNotFoundExceptions) {
                    throw new BadCredentialsException(messages.getMessage(
                            "AbstractUserDetailsAuthenticationProvider.badCredentials",
                            "Bad credentials"));
                } else {
                    throw notFound;
                }
            }

            Assert.notNull(user,
                    "retrieveUser returned null - a violation of the interface contract");
        }

        // ....
        return createSuccessAuthentication(principalToReturn, authentication, user);
    }

                .and()
        .csrf().disable()
        .exceptionHandling()
        .authenticationEntryPoint((request,response,authException)->{
        response.setContentType("application/json;charset=utf-8");
        PrintWriter out=response.getWriter();
        out.write("尚未登录，请先登录");
        out.flush();
        out.close();
        });

        http.logout()
        .logoutUrl("/logout")
        .logoutSuccessHandler((request,response,authentication)->{
        response.setContentType("application/json;charset=utf-8");
        PrintWriter out=response.getWriter();
        out.write("注销成功");
        out.flush();
        out.close();
        })
        .deleteCookies();

    @Override
	protected void configure(AuthenticationManagerBuilder auth)throws Exception{
        auth.inMemoryAuthentication()
        .withUser("spencer")
        .password("123")
        .roles("admin")
        .and()
        .withUser("maqb")
        .password("123")
        .roles("user");
    }

    @Bean
    @Override
    protected UserDetailsService userDetailsService(){
        InMemoryUserDetailsManager manager=new InMemoryUserDetailsManager();
        manager.createUser(User.withUsername("spencer").password("123").roles("admin").build());
        manager.createUser(User.withUsername("maqb").password("123").roles("user").build());
        return manager;
    }

@RestController
public class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "hello";
    }

    @GetMapping("/admin/hello")
    public String admin() {
        return "admin";
    }

    @GetMapping("/user/hello")
    public String user() {
        return "user";
    }
}

    @Override
	protected void configure(HttpSecurity http)throws Exception{
        http.authorizeRequests()
        .antMatchers("/admin/**").hasRole("admin")
        .antMatchers("/user/**").hasRole("user")
        .and()
        .authorizeRequests().anyRequest().authenticated();

        // ...
    }

.antMatchers("/user/**").hasRole("user") // 修改成如下
        .antMatchers("/user/**").hasAnyRole("user","admin")

    @Bean
    RoleHierarchy roleHierarchy(){
            RoleHierarchyImpl roleHierarchy=new RoleHierarchyImpl();
            roleHierarchy.setHierarchy("ROLE_admin > ROLE_user");
            return roleHierarchy;
    }

create table users
(
    username varchar_ignorecase(50) not null primary key,
    password varchar_ignorecase(500) not null,
    enabled  boolean not null
);
create table authorities
(
    username  varchar_ignorecase(50) not null,
    authority varchar_ignorecase(50) not null,
    constraint fk_authorities_users foreign key (username) references users (username)
);
create
unique index ix_auth_username on authorities (username,authority);

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-jdbc</artifactId>
</dependency>
<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
</dependency>

spring:
  datasource:
    driver-class-name: com.mysql.jdbc.Driver
    url: jdbc:mysql://localhost:3306/spring_security_sample?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai
    username: root
    password: admin

    @Autowired
    DataSource dataSource;

    @Bean
    @Override
    protected UserDetailsService userDetailsService() {
        JdbcUserDetailsManager manager = new JdbcUserDetailsManager();
        manager.setDataSource(dataSource);
        if (!manager.userExists("spencer")) {
            manager.createUser(User.withUsername("spencer").password("123").roles("admin").build());
        }
        if (!manager.userExists("maqb")) {
            manager.createUser(User.withUsername("maqb").password("123").roles("user").build());
        }
        return manager;
    }

@Entity(name = "t_role")
public class Role {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String name;
    private String nameZh;

    // getter/setter 
}

@Entity(name = "t_user")
public class User implements UserDetails {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String username;
    private String password;
    private boolean accountNonExpired;
    private boolean accountNonLocked;
    private boolean credentialsNonExpired;
    private boolean enabled;

    @ManyToMany(fetch = FetchType.EAGER, cascade = CascadeType.PERSIST)
    private List<Role> roles;

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        List<SimpleGrantedAuthority> authorities = new ArrayList<>();
        for (Role role : getRoles()) {
            authorities.add(new SimpleGrantedAuthority(role.getName()));
        }
        return authorities;
    }

    @Override
    public String getPassword() {
        return password;
    }

    @Override
    public String getUsername() {
        return username;
    }

    @Override
    public boolean isAccountNonExpired() {
        return accountNonExpired;
    }

    @Override
    public boolean isAccountNonLocked() {
        return accountNonLocked;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return credentialsNonExpired;
    }

    @Override
    public boolean isEnabled() {
        return enabled;
    }

    // getter/setter
}

public interface UserDao extends JpaRepository<User, Long> {
    User findUserByUsername(String username);
}

@Service
public class UserService implements UserDetailsService {

    @Resource
    private UserDao userDao;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userDao.findUserByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("用户名不存在");
        }
        return user;
    }
}

    @Autowired
    UserService userService;

@Override
protected void configure(AuthenticationManagerBuilder auth)throws Exception{
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
        }

spring:
  datasource:
    driver-class-name: com.mysql.jdbc.Driver
    url: jdbc:mysql://localhost:3306/withjpa?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai
    username: root
    password: admin

  jpa:
    database: mysql
    #database-platform: mysql
    hibernate:
      ddl-auto: update
    show-sql: true

@SpringBootTest
public class WithJpaApplicationTests {

    @Resource
    UserDao userDao;

    @Test
    void contextLoads() {
        User u1 = new User();
        u1.setUsername("spencer");
        u1.setPassword("123");
        u1.setAccountNonExpired(true);
        u1.setAccountNonLocked(true);
        u1.setCredentialsNonExpired(true);
        u1.setEnabled(true);
        List<Role> rs1 = new ArrayList<>();
        Role r1 = new Role();
        r1.setName("ROLE_admin");
        r1.setNameZh("管理员");
        rs1.add(r1);
        u1.setRoles(rs1);
        userDao.save(u1);
        User u2 = new User();
        u2.setUsername("maqb");
        u2.setPassword("123");
        u2.setAccountNonExpired(true);
        u2.setAccountNonLocked(true);
        u2.setCredentialsNonExpired(true);
        u2.setEnabled(true);
        List<Role> rs2 = new ArrayList<>();
        Role r2 = new Role();
        r2.setName("ROLE_user");
        r2.setNameZh("普通用户");
        rs2.add(r2);
        u2.setRoles(rs2);
        userDao.save(u2);
    }
}

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated();

        http.formLogin()
                .and()
                .rememberMe()
                .and()
                .csrf().disable();
    }

@RestController
public class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "hello";
    }
}

public class DecodeTest {
    @Test
    void t1() {
        Base64.Decoder decoder = Base64.getDecoder();
        String str = new String(decoder.decode("c3BlbmNlcjoxNjE4MjMyMzU0MTYzOmZjMmEwODllY2UzMWU1ZWE0NTM5NDExOGI0NTU3NGI1"));
        System.out.println(str); // spencer:1618232354163:fc2a089ece31e5ea45394118b45574b5
    }
}

    @Override
    public void onLoginSuccess(HttpServletRequest request, HttpServletResponse response,
                               Authentication successfulAuthentication) {

        String username = retrieveUserName(successfulAuthentication);
        String password = retrievePassword(successfulAuthentication);

