Spring Security + JWT使用

@Bean
public JsonLoginFilter jsonLoginFilter(){
    JsonLoginFilter jsonLoginFilter = new JsonLoginFilter();
    jsonLoginFilter.setAuthenticationManager(authenticationManager());
    jsonLoginFilter.setAuthenticationFailureHandler((request, response, exception) -> {
        Map<String,Object> result = new HashMap<>();
        result.put("code",-1);
        result.put("msg","登录失败");
        result.put("data",exception.getMessage());
        writeResp(result,response);
    });
    jsonLoginFilter.setAuthenticationSuccessHandler((request, response, authentication) -> {
        Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
        List<String> permissions = authorities.stream().map(GrantedAuthority::getAuthority).collect(Collectors.toList());
        String token = JwtTokenUtil.generateTokenByRSA(authentication.getName(), permissions);
        Map<String,Object> result = new HashMap<>();
        result.put("code",-1);
        result.put("msg","登录成功");
        result.put("data",token);
        writeResp(result,response);
    });
    return jsonLoginFilter;
}

.exceptionHandling()
      .accessDeniedHandler(new AccessDeniedHandler() {
                    @Override
                    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
                        Map<String,Object> result = new HashMap<>();
                        result.put("code",-1);
                        result.put("msg","访问失败");
                        result.put("data","无权限访问");
                        writeResp(result,response);
                    }
                })

.exceptionHandling() 
.authenticationEntryPoint(new AuthenticationEntryPoint() {
                    @Override
                    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
                        Map<String,Object> result = new HashMap<>();
                        result.put("code",-1);
                        result.put("msg","访问失败");
                        result.put("data","请登录");
                        writeResp(result,response);
                    }
                })

@Service
public class UserDetailService implements UserDetailsService {
    @Autowired
    private UserMapper userMapper;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException{
        User user = userMapper.queryUserByUsername(username);
        List<Role> roles = userMapper.getRolesByUserId(user.getId());
        user.setRoles(roles);
        if (Objects.isNull(user)) {
            throw new UsernameNotFoundException("user not found");
        }
        return user;
    }
}

@Component
@WebFilter(filterName = "TokenLoginFilter", urlPatterns = "/*")//先全部拦截
public class TokenLoginFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException, IOException {
        String authorization = request.getHeader("Authorization");
        if (StringUtils.isEmpty(authorization)) {
            filterChain.doFilter(request, response);
            return;
        }
        AccessToken accessToken = JwtTokenUtil.verifyTokenByRSA(authorization);
        if (Objects.isNull(accessToken)) {
            filterChain.doFilter(request, response);
            return;
        }
        //已登录，获取用户信息，进行授权
        List<SimpleGrantedAuthority> authorities = accessToken.getAuthorities().stream().map(permission ->
                new SimpleGrantedAuthority(permission)
        ).collect(Collectors.toList());
        UsernamePasswordAuthenticationToken token =
                new UsernamePasswordAuthenticationToken(accessToken.getUsername(), null, authorities);
        SecurityContextHolder.getContext().setAuthentication(token);
        System.out.println("SecurityContextHolder信息：" + JSON.toJSONString(SecurityContextHolder.getContext()));
        filterChain.doFilter(request, response);
    }
}

.addFilterAt(jsonLoginFilter(), UsernamePasswordAuthenticationFilter.class)
                .addFilterAt(tokenLoginFilter, JsonLoginFilter.class)

@RestController
public class IndexController {
    @RequestMapping("/admin")
    @PreAuthorize("hasAnyAuthority('admin:write')")
    public String admin(Authentication authentication){
        return JSON.toJSONString(authentication);
    }
    @RequestMapping("/superAdmin")
    @PreAuthorize("hasAnyAuthority('super:write')")
    public String superAdmin(Authentication authentication){
        return JSON.toJSONString(authentication);
    }
}