@Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
        if (postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException(
                    "Authentication method not supported: " + request.getMethod());
        }
        //獲取表單中的用户名和密碼
        String username = obtainUsername(request);
        String password = obtainPassword(request);
        if (username == null) {
            username = "";
        }
        if (password == null) {
            password = "";
        }
        username = username.trim();
        //組裝成username+password形式的token
        UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
                username, password);
        // Allow subclasses to set the "details" property
        setDetails(request, authRequest);
        //交給內部的AuthenticationManager去認證，並返回認證信息
        return this.getAuthenticationManager().authenticate(authRequest);
    }

@Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        logger.debug("權限框架-加載用户");
        List<GrantedAuthority> auths = new ArrayList<>();

        BaseUser baseUser = new BaseUser();
        baseUser.setUserName(username);
        baseUser = baseUserService.selectOne(baseUser);

        if (baseUser == null) {
            logger.debug("找不到該用户 用户名:{}", username);
            throw new UsernameNotFoundException("找不到該用户！");
        }
        if(baseUser.getStatus()==2)
        {
            logger.debug("用户被禁用，無法登陸 用户名:{}", username);
            throw new UsernameNotFoundException("用户被禁用！");
        }
        List<BaseRole> roles = baseRoleService.selectRolesByUserId(baseUser.getId());
        if (roles != null) {
            //設置角色名稱
            for (BaseRole role : roles) {
                SimpleGrantedAuthority authority = new SimpleGrantedAuthority(role.getRoleCode());
                auths.add(authority);
            }
        }

        return new org.springframework.security.core.userdetails.User(baseUser.getUserName(), baseUser.getUserPassword(), true, true, true, true, auths);
    }

public class CustomSecurityInterceptor extends AbstractSecurityInterceptor implements Filter {
    private FilterInvocationSecurityMetadataSource securityMetadataSource;
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        FilterInvocation fi = new FilterInvocation(request, response, chain);
        invoke(fi);
    }
    @Override
    public void destroy() {
    }
    @Override
    public Class<?> getSecureObjectClass() {
        return FilterInvocation.class;
    }
    @Override
    public SecurityMetadataSource obtainSecurityMetadataSource() {
        return this.securityMetadataSource;
    }
    public void invoke(FilterInvocation fi) throws IOException {
        InterceptorStatusToken token = super.beforeInvocation(fi);
        try {
            fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
        } catch (ServletException e) {
            super.afterInvocation(token, null);
        }
    }
    public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {
        return securityMetadataSource;
    }

    public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource securityMetadataSource) {
        this.securityMetadataSource = securityMetadataSource;
    }
}

@Override
    public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
        //獲取當前訪問url
        String url = ((FilterInvocation) object).getRequestUrl();
        int firstQuestionMarkIndex = url.indexOf("?");
        if (firstQuestionMarkIndex != -1) {
            url = url.substring(0, firstQuestionMarkIndex);
        }
        List<ConfigAttribute> result = new ArrayList<>();

        try {
            //設置不攔截
            if (propertySourceBean.getProperty("security.ignoring") != null) {
                String[] paths = propertySourceBean.getProperty("security.ignoring").toString().split(",");
                //判斷是否符合規則
                for (String path: paths) {
                    String temp = StringUtil.clearSpace(path);
                    if (matcher.match(temp, url)) {
                        return SecurityConfig.createList("ROLE_ANONYMOUS");
                    }
                }
            }

            //如果不是攔截列表裏的, 默認需要ROLE_ANONYMOUS權限
            if (!isIntercept(url)) {
                return SecurityConfig.createList("ROLE_ANONYMOUS");
            }