        // If unable to find a username and password, just abort as
        // TokenBasedRememberMeServices is
        // unable to construct a valid token in this case.
        if (!StringUtils.hasLength(username)) {
            logger.debug("Unable to retrieve username");
            return;
        }

        if (!StringUtils.hasLength(password)) {
            UserDetails user = getUserDetailsService().loadUserByUsername(username);
            password = user.getPassword();

            if (!StringUtils.hasLength(password)) {
                logger.debug("Unable to obtain password for user: " + username);
                return;
            }
        }

        int tokenLifetime = calculateLoginLifetime(request, successfulAuthentication);
        long expiryTime = System.currentTimeMillis();
        // SEC-949
        expiryTime += 1000L * (tokenLifetime < 0 ? TWO_WEEKS_S : tokenLifetime);

        String signatureValue = makeTokenSignature(expiryTime, username, password);

        setCookie(new String[]{username, Long.toString(expiryTime), signatureValue},
                tokenLifetime, request, response);

        if (logger.isDebugEnabled()) {
            logger.debug("Added remember-me cookie for user '" + username
                    + "', expiry: '" + new Date(expiryTime) + "'");
        }
    }

    protected String makeTokenSignature(long tokenExpiryTime, String username,
                                        String password) {
        String data = username + ":" + tokenExpiryTime + ":" + password + ":" + getKey();
        MessageDigest digest;
        try {
            digest = MessageDigest.getInstance("MD5");
        } catch (NoSuchAlgorithmException e) {
            throw new IllegalStateException("No MD5 algorithm available!");
        }

        return new String(Hex.encode(digest.digest(data.getBytes())));
    }

    @Override
	protected void configure(HttpSecurity http)throws Exception{
        http.authorizeRequests().anyRequest().authenticated();

        http.formLogin()
        .and()
        .rememberMe()
        .key("maqb")
        .and()
        .csrf().disable();
    }

AbstractAuthenticationProcessingFilter#doFilter -> 
AbstractAuthenticationProcessingFilter#successfulAuthentication -> 
AbstractRememberMeServices#loginSuccess -> 
TokenBasedRememberMeServices#onLoginSuccess。

    public void doFilter(ServletRequest req,ServletResponse res,FilterChain chain)
        throws IOException,ServletException{
        HttpServletRequest request=(HttpServletRequest)req;
        HttpServletResponse response=(HttpServletResponse)res;

        if(SecurityContextHolder.getContext().getAuthentication()==null){
        Authentication rememberMeAuth=rememberMeServices.autoLogin(request,
        response);

        // ...略
        }
    }

	@Override
    public final Authentication autoLogin(HttpServletRequest request,
                                          HttpServletResponse response) {
        String rememberMeCookie = extractRememberMeCookie(request);

        if (rememberMeCookie == null) {
            return null;
        }

        logger.debug("Remember-me cookie detected");

        if (rememberMeCookie.length() == 0) {
            logger.debug("Cookie was empty");
            cancelCookie(request, response);
            return null;
        }

        UserDetails user = null;

        try {
            String[] cookieTokens = decodeCookie(rememberMeCookie);
            user = processAutoLoginCookie(cookieTokens, request, response);
            userDetailsChecker.check(user);
            // ...略
        }
    }

public class PersistentRememberMeToken {
    private final String username;
    private final String series;
    private final String tokenValue;
    private final Date date;
    // ...
}

public class JdbcTokenRepositoryImpl extends JdbcDaoSupport implements
        PersistentTokenRepository {
    public static final String CREATE_TABLE_SQL = "create table persistent_logins (username varchar(64) not null, series varchar(64) primary key, "
            + "token varchar(64) not null, last_used timestamp not null)";
    public static final String DEF_TOKEN_BY_SERIES_SQL = "select username,series,token,last_used from persistent_logins where series = ?";
    public static final String DEF_INSERT_TOKEN_SQL = "insert into persistent_logins (username, series, token, last_used) values(?,?,?,?)";
    public static final String DEF_UPDATE_TOKEN_SQL = "update persistent_logins set token = ?, last_used = ? where series = ?";
    public static final String DEF_REMOVE_USER_TOKENS_SQL = "delete from persistent_logins where username = ?";

    // ...
}

CREATE TABLE `persistent_logins`
(
    `username`  varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL,
    `series`    varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL,
    `token`     varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL,
    `last_used` timestamp                              NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    PRIMARY KEY (`series`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-jdbc</artifactId>
</dependency>
<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
</dependency>

spring:
  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver
    username: root
    password: admin
    url: jdbc:mysql://localhost:3306/withjpa?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai

	@Autowired
    DataSource dataSource;

    @Bean
    JdbcTokenRepositoryImpl jdbcTokenRepository() {
        JdbcTokenRepositoryImpl jdbcTokenRepository = new JdbcTokenRepositoryImpl();
        jdbcTokenRepository.setDataSource(dataSource);
        return jdbcTokenRepository;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated();

        http.formLogin()
                .and()
                .rememberMe()
                .key("maqb")
                .tokenRepository(jdbcTokenRepository())
                .and()
                .csrf().disable();
    }

	protected void onLoginSuccess(HttpServletRequest request,
                                  HttpServletResponse response, Authentication successfulAuthentication) {
        String username = successfulAuthentication.getName();

        logger.debug("Creating new persistent login for user " + username);

        PersistentRememberMeToken persistentToken = new PersistentRememberMeToken(
                username, generateSeriesData(), generateTokenData(), new Date());
        try {
            tokenRepository.createNewToken(persistentToken);
            addCookie(persistentToken, request, response);
        } catch (Exception e) {
            logger.error("Failed to save persistent token ", e);
        }
    }

protected UserDetails processAutoLoginCookie(String[]cookieTokens,
                                             HttpServletRequest request,HttpServletResponse response){

    if(cookieTokens.length!=2){
        throw new InvalidCookieException("Cookie token did not contain "+2
                                         +" tokens, but contained '"+Arrays.asList(cookieTokens)+"'");
    }

    final String presentedSeries=cookieTokens[0];
    final String presentedToken=cookieTokens[1];

    PersistentRememberMeToken token=tokenRepository
        .getTokenForSeries(presentedSeries);

    if(token==null){
        // No series match, so we can't authenticate using this cookie
        throw new RememberMeAuthenticationException(
            "No persistent token found for series id: "+presentedSeries);
    }

    // We have a match for this user/series combination
    if(!presentedToken.equals(token.getTokenValue())){
        // Token doesn't match series value. Delete all logins for this user and throw
        // an exception to warn them.
        tokenRepository.removeUserTokens(token.getUsername());

        throw new CookieTheftException(
            messages.getMessage(
                "PersistentTokenBasedRememberMeServices.cookieStolen",
                "Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack."));
    }

    if(token.getDate().getTime()+getTokenValiditySeconds()*1000L<System
       .currentTimeMillis()){
        throw new RememberMeAuthenticationException("Remember-me login has expired");
    }

    // Token also matches, so login is valid. Update the token value, keeping the
    // *same* series number.
    if(logger.isDebugEnabled()){
        logger.debug("Refreshing persistent login token for user '"
                     +token.getUsername()+"', series '"+token.getSeries()+"'");
    }

    PersistentRememberMeToken newToken=new PersistentRememberMeToken(
        token.getUsername(),token.getSeries(),generateTokenData(),new Date());

    try{
        tokenRepository.updateToken(newToken.getSeries(),newToken.getTokenValue(),
                                    newToken.getDate());
        addCookie(newToken,request,response);
    }
    catch(Exception e){
        logger.error("Failed to update token: ",e);
        throw new RememberMeAuthenticationException(
            "Autologin failed due to data access problem");
    }

    return getUserDetailsService().loadUserByUsername(token.getUsername());
}

@RestController
public class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "hello";
    }

    @GetMapping("/admin")
    public String admin() {
        return "admin";
    }

    @GetMapping("/rememberme")
    public String rememberMe() {
        return "rememberMe";
    }
}

        http.authorizeRequests()
        .antMatchers("/rememberme").rememberMe()
        .antMatchers("/admin").fullyAuthenticated()
        .anyRequest().authenticated();

/**
 * 生成验证码工具类
 */
public class VerifyCode {
    private int width = 100;// 生成验证码图片的宽度
    private int height = 50;// 生成验证码图片的高度
    private String[] fontNames = {"宋体", "楷体", "隶书", "微软雅黑"};
    private Color bgColor = new Color(255, 255, 255);// 定义验证码图片的背景颜色为白色
    private Random random = new Random();
    private String codes = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
    private String text;// 记录随机字符串

    /**
     * 获取一个随意颜色
     *
     * @return
     */
    private Color randomColor() {
        int red = random.nextInt(150);
        int green = random.nextInt(150);
        int blue = random.nextInt(150);
        return new Color(red, green, blue);
    }

    /**
     * 获取一个随机字体
     *
     * @return
     */
    private Font randomFont() {
        String name = fontNames[random.nextInt(fontNames.length)];
        int style = random.nextInt(4);
        int size = random.nextInt(5) + 24;
        return new Font(name, style, size);
    }

    /**
     * 获取一个随机字符
     *
     * @return
     */
    private char randomChar() {
        return codes.charAt(random.nextInt(codes.length()));
    }

    /**
     * 创建一个空白的BufferedImage对象
     *
     * @return
     */
    private BufferedImage createImage() {
        BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_RGB);
        Graphics2D g2 = (Graphics2D) image.getGraphics();
        g2.setColor(bgColor);// 设置验证码图片的背景颜色
        g2.fillRect(0, 0, width, height);
        return image;
    }

    public BufferedImage getImage() {
        BufferedImage image = createImage();
        Graphics2D g2 = (Graphics2D) image.getGraphics();
        StringBuffer sb = new StringBuffer();
        for (int i = 0; i < 4; i++) {
            String s = randomChar() + "";
            sb.append(s);
            g2.setColor(randomColor());
            g2.setFont(randomFont());
            float x = i * width * 1.0f / 4;
            g2.drawString(s, x, height - 15);
        }
        this.text = sb.toString();
        drawLine(image);
        return image;
    }

    /**
     * 绘制干扰线
     *
     * @param image
     */
    private void drawLine(BufferedImage image) {
        Graphics2D g2 = (Graphics2D) image.getGraphics();
        int num = 5;
        for (int i = 0; i < num; i++) {
            int x1 = random.nextInt(width);
            int y1 = random.nextInt(height);
            int x2 = random.nextInt(width);
            int y2 = random.nextInt(height);
            g2.setColor(randomColor());
            g2.setStroke(new BasicStroke(1.5f));
            g2.drawLine(x1, y1, x2, y2);
        }
    }

    public String getText() {
        return text;
    }

    public static void output(BufferedImage image, OutputStream out) throws IOException {
        ImageIO.write(image, "JPEG", out);
    }
}

@RestController
public class VerifyCodeController {
    @GetMapping("/verifyCode")
    public void code(HttpServletRequest request, HttpServletResponse response) throws IOException {
        VerifyCode vc = new VerifyCode();
        BufferedImage image = vc.getImage();
        String text = vc.getText();
        HttpSession session = request.getSession();
        session.setAttribute("index_code", text);
        VerifyCode.output(image, response.getOutputStream());
    }
}

<body>
<img src="/verifyCode" alt=""/>
</body>

@Component
public class VerifyCodeFilter extends GenericFilterBean {

    private final String defaultLoginProcessingUrl = "/login";

    @Autowired
    private AuthenticationFailureHandler authenticationFailureHandler;

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse resp = (HttpServletResponse) response;

        // 判断当前请求是否为登录请求
        if ("POST".equalsIgnoreCase(req.getMethod()) && defaultLoginProcessingUrl.equals(req.getServletPath())) {
            // 校验验证码
            String code = request.getParameter("code");
            HttpSession session = req.getSession();
            if (session == null) {
                authenticationFailureHandler.onAuthenticationFailure(req, resp, new VerifyInvalidException("验证码错误"));
            }

            String codeInSession = (String) session.getAttribute("index_code");
            if (StringUtils.isEmpty(code)) {
                authenticationFailureHandler.onAuthenticationFailure(req, resp, new VerifyInvalidException("验证码不能为空"));
            }
            if (!codeInSession.equalsIgnoreCase(code)) {
                authenticationFailureHandler.onAuthenticationFailure(req, resp, new VerifyInvalidException("验证码错误"));
            }
        }
        chain.doFilter(req, resp);
    }
}

public class VerifyInvalidException extends AuthenticationException {

    public VerifyInvalidException(String msg, Throwable t) {
        super(msg, t);
    }

    public VerifyInvalidException(String msg) {
        super(msg);
    }
}

    protected void configure(HttpSecurity http)throws Exception{
        http.addFilterBefore(verifyCodeFilter,UsernamePasswordAuthenticationFilter.class);

@Bean
public AuthenticationFailureHandler authenticationFailureHandler(){
    return(request,response,exception)->{
        response.setContentType("application/json;charset=utf-8");
        response.setStatus(500);
        PrintWriter writer=response.getWriter();
        String responseMsg=null;
        if(exception instanceof VerifyInvalidException){
            responseMsg=exception.getMessage();
        }else if(exception instanceof BadCredentialsException){
            responseMsg="用户名或密码错误，请重新输入";
        }else if(exception instanceof LockedException){
            responseMsg="账户被锁定，请联系管理员";
        }else if(exception instanceof DisabledException){
            responseMsg="账户被禁用，请联系管理员";
        }else if(exception instanceof AccountExpiredException){
            responseMsg="账户过期，请联系管理员";
        }else{
            responseMsg="账户出现问题，请联系管理员....";
        }
        writer.write(responseMsg);
        writer.flush();
        writer.close();
};

.failureHandler(authenticationFailureHandler())

<form action="/login" method="post">
    用户名：<input type="text" name="username"> <br/>
    密码：<input type="password" name="password"> <br/>
    验证码：<input type="text" name="code"> <br/>
    <img src="/verifyCode" alt=""> <br/>
    <input type="submit" value="提交">
</form>

public void doFilter(ServletRequest req,ServletResponse res,FilterChain chain)
    throws IOException,ServletException{

    HttpServletRequest request=(HttpServletRequest)req;
    HttpServletResponse response=(HttpServletResponse)res;

    if(!requiresAuthentication(request,response)){
        chain.doFilter(request,response);

        return;
    }

    if(logger.isDebugEnabled()){
        logger.debug("Request is to process authentication");
    }