            //查詢數據庫url匹配的菜單
            List<BaseMenu> menuList = baseMenuService.selectMenusByUrl(url);
            if (menuList != null && menuList.size() > 0) {
                for (BaseMenu menu : menuList) {
                    //查詢擁有該菜單權限的角色列表
                    List<BaseRole> roles = baseRoleService.selectRolesByMenuId(menu.getId());
                    if (roles != null && roles.size() > 0) {
                        for (BaseRole role : roles) {
                            ConfigAttribute conf = new SecurityConfig(role.getRoleCode());
                            result.add(conf);
                        }
                    }
                }
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
        return result;
    }

     /**
     * 判斷是否需要過濾
     * @param url
     * @return
     */
    public boolean isIntercept(String url) {
        String[] filterPaths = propertySourceBean.getProperty("security.intercept").toString().split(",");
        for (String filter: filterPaths) {
            if (matcher.match(StringUtil.clearSpace(filter), url) & !matcher.match(indexUrl, url)) {
                return true;
            }
        }

        return false;
    }

@Override
    public void decide(Authentication authentication, Object o, Collection<ConfigAttribute> collection) throws AccessDeniedException, InsufficientAuthenticationException {
        if (collection == null) {
            return;
        }
        for (ConfigAttribute configAttribute : collection) {
            String needRole = configAttribute.getAttribute();
            for (GrantedAuthority ga : authentication.getAuthorities()) {
                if (needRole.trim().equals(ga.getAuthority().trim()) || needRole.trim().equals("ROLE_ANONYMOUS")) {
                    return;
                }
            }
        }
        throw new AccessDeniedException("無權限！");
    }

/**
 * spring-security配置
 */
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    private final Logger logger = LoggerFactory.getLogger(this.getClass());

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private PropertySource propertySourceBean;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        logger.debug("權限框架配置");

        String[] paths = null;
        //設置不攔截
        if (propertySourceBean.getProperty("security.ignoring") != null) {
            paths = propertySourceBean.getProperty("security.ignoring").toString().split(",");
            paths = StringUtil.clearSpace(paths);
        }

        //設置過濾器
        http    // 根據配置文件放行無需驗證的url
                .authorizeRequests().antMatchers(paths).permitAll()
                .and()
                .httpBasic()
                // 配置驗證異常處理
                .authenticationEntryPoint(getCustomLoginAuthEntryPoint())
                // 配置登陸過濾器
                .and().addFilterAt(getCustomLoginFilter(), UsernamePasswordAuthenticationFilter.class)
                // 配置 AbstractSecurityInterceptor
                .addFilterAt(getCustomSecurityInterceptor(), FilterSecurityInterceptor.class)
                // 登出成功處理
                .logout().logoutSuccessHandler(getCustomLogoutSuccessHandler())
                // 關閉csrf
                .and().csrf().disable()
                // 其他所有請求都需要驗證
                .authorizeRequests().anyRequest().authenticated()
                // 配置登陸url, 登陸頁面並無需驗證
                .and().formLogin().loginProcessingUrl("/login").loginPage("/login.ftl").permitAll()
                // 登出
                .and().logout().logoutUrl("/logout").permitAll();
        
        logger.debug("配置忽略驗證url");

    }

    @Autowired
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.authenticationProvider(getDaoAuthenticationProvider());
    }


    /**
     * spring security 配置
     * @return
     */
    @Bean
    public CustomLoginAuthEntryPoint getCustomLoginAuthEntryPoint() {
        return new CustomLoginAuthEntryPoint();
    }

    /**
     * 用户驗證
     * @return
     */
    @Bean
    public DaoAuthenticationProvider getDaoAuthenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setUserDetailsService(userDetailsService);
        provider.setHideUserNotFoundExceptions(false);
        provider.setPasswordEncoder(new BCryptPasswordEncoder());
        return provider;
    }