    Authentication authResult;

    try{
        authResult=attemptAuthentication(request,response);
        if(authResult==null){
            // return immediately as subclass has indicated that it hasn't completed
            // authentication
            return;
        }
        sessionStrategy.onAuthentication(authResult,request,response);
    }
    catch(InternalAuthenticationServiceException failed){
        logger.error(
            "An internal error occurred while trying to authenticate the user.",
            failed);
        unsuccessfulAuthentication(request,response,failed);

        return;
    }
    catch(AuthenticationException failed){
        // Authentication failed
        unsuccessfulAuthentication(request,response,failed);

        return;
    }

    // Authentication success
    if(continueChainBeforeSuccessfulAuthentication){
        chain.doFilter(request,response);
    }

    successfulAuthentication(request,response,chain,authResult);
}

public Authentication attemptAuthentication(HttpServletRequest request,
                                            HttpServletResponse response)throws AuthenticationException{
    if(postOnly&&!request.getMethod().equals("POST")){
        throw new AuthenticationServiceException(
            "Authentication method not supported: "+request.getMethod());
    }

    String username=obtainUsername(request);
    String password=obtainPassword(request);

    UsernamePasswordAuthenticationToken authRequest=new UsernamePasswordAuthenticationToken(
        username,password);

    // Allow subclasses to set the "details" property
    setDetails(request,authRequest);

    return this.getAuthenticationManager().authenticate(authRequest);
}

public Authentication authenticate(Authentication authentication)
    throws AuthenticationException{
    Class<?extends Authentication> toTest=authentication.getClass();
    AuthenticationException lastException=null;
    AuthenticationException parentException=null;
    Authentication result=null;
    Authentication parentResult=null;
    boolean debug=logger.isDebugEnabled();

    for(AuthenticationProvider provider:getProviders()){
        if(!provider.supports(toTest)){
            continue;
        }

        try{
            result=provider.authenticate(authentication);

            if(result!=null){
                copyDetails(authentication,result);
                break;
            }
        }
        catch(AccountStatusException|InternalAuthenticationServiceException e){

        }
    }

    if(result==null&&parent!=null){
        // Allow the parent to try.
        try{
            result=parentResult=parent.authenticate(authentication);
        }
        catch(ProviderNotFoundException e){

        }

        if(result!=null){
            if(eraseCredentialsAfterAuthentication
               &&(result instanceof CredentialsContainer)){
                ((CredentialsContainer)result).eraseCredentials();
            }

        }

    }

<dependency>
    <groupId>com.github.penggle</groupId>
    <artifactId>kaptcha</artifactId>
    <version>2.3.2</version>
</dependency>

@Bean
Producer verifyCode(){
    Properties properties=new Properties();
    properties.setProperty("kaptcha.image.width","150");
    properties.setProperty("kaptcha.image.height","50");
    properties.setProperty("kaptcha.textproducer.char.string","0123456789");
    properties.setProperty("kaptcha.textproducer.char.length","4");
    Config config=new Config(properties);
    DefaultKaptcha defaultKaptcha=new DefaultKaptcha();
    defaultKaptcha.setConfig(config);
    return defaultKaptcha;
}

@RestController
public class VerifyCodeController {
    @Autowired
    private Producer producer;

    @GetMapping("/vc.jpg")
    public void getVerifyCode(HttpServletRequest request, HttpServletResponse response) throws IOException {
        response.setContentType("images/jpeg");
        String text = producer.createText();
        request.getSession().setAttribute("verify_code", text);

        BufferedImage image = producer.createImage(text);
        try (ServletOutputStream out = response.getOutputStream()) {
            ImageIO.write(image, "jpg", out);
        }
    }

    @GetMapping("/loginSuccess")
    public String loginSuccess() {
        return "登录成功O(∩_∩)O";
    }
}

public class MyAuthenticationProvider extends DaoAuthenticationProvider {
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        HttpServletRequest req = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
        String code = req.getParameter("code");
        String verify_code = (String) req.getSession().getAttribute("verify_code");
        if (code == null || verify_code == null || !code.equals(verify_code)) {
            throw new AuthenticationServiceException("验证码错误");
        }
        return super.authenticate(authentication);
    }
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    PasswordEncoder passwordEncoder() {
        return NoOpPasswordEncoder.getInstance();
    }

    @Bean
    @Override
    protected UserDetailsService userDetailsService() {
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(User.withUsername("spencer").password("123").roles("admin").build());
        return manager;
    }

    @Bean
    MyAuthenticationProvider myAuthenticationProvider() {
        MyAuthenticationProvider provider = new MyAuthenticationProvider();
        provider.setUserDetailsService(userDetailsService());
        provider.setPasswordEncoder(passwordEncoder());
        return provider;
    }

    @Bean
    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
        ProviderManager providerManager = new ProviderManager(List.of(myAuthenticationProvider()));
        return providerManager;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/login.html", "/vc.jpg").permitAll()
                .anyRequest().authenticated();

        http.formLogin()
                .loginPage("/login.html")
                .loginProcessingUrl("/login")
                .defaultSuccessUrl("/loginSuccess", true)
                .failureHandler((request, response, exception) -> {
                    response.setContentType("application/json;charset=utf-8");
                    PrintWriter writer = response.getWriter();
                    writer.write(exception.getMessage());
                    writer.flush();
                    writer.close();
                })
                .permitAll()
                .and()
                .csrf().disable();
    }
}

public interface Authentication extends Principal, Serializable {
    Collection<? extends GrantedAuthority> getAuthorities();

    Object getCredentials();

    Object getDetails();

    Object getPrincipal();

    boolean isAuthenticated();

    void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException;
}

Stores additional details about the authentication request. These might be an IP address, certificate serial number etc.

        UsernamePasswordAuthenticationToken authRequest=new UsernamePasswordAuthenticationToken(
        username,password);

        setDetails(request,authRequest);

protected void setDetails(HttpServletRequest request,
        UsernamePasswordAuthenticationToken authRequest){
        authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
        }

public class WebAuthenticationDetailsSource implements
        AuthenticationDetailsSource<HttpServletRequest, WebAuthenticationDetails> {

    public WebAuthenticationDetails buildDetails(HttpServletRequest context) {
        return new WebAuthenticationDetails(context);
    }
}

    public WebAuthenticationDetails(HttpServletRequest request){
        this.remoteAddress=request.getRemoteAddr();

        HttpSession session=request.getSession(false);
        this.sessionId=(session!=null)?session.getId():null;
        }

@Component
public class MyWebAuthenticationDetailsSource extends WebAuthenticationDetailsSource {
    @Override
    public WebAuthenticationDetails buildDetails(HttpServletRequest context) {
        return new MyWebAuthenticationDetails(context);
    }
}

public class MyWebAuthenticationDetails extends WebAuthenticationDetails {

    private final Object something;

    public MyWebAuthenticationDetails(HttpServletRequest request) {
        super(request);
        something = request.getMethod();
    }

    public Object getSomething() {
        return something;
    }
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private MyWebAuthenticationDetailsSource myWebAuthenticationDetailsSource;

    @Bean
    PasswordEncoder passwordEncoder() {
        return NoOpPasswordEncoder.getInstance();
    }

    @Bean
    @Override
    protected UserDetailsService userDetailsService() {
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(User.withUsername("spencer").password("123").roles("admin").build());
        return manager;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/login.html", "/login", "/details").permitAll()
                .anyRequest().authenticated();

        http.formLogin()
                .loginPage("/login.html")
                .loginProcessingUrl("/login")
                .successHandler((request, response, authentication) -> {
                    response.setContentType("application/json;charset=utf-8");
                    PrintWriter out = response.getWriter();
                    out.write("登录成功");
                    out.flush();
                    out.close();
                })
                .failureHandler((request, response, exception) -> {
                    response.setContentType("application/json;charset=utf-8");
                    PrintWriter out = response.getWriter();
                    out.write("登录失败/(ㄒoㄒ)/~~");
                    out.flush();
                    out.close();
                })
                .authenticationDetailsSource(myWebAuthenticationDetailsSource)
                .and()
                .csrf().disable();
    }
}

@RestController
public class HelloController {
    @GetMapping("/details")
    public Map<String, Object> details(HttpServletRequest request) {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        WebAuthenticationDetails details = (WebAuthenticationDetails) authentication.getDetails();

        Map<String, Object> res = new HashMap<>(3);
        res.put("details", details);
        res.put("requestSessionId", request.getRequestedSessionId());
        res.put("session", request.getSession(false) == null ? null : request.getSession().getId());
        return res;
    }
}

@Override
protected void configure(HttpSecurity http)throws Exception{
        http.
        // 略
        .and().sessionManagement().maximumSessions(1);
        }

This session has been expired (possibly due to multiple concurrent logins being attempted as the same user).