    /**
     * 登陸
     * @return
     */
    @Bean
    public CustomLoginFilter getCustomLoginFilter() {
        CustomLoginFilter filter = new CustomLoginFilter();
        try {
            filter.setAuthenticationManager(this.authenticationManagerBean());
        } catch (Exception e) {
            e.printStackTrace();
        }
        filter.setAuthenticationSuccessHandler(getCustomLoginAuthSuccessHandler());
        filter.setAuthenticationFailureHandler(new CustomLoginAuthFailureHandler());

        return filter;
    }

    @Bean
    public CustomLoginAuthSuccessHandler getCustomLoginAuthSuccessHandler() {
        CustomLoginAuthSuccessHandler handler =  new CustomLoginAuthSuccessHandler();
        if (propertySourceBean.getProperty("security.successUrl")!=null){
            handler.setAuthSuccessUrl(propertySourceBean.getProperty("security.successUrl").toString());
        }
        return handler;
    }

    /**
     * 登出
     * @return
     */
    @Bean
    public CustomLogoutSuccessHandler getCustomLogoutSuccessHandler() {
        CustomLogoutSuccessHandler handler = new CustomLogoutSuccessHandler();
        if (propertySourceBean.getProperty("security.logoutSuccessUrl")!=null){
            handler.setLoginUrl(propertySourceBean.getProperty("security.logoutSuccessUrl").toString());
        }
        return handler;
    }

    /**
     * 過濾器
     * @return
     */
    @Bean
    public CustomSecurityInterceptor getCustomSecurityInterceptor() {
        CustomSecurityInterceptor interceptor = new CustomSecurityInterceptor();
        interceptor.setAccessDecisionManager(new CustomAccessDecisionManager());
        interceptor.setSecurityMetadataSource(getCustomMetadataSourceService());
        try {
            interceptor.setAuthenticationManager(this.authenticationManagerBean());
        } catch (Exception e) {
            e.printStackTrace();
        }
        return interceptor;
    }
    
    @Bean
    public CustomMetadataSourceService getCustomMetadataSourceService() {
        CustomMetadataSourceService sourceService = new CustomMetadataSourceService();
        if (propertySourceBean.getProperty("security.successUrl")!=null){
            sourceService.setIndexUrl(propertySourceBean.getProperty("security.successUrl").toString());
        }
        return sourceService;
    }
}

package com.hxkj.waychat.intercept.listener;
 
import javax.servlet.ServletContextEvent;
import javax.servlet.ServletContextListener;
import javax.servlet.annotation.WebListener;
 
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
 
import com.hxkj.waychat.core.config.Constant;
import com.hxkj.waychat.core.utils.PropertiesUtils;
 
@WebListener
public class ThymeleafServletContextListener implements ServletContextListener {
 
private static Logger logger = LoggerFactory.getLogger(ThymeleafServletContextListener.class);
 
@Override
public void contextDestroyed(ServletContextEvent arg0) {
logger.info("----------:ServletContext銷燬");
}
 
@Override
public void contextInitialized(ServletContextEvent arg0) {
logger.info("----------:ServletContext初始化");
logger.info("----------:baseUrl:"+PropertiesUtils.getPropertiesValue(Constant.BASE_URL)+";fileUrl:"+PropertiesUtils.getPropertiesValue(Constant.FILE_URL));
arg0.getServletContext().setAttribute("baseUrl", PropertiesUtils.getPropertiesValue(Constant.BASE_URL));
arg0.getServletContext().setAttribute("fileUrl", PropertiesUtils.getPropertiesValue(Constant.FILE_URL));
}
 
}
 
三、過濾器配置
 
package com.hxkj.waychat.intercept.fliter;
 
import java.io.IOException;
 
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
 
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
 
/*@WebFilter(filterName="MyFilter",urlPatterns="/*")*/
public class MyFilter implements Filter {
 
private static Logger logger = LoggerFactory.getLogger(MyFilter.class);
 
@Override
public void destroy() {
logger.info("----------:過濾器銷燬");
}
 
@Override
public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2)
throws IOException, ServletException {
logger.info("----------:過濾器執行內容");
 
arg2.doFilter(arg0, arg1);
}
 
@Override
public void init(FilterConfig arg0) throws ServletException {
logger.info("----------:過濾器初始化");
}
 