@Override
protected void configure(HttpSecurity http)throws Exception{
        http.
        // 略
        .and().sessionManagement()
        .maximumSessions(1)
        .maxSessionsPreventsLogin(true);
        }

@Bean
HttpSessionEventPublisher httpSessionEventPublisher(){
        return new HttpSessionEventPublisher();
        }

Maximum sessions of 1 for this principal exceeded

public void sessionCreated(HttpSessionEvent event){
    HttpSessionCreatedEvent e=new HttpSessionCreatedEvent(event.getSession());
    getContext(event.getSession().getServletContext()).publishEvent(e);
}

public void sessionDestroyed(HttpSessionEvent event){
    HttpSessionDestroyedEvent e=new HttpSessionDestroyedEvent(event.getSession());
    getContext(event.getSession().getServletContext()).publishEvent(e);
}

public void doFilter(ServletRequest req,ServletResponse res,FilterChain chain)
    throws IOException,ServletException{
    HttpServletRequest request=(HttpServletRequest)req;
    HttpServletResponse response=(HttpServletResponse)res;
    if(!requiresAuthentication(request,response)){
        chain.doFilter(request,response);
        return;
    }
    Authentication authResult;
    try{
        authResult=attemptAuthentication(request,response);
        if(authResult==null){
            return;
        }
        sessionStrategy.onAuthentication(authResult,request,response);
    }
    catch(InternalAuthenticationServiceException failed){
        unsuccessfulAuthentication(request,response,failed);
        return;
    }
    catch(AuthenticationException failed){
        unsuccessfulAuthentication(request,response,failed);
        return;
    }
    // Authentication success
    if(continueChainBeforeSuccessfulAuthentication){
        chain.doFilter(request,response);
    }
    successfulAuthentication(request,response,chain,authResult);

public class ConcurrentSessionControlAuthenticationStrategy implements
        MessageSourceAware, SessionAuthenticationStrategy {
    public void onAuthentication(Authentication authentication,
                                 HttpServletRequest request, HttpServletResponse response) {

        final List<SessionInformation> sessions = sessionRegistry.getAllSessions(
                authentication.getPrincipal(), false);

        int sessionCount = sessions.size();
        int allowedSessions = getMaximumSessionsForThisUser(authentication);

        if (sessionCount < allowedSessions) {
            // They haven't got too many login sessions running at present
            return;
        }

        if (allowedSessions == -1) {
            // We permit unlimited logins
            return;
        }

        if (sessionCount == allowedSessions) {
            HttpSession session = request.getSession(false);

            if (session != null) {
                // Only permit it though if this request is associated with one of the
                // already registered sessions
                for (SessionInformation si : sessions) {
                    if (si.getSessionId().equals(session.getId())) {
                        return;
                    }
                }
            }
            // If the session is null, a new one will be created by the parent class,
            // exceeding the allowed number
        }

        allowableSessionsExceeded(sessions, allowedSessions, sessionRegistry);
    }

    protected void allowableSessionsExceeded(List<SessionInformation> sessions,
                                             int allowableSessions, SessionRegistry registry)
            throws SessionAuthenticationException {
        if (exceptionIfMaximumExceeded || (sessions == null)) {
            throw new SessionAuthenticationException(messages.getMessage(
                    "ConcurrentSessionControlAuthenticationStrategy.exceededAllowed",
                    new Object[]{allowableSessions},
                    "Maximum sessions of {0} for this principal exceeded"));
        }

        // Determine least recently used sessions, and mark them for invalidation
        sessions.sort(Comparator.comparing(SessionInformation::getLastRequest));
        int maximumSessionsExceededBy = sessions.size() - allowableSessions + 1;
        List<SessionInformation> sessionsToBeExpired = sessions.subList(0, maximumSessionsExceededBy);
        for (SessionInformation session : sessionsToBeExpired) {
            session.expireNow();
        }
    }
}

@Override
protected void configure(HttpSecurity http)throws Exception{
    http.authorizeRequests().anyRequest().authenticated();

    http.formLogin()
        .loginPage("/login.html")
        .loginProcessingUrl("/login") // 使用security默认的登录处理
        // 略...
        .permitAll()
        .and()
        .csrf().disable()
        // 略...
        .and().sessionManagement()
        .maximumSessions(1)
        .maxSessionsPreventsLogin(true);
}

public class SessionRegistryImpl implements SessionRegistry,
        ApplicationListener<SessionDestroyedEvent> {

    /** <principal:Object,SessionIdSet> */
    private final ConcurrentMap<Object, Set<String>> principals;
    /** <sessionId:Object,SessionInformation> */
    private final Map<String, SessionInformation> sessionIds;

    public void registerNewSession(String sessionId, Object principal) {
        if (getSessionInformation(sessionId) != null) {
            removeSessionInformation(sessionId);
        }
        sessionIds.put(sessionId,
                new SessionInformation(principal, sessionId, new Date()));

        principals.compute(principal, (key, sessionsUsedByPrincipal) -> {
            if (sessionsUsedByPrincipal == null) {
                sessionsUsedByPrincipal = new CopyOnWriteArraySet<>();
            }
            sessionsUsedByPrincipal.add(sessionId);
            return sessionsUsedByPrincipal;
        });
    }

    public void removeSessionInformation(String sessionId) {
        SessionInformation info = getSessionInformation(sessionId);
        if (info == null) {
            return;
        }
        sessionIds.remove(sessionId);
        principals.computeIfPresent(info.getPrincipal(), (key, sessionsUsedByPrincipal) -> {
            sessionsUsedByPrincipal.remove(sessionId);
            if (sessionsUsedByPrincipal.isEmpty()) {
                sessionsUsedByPrincipal = null;
            }
            return sessionsUsedByPrincipal;
        });
    }

}

public class User implements UserDetails, CredentialsContainer {
    private String password;
    private final String username;
    private final Set<GrantedAuthority> authorities;
    private final boolean accountNonExpired;
    private final boolean accountNonLocked;
    private final boolean credentialsNonExpired;
    private final boolean enabled;

    @Override
    public boolean equals(Object rhs) {
        if (rhs instanceof User) {
            return username.equals(((User) rhs).username);
        }
        return false;
    }

    @Override
    public int hashCode() {
        return username.hashCode();
    }
}

@Entity(name = "t_user")
public class User implements UserDetails {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String username;
    private String password;
    private boolean accountNonExpired;
    private boolean accountNonLocked;
    private boolean credentialsNonExpired;
    private boolean enabled;

    // 略...

    @Override
    public boolean equals(Object o) {
        if (this == o) return true;
        if (o == null || getClass() != o.getClass()) return false;
        User user = (User) o;
        return Objects.equals(username, user.username);
    }

    @Override
    public int hashCode() {
        return Objects.hash(username);
    }
}

public class StrictHttpFirewall implements HttpFirewall {
    private Set<String> allowedHttpMethods = createDefaultAllowedHttpMethods();

    private static Set<String> createDefaultAllowedHttpMethods() {
        Set<String> result = new HashSet<>();
        result.add(HttpMethod.DELETE.name());
        result.add(HttpMethod.GET.name());
        result.add(HttpMethod.HEAD.name());
        result.add(HttpMethod.OPTIONS.name());
        result.add(HttpMethod.PATCH.name());
        result.add(HttpMethod.POST.name());
        result.add(HttpMethod.PUT.name());
        return result;
    }

    private void rejectForbiddenHttpMethod(HttpServletRequest request) {
        if (this.allowedHttpMethods == ALLOW_ANY_HTTP_METHOD) {
            return;
        }
        if (!this.allowedHttpMethods.contains(request.getMethod())) {
            throw new RequestRejectedException("The request was rejected because the HTTP method \"" +
                    request.getMethod() +
                    "\" was not included within the whitelist " +
                    this.allowedHttpMethods);
        }
    }
}

# 发送一个 TRACE 请求
curl  -v -X TRACE http://localhost:8080/hello

# 返回 405 ， method not allow
<!doctype html><html lang="en"><head><title>HTTP Status 405 – Method Not Allowed</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 405 – Method Not Allowed</h1></body></html>* Connection #0 to host localhost left intact

# java后台报错
org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the HTTP method "TRACE" was not included within the whitelist [HEAD, DELETE, POST, GET, OPTIONS, PATCH, PUT]

    @Bean
    HttpFirewall httpFirewall(){
            StrictHttpFirewall strictHttpFirewall=new StrictHttpFirewall();
            strictHttpFirewall.setUnsafeAllowAnyHttpMethod(true);
            return strictHttpFirewall;
            }

org.springframework.security.web.firewall.RequestRejectedException:The request was rejected because the URL contained a potentially malicious String";"

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {

    @Override
    public void configurePathMatch(PathMatchConfigurer configurer) {
        UrlPathHelper urlPathHelper = new UrlPathHelper();
        urlPathHelper.setRemoveSemicolonContent(false);
        configurer.setUrlPathHelper(urlPathHelper);
    }
}

@Bean
HttpFirewall httpFirewall(){
    StrictHttpFirewall firewall=new StrictHttpFirewall();
    firewall.setAllowSemicolon(true);
    return firewall;
}

@RestController
public class HelloController {
    @RequestMapping(value = "/hello/{id}")
    public String hello(@PathVariable Integer id, @MatrixVariable String name) {
        System.out.println("id = " + id);
        System.out.println("name = " + name);
        return "hello";
    }
}

private static boolean isNormalized(HttpServletRequest request){
    if(!isNormalized(request.getRequestURI())){
        return false;
    }
    if(!isNormalized(request.getContextPath())){
        return false;
    }
    if(!isNormalized(request.getServletPath())){
        return false;
    }
    if(!isNormalized(request.getPathInfo())){
        return false;
    }
    return true;
}

private static boolean containsOnlyPrintableAsciiCharacters(String uri){
    int length=uri.length();
    for(int i=0;i<length; i++){
        char c=uri.charAt(i);
        if(c< '\u0020'||c>'\u007e'){
            return false;
        }
    }

    return true;
}

org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String "//"

@Bean
HttpFirewall httpFirewall(){
    StrictHttpFirewall firewall=new StrictHttpFirewall();
    firewall.setAllowUrlEncodedDoubleSlash(true);
    return firewall;
}

@Bean
HttpFirewall httpFirewall(){
    StrictHttpFirewall firewall=new StrictHttpFirewall();
    firewall.setAllowUrlEncodedPercent(true);
    return firewall;
}

@Bean
HttpFirewall httpFirewall() {
    StrictHttpFirewall firewall = new StrictHttpFirewall();
    firewall.setAllowBackSlash(true);
    firewall.setAllowUrlEncodedSlash(true);
    return firewall;
}

@Bean
HttpFirewall httpFirewall() {
    StrictHttpFirewall firewall = new StrictHttpFirewall();
    firewall.setAllowUrlEncodedPeriod(true);
    return firewall;
}

public class StrictHttpFirewall implements HttpFirewall {
 @Override
 public FirewalledRequest getFirewalledRequest(HttpServletRequest request) throws RequestRejectedException {
  rejectForbiddenHttpMethod(request);
  rejectedBlacklistedUrls(request);
  rejectedUntrustedHosts(request);

  if (!isNormalized(request)) {
   throw new RequestRejectedException("The request was rejected because the URL was not normalized.");
  }

  String requestUri = request.getRequestURI();
  if (!containsOnlyPrintableAsciiCharacters(requestUri)) {
   throw new RequestRejectedException("The requestURI was rejected because it can only contain printable ASCII characters.");
  }
  return new FirewalledRequest(request) {
   @Override
   public void reset() {
   }
  };
 }
 private void rejectedBlacklistedUrls(HttpServletRequest request) {
  for (String forbidden : this.encodedUrlBlacklist) {
   if (encodedUrlContains(request, forbidden)) {
    throw new RequestRejectedException("The request was rejected because the URL contained a potentially malicious String \"" + forbidden + "\"");
   }
  }
  for (String forbidden : this.decodedUrlBlacklist) {
   if (decodedUrlContains(request, forbidden)) {
    throw new RequestRejectedException("The request was rejected because the URL contained a potentially malicious String \"" + forbidden + "\"");
   }
  }
 }
 private static boolean encodedUrlContains(HttpServletRequest request, String value) {
  if (valueContains(request.getContextPath(), value)) {
   return true;
  }
  return valueContains(request.getRequestURI(), value);
 }

 private static boolean decodedUrlContains(HttpServletRequest request, String value) {
  if (valueContains(request.getServletPath(), value)) {
   return true;
  }
  if (valueContains(request.getPathInfo(), value)) {
   return true;
  }
  return false;
 }
 private static boolean valueContains(String value, String contains) {
  return value != null && value.contains(contains);
 }
}

http://www.taobao.com;jsessionid=xxxx

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-redis</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.session</groupId>
        <artifactId>spring-session-data-redis</artifactId>
    </dependency>
</dependencies>

<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-pool2</artifactId>
</dependency>

spring:
  session:
    redis:
      flush-mode: on_save
      namespace: spring.example
    store-type: redis
    timeout: 1800

  redis:
    host: XXX.XXX.XXX.XX
    port: 6379
    database: 2
    lettuce:
      pool:
        max-active: 8

  security:
    user:
      name: user
      password: 123

@Configuration
public class CustomRedisConfig {

    private final ObjectMapper objectMapper = new ObjectMapper();

    @Bean
    public RedisSerializer<Object> redisSerializer() {
        ObjectMapper om = objectMapper.copy();

        om.setVisibility(PropertyAccessor.ALL, JsonAutoDetect.Visibility.ANY);
        om.registerModule(new CoreJackson2Module());
        om.registerModule(new WebJackson2Module());
        om.registerModule(new WebServletJackson2Module());
        om.registerModule(new WebServerJackson2Module());