}

public class WebAppConfig extends WebMvcConfigurerAdapter{
    public static void main(String[] args) {
SpringApplication.run(WebAppConfig.class, args);
} 
    
    /**
     * 配置攔截器
     * @author lance
     * @param registry
     */
    public void addInterceptors(InterceptorRegistry registry) {
    registry.addInterceptor(new UserSecurityInterceptor()).addPathPatterns("/user/**");
}
}
 
UserSecurityInterceptor代碼
public class UserSecurityInterceptor implements HandlerInterceptor {
 
@Override
public boolean preHandle(HttpServletRequest request,
HttpServletResponse response, Object handler) throws Exception {
        
        return true;
}
 
@Override
public void postHandle(HttpServletRequest request,
HttpServletResponse response, Object handler,
ModelAndView modelAndView) throws Exception {
}
 
@Override
public void afterCompletion(HttpServletRequest request,
HttpServletResponse response, Object handler, Exception ex)
throws Exception {
 
}
 
}

@Component  
public class Scheduler {  
    private final Logger logger = LoggerFactory.getLogger(this.getClass());  
      
    @Scheduled(cron="0 0/1 * * * ?") //每分鐘執行一次  
    public void statusCheck() {      
        logger.info("每分鐘執行一次。開始……");  
        //statusTask.healthCheck();  
        logger.info("每分鐘執行一次。結束。");  
    }    
  
    @Scheduled(fixedRate=20000)  
    public void testTasks() {      
        logger.info("每20秒執行一次。開始……");  
        //statusTask.healthCheck();  
        logger.info("每20秒執行一次。結束。");  
    }    
}

package com.hxkj.fsslr.controller;
 
import java.io.FileNotFoundException;
 
import javax.lang.model.type.UnknownTypeException;
import javax.servlet.http.HttpServletRequest;
 
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.ResponseBody;
 
import com.hxkj.fsslr.core.utils.PageReturnUtils;
 
/**
 * @ClassName: GlobalExceptionHandler 
 * @Description: 全局異常處理
 * @author huzhihui_c@qq.com
 * @date 2016年7月18日 下午1:17:59
 */
@ControllerAdvice
public class GlobalExceptionHandler {
 
private static Logger logger = LoggerFactory.getLogger(GlobalExceptionHandler.class);
 
@ExceptionHandler(value=Exception.class)
@ResponseBody
public Object errorHandler(HttpServletRequest request,Exception e){
logger.info("-----捕獲到異常-----");
//ajax請求異常返回
if(null != request.getHeader("X-Requested-With") && "XMLHttpRequest".equals( request.getHeader("X-Requested-With").toString())){
if (e instanceof NullPointerException) {
return PageReturnUtils.formatNormal("", PageReturnUtils.MSG_CODE_111111, PageReturnUtils.MSG_STATE_FALSE, "數據參數傳入錯誤");
} else if (e instanceof FileNotFoundException) {
return PageReturnUtils.formatNormal("", PageReturnUtils.MSG_CODE_111111, PageReturnUtils.MSG_STATE_FALSE, "數據文件上傳出錯");
} else if (e instanceof ClassNotFoundException) {
return PageReturnUtils.formatNormal("", PageReturnUtils.MSG_CODE_111111, PageReturnUtils.MSG_STATE_FALSE, "系統未找到該jar包");
} else if (e instanceof UnknownTypeException) {
return PageReturnUtils.formatNormal("", PageReturnUtils.MSG_CODE_111111, PageReturnUtils.MSG_STATE_FALSE, "未知錯誤");
} else{
return PageReturnUtils.formatNormal("", PageReturnUtils.MSG_CODE_111111, PageReturnUtils.MSG_STATE_FALSE, e.toString());
}
}
return PageReturnUtils.formatNormal("", PageReturnUtils.MSG_CODE_111111, PageReturnUtils.MSG_STATE_FALSE, e.toString());
}
}