        SecurityJackson2Modules.enableDefaultTyping(om);
        return new GenericJackson2JsonRedisSerializer(om);
    }

    @Bean
    public RedisTemplate<Object, Object> redisTemplate(RedisConnectionFactory factory) {
        RedisTemplate<Object, Object> redisTemplate = new RedisTemplate<>();
        redisTemplate.setConnectionFactory(factory);
        redisTemplate.setKeySerializer(new StringRedisSerializer());
        redisTemplate.setHashKeySerializer(new StringRedisSerializer());
        redisTemplate.setDefaultSerializer(redisSerializer());
        redisTemplate.afterPropertiesSet();
        return redisTemplate;
    }
}

@Configuration
@EnableRedisHttpSession
public class CustomRedisHttpSessionConfig {

    private final RedisSerializer<Object> redisSerializer;

    public CustomRedisHttpSessionConfig(RedisSerializer<Object> redisSerializer) {
        this.redisSerializer = redisSerializer;
    }

    /**
     * 修改 SpringSession redis 序列化方式
     * 注意这个beanName必须是 springSessionDefaultRedisSerializer
     * @return
     */
    @Bean
    public RedisSerializer springSessionDefaultRedisSerializer() {
        return redisSerializer;
    }

    @Bean
    public HttpSessionEventPublisher httpSessionEventPublisher() {
        return new HttpSessionEventPublisher();
    }
}

DROP TABLE IF EXISTS `t_role`;
CREATE TABLE `t_role`
(
    `id`      bigint(20) NOT NULL AUTO_INCREMENT,
    `name`    varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
    `name_zh` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
    PRIMARY KEY (`id`) USING BTREE
) ENGINE = MyISAM AUTO_INCREMENT = 3 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;

-- ----------------------------
-- Records of t_role
-- ----------------------------
INSERT INTO `t_role`
VALUES (1, 'ROLE_admin', '管理员');
INSERT INTO `t_role`
VALUES (2, 'ROLE_user', '普通用户');

-- ----------------------------
-- Table structure for t_user
-- ----------------------------
DROP TABLE IF EXISTS `t_user`;
CREATE TABLE `t_user`
(
    `id`                      bigint(20) NOT NULL AUTO_INCREMENT,
    `account_non_expired`     bit(1) NOT NULL,
    `account_non_locked`      bit(1) NOT NULL,
    `credentials_non_expired` bit(1) NOT NULL,
    `enabled`                 bit(1) NOT NULL,
    `password`                varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
    `username`                varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
    PRIMARY KEY (`id`) USING BTREE
) ENGINE = MyISAM AUTO_INCREMENT = 3 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Dynamic;

-- ----------------------------
-- Records of t_user
-- ----------------------------
INSERT INTO `t_user`
VALUES (1, b'1', b'1', b'1', b'1', '123', 'spencer');
INSERT INTO `t_user`
VALUES (2, b'1', b'1', b'1', b'1', '123', 'maqb');

-- ----------------------------
-- Table structure for t_user_roles
-- ----------------------------
DROP TABLE IF EXISTS `t_user_roles`;
CREATE TABLE `t_user_roles`
(
    `t_user_id` bigint(20) NOT NULL,
    `roles_id`  bigint(20) NOT NULL,
    INDEX       `FKj47yp3hhtsoajht9793tbdrp4`(`roles_id`) USING BTREE,
    INDEX       `FK7l00c7jb4804xlpmk1k26texy`(`t_user_id`) USING BTREE
) ENGINE = MyISAM CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Fixed;

-- ----------------------------
-- Records of t_user_roles
-- ----------------------------
INSERT INTO `t_user_roles`
VALUES (1, 1);
INSERT INTO `t_user_roles`
VALUES (2, 2);

SET
FOREIGN_KEY_CHECKS = 1;

public class User implements UserDetails {

    private Long id;
    private String username;
    private String password;
    private boolean accountNonExpired;
    private boolean accountNonLocked;
    private boolean credentialsNonExpired;
    private boolean enabled;
    private List<Role> roles;

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        if (getRoles() == null) {
            return null;
        }
        List<SimpleGrantedAuthority> authorities = new ArrayList<>();
        for (Role role : getRoles()) {
            authorities.add(new SimpleGrantedAuthority(role.getName()));
        }
        return authorities;
    }

    // 略...
}

public class Role implements Serializable {

    private Long id;
    private String name;
    private String nameZh;

    // getter and setter
}

@Service
public class UserService implements UserDetailsService {

    @Resource
    private UserMapper userMapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userMapper.selectOneUserWithRoleByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("用户名不存在");
        }
        return user;
    }
}

org.springframework.data.redis.serializer.SerializationException: Could not read JSON: The class with com.mqb.model.User and name of com.mqb.model.User is not whitelisted. 

If you believe this class is safe to deserialize, please provide an explicit mapping using Jackson annotations or by providing a Mixin. If the serialization is only done by a trusted source, you can also enable default typing. See https://github.com/spring-projects/spring-security/issues/4370 for details 

    @Override
public void setupModule(SetupContext context){
        SecurityJackson2Modules.enableDefaultTyping(context.getOwner());
        // 略...
        context.setMixInAnnotations(SimpleGrantedAuthority.class,SimpleGrantedAuthorityMixin.class);
        context.setMixInAnnotations(User.class,UserMixin.class);
        // 略...
        }

@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
@JsonDeserialize(using = UserDeserializer.class)
@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
        isGetterVisibility = JsonAutoDetect.Visibility.NONE)
@JsonIgnoreProperties(ignoreUnknown = true)
abstract class UserMixin {
}

@Configuration
public class CustomRedisConfig {

    private final ObjectMapper objectMapper = new ObjectMapper();

    @Bean
    public RedisSerializer<Object> redisSerializer() {
        ObjectMapper om = objectMapper.copy();

        om.setVisibility(PropertyAccessor.ALL, JsonAutoDetect.Visibility.ANY);
        om.registerModule(new CoreJackson2Module());
        om.registerModule(new WebJackson2Module());
        om.registerModule(new WebServletJackson2Module());
        om.registerModule(new WebServerJackson2Module());

        om.registerModule(new CustomModule());

        SecurityJackson2Modules.enableDefaultTyping(om);
        return new GenericJackson2JsonRedisSerializer(om);
    }

    // 略...
}

org.hibernate.collection.internal.PersistentBag and name of org.hibernate.collection.internal.PersistentBag is not whitelisted....

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    FindByIndexNameSessionRepository sessionRepository;

    @Bean
    SpringSessionBackedSessionRegistry sessionRegistry() {
        return new SpringSessionBackedSessionRegistry(sessionRepository);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.sessionManagement().maximumSessions(1)
                .maxSessionsPreventsLogin(true).sessionRegistry(sessionRegistry());
    }

spring:
  security:
    user:
      name: spencer
      password: 123

@RestController
public class HelloController {
    @PostMapping("/transfer")
    public void transferMoney(String name, Double money) {
        System.out.println("给【" + name + "】转了【" + money + "】元");
    }

    @GetMapping("/hello")
    public String hello() {
        return "hello";
    }
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();
    }
}

server:
  port: 8081

<body>
<h3>危险网站</h3>
<form action="http://localhost:8080/transfer" method="post">
    <input type="hidden" value="huff" name="name">
    <input type="hidden" value="10000" name="money">
    <input type="submit" value="点击查看美女图片">
</form>
</body>

spring:
  security:
    user:
      name: spencer
      password: 123

@Controller
public class HelloController {
    @PostMapping("/hello")
    @ResponseBody
    public String hello() {
        return "hello";
    }

    @GetMapping("/hello")
    public String hello2() {
        return "hello";
    }
}

<body>
<form action="/hello" method="post">
    <input type="hidden" th:value="${_csrf.token}" th:name="${_csrf.parameterName}">
    <input type="submit" value="hello">
</form>
</body>

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated()
                .and()
                .formLogin()
                .and()
                .csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
    }
}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
    <script src="js/jquery.min.js"></script>
    <script src="js/jquery.cookie.js"></script>
</head>
<body>
<div>
    <input type="text" id="username">
    <input type="password" id="password">
    <input type="button" value="登录" id="loginBtn">
</div>
<script>
    $("#loginBtn").click(function () {
        let _csrf = $.cookie('XSRF-TOKEN');
        $.post('/login.html', {
            username: $("#username").val(),
            password: $("#password").val(),
            _csrf: _csrf
        }, function (data) {
            alert(data);
        })
    })
</script>
</body>
</html>

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/js/**");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login.html")
                .successHandler((req,resp,authentication)->{
                    resp.getWriter().write("success");
                })
                .permitAll()
                .and()
                .csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
    }
}

<dependency>
    <groupId>commons-codec</groupId>
    <artifactId>commons-codec</artifactId>
</dependency>

@Component
public class MyPasswordEncoder implements PasswordEncoder {

    @Override
    public String encode(CharSequence rawPassword) {
        return DigestUtils.md5Hex(rawPassword.toString());
    }

    @Override
    public boolean matches(CharSequence rawPassword, String encodedPassword) {
        return encodedPassword.equals(DigestUtils.md5Hex(rawPassword.toString()));
    }
}

@Bean
PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder(10);
        }

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Bean
    PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("spencer")
                .password("$2a$10$qF6JeBrhLsXmB18Mh4VarOsWTkAS4dWIapvXdWmzRcDXQWmMk/Ahy")
                .roles("admin")
                .and()
                .withUser("maqb")
                .password("$2a$10$miKjLcPXLeWNS8UJEzjJQO/ecFS2nBXHIWgXgInOHPYYea4bt1PKa")
                .roles("user");
    }
}

keytool -genkey -alias casserver -keyalg RSA -keystore ./keystore

server.ssl.key-store=classpath:keystore
server.ssl.key-store-password=111111
server.ssl.key-password=111111

build.cmd bootrun		// windows 环境
./build.sh bootrun		// linux 环境

cas.authn.accept.users=casuser::Mellon

src/main/resources/services

{
  "@class": "org.apereo.cas.services.RegexRegisteredService",
  "serviceId": "^(https|http)://.*",
  "name": "client1",
  "id": 99,
  "description": "应用1 的定义信息",
  "evaluationOrder": 1
}

cas.serviceRegistry.json.location=classpath:/services
cas.serviceRegistry.initFromJson=true

keytool -export -alias casserver -file cassser.cer -keystore ./keystore -rfc

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-cas</artifactId>
</dependency>

cas:
  server:
    prefix: https://cas.maqb.org:8443/cas
    login: ${cas.server.prefix}/login
    logout: ${cas.server.prefix}/logout

  client:
    prefix: http://client1.cas.maqb.org:8080
    login: ${cas.client.prefix}/login/cas
    logoutRelative: /logout/cas
    logout: ${cas.client.prefix}${cas.client.logoutRelative}

@ConfigurationProperties(prefix = "cas.server")
public class CASServerProperties {
    private String prefix;
    private String login;
    private String logout;
    //省略 getter/setter
}
@ConfigurationProperties(prefix = "cas.client")
public class CASClientProperties {
    private String prefix;
    private String login;
    private String logoutRelative;
    private String logout;
    //省略 getter/setter
}

@SpringBootApplication
@EnableConfigurationProperties({CasServerProperties.class, CasClientProperties.class})
public class Client1Application {

    public static void main(String[] args) {
        SpringApplication.run(Client1Application.class, args);
    }
}

@Configuration
public class CasSecurityConfig {
    @Autowired
    CASClientProperties casClientProperties;
    @Autowired
    CASServerProperties casServerProperties;
    @Autowired
    UserDetailsService userDetailService;

    @Bean
    ServiceProperties serviceProperties() {
        ServiceProperties serviceProperties = new ServiceProperties();
        serviceProperties.setService(casClientProperties.getLogin());
        return serviceProperties;
    }

    @Bean
    @Primary
    AuthenticationEntryPoint authenticationEntryPoint() {
        CasAuthenticationEntryPoint entryPoint = new CasAuthenticationEntryPoint();
        entryPoint.setLoginUrl(casServerProperties.getLogin());
        entryPoint.setServiceProperties(serviceProperties());
        return entryPoint;
    }

    @Bean
    TicketValidator ticketValidator() {
        return new Cas20ProxyTicketValidator(casServerProperties.getPrefix());
    }

    @Bean
    CasAuthenticationProvider casAuthenticationProvider() {
        CasAuthenticationProvider provider = new CasAuthenticationProvider();
        provider.setServiceProperties(serviceProperties());
        provider.setTicketValidator(ticketValidator());
        provider.setUserDetailsService(userDetailService);
        provider.setKey("javaboy");
        return provider;
    }

    @Bean
    CasAuthenticationFilter casAuthenticationFilter(AuthenticationProvider authenticationProvider) {
        CasAuthenticationFilter filter = new CasAuthenticationFilter();
        filter.setServiceProperties(serviceProperties());
        filter.setAuthenticationManager(new ProviderManager(authenticationProvider));
        return filter;
    }

    @Bean
    SingleSignOutFilter singleSignOutFilter() {
        SingleSignOutFilter sign = new SingleSignOutFilter();
        sign.setIgnoreInitConfiguration(true);
        return sign;
    }
    @Bean
    LogoutFilter logoutFilter() {
        LogoutFilter filter = new LogoutFilter(casServerProperties.getLogout(), new SecurityContextLogoutHandler());
        filter.setFilterProcessesUrl(casClientProperties.getLogoutRelative());
        return filter;
    }
}

@Component
@Primary
public class UserDetailsServiceImpl implements UserDetailsService{

    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
        return new User(s, "123", true, true, true, true,
                AuthorityUtils.createAuthorityList("ROLE_user"));
    }
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    AuthenticationEntryPoint authenticationEntryPoint;
    @Autowired
    AuthenticationProvider authenticationProvider;
    @Autowired
    SingleSignOutFilter singleSignOutFilter;
    @Autowired
    LogoutFilter logoutFilter;
    @Autowired
    CasAuthenticationFilter casAuthenticationFilter;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/user/**")
                .hasRole("user")
                .antMatchers("/login/cas").permitAll()
                .anyRequest().authenticated()
                .and()
                .exceptionHandling()
                .authenticationEntryPoint(authenticationEntryPoint)
                .and()
                .addFilter(casAuthenticationFilter)
                .addFilterBefore(singleSignOutFilter, CasAuthenticationFilter.class)
                .addFilterBefore(logoutFilter, LogoutFilter.class);
    }
}

@RestController
public class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "hello";
    }
    @GetMapping("/user/hello")
    public String user() {
        return "user";
    }
}

127.0.0.1	cas.maqb.org
127.0.0.1	client1.cas.maqb.org