@Slf4j
@RestController
public class SmsController {

    @Autowired
    private UserDetailsService userDetailsService;

    //獲取短信驗(yàn)證碼
    @RequestMapping(value="/smscode",method = RequestMethod.GET)
    public String sms(@RequestParam String mobile, HttpSession session) throws IOException {
         //先從數(shù)據(jù)庫中查找，判斷對(duì)應(yīng)的手機(jī)號(hào)是否存在
        UserDetails userDetails = userDetailsService.loadUserByUsername(mobile);
        //這個(gè)地方userDetailsService如果使用spring security提供的話，找不到用戶名會(huì)直接拋出異常，走不到這里來
        //即直接去了登錄失敗的處理器
        if(userDetails == null){
            return "您輸入的手機(jī)號(hào)不是系統(tǒng)注冊(cè)用戶";
        }
        //commons-lang3包下的工具類,生成指定長(zhǎng)度為4的隨機(jī)數(shù)字字符串
        String randomNumeric = RandomStringUtils.randomNumeric(4);
        //驗(yàn)證碼,過期時(shí)間，手機(jī)號(hào)
        SmsCode smsCode = new SmsCode(randomNumeric,60,mobile);
        //TODO 此處調(diào)用驗(yàn)證碼發(fā)送服務(wù)接口
        //這里只是模擬調(diào)用
        log.info(smsCode.getCode() + "=》" + mobile);

        //將驗(yàn)證碼存放到session中
        session.setAttribute("sms_key",smsCode);

        return "短信息已經(jīng)發(fā)送到您的手機(jī)";
    }
}

public class SmsCode {
    private String code;  //短信驗(yàn)證碼
    private LocalDateTime expireTime; //驗(yàn)證碼的過期時(shí)間
    private String mobile; //發(fā)送手機(jī)號(hào)

    public SmsCode(String code,int expireAfterSeconds,String mobile){
        this.code = code;
        this.expireTime = LocalDateTime.now().plusSeconds(expireAfterSeconds);
        this.mobile = mobile;
    }

    public boolean isExpired(){
        return  LocalDateTime.now().isAfter(expireTime);
    }

    public String getCode() {
        return code;
    }

    public String getMobile() {
       return mobile;
    }

}

<h1>短信登陸</h1>
<form action="/smslogin" method="post">
    <span>手機(jī)號(hào)碼：</span><input type="text" name="mobile" id="mobile"> <br>
    <span>短信驗(yàn)證碼：</span><input type="text" name="smsCode" id="smsCode" >
    <input type="button" onclick="getSmsCode()" value="獲取"><br>
    <input type="button" onclick="smslogin()" value="登陸">
</form>

<script>

   function getSmsCode()
   {
     $.ajax({
       type: "GET",
       url: "/smscode",
        data:{"mobile":$("#mobile").val()},
       success: function (res) {
         console.log(res)
       },
       error: function (e) {
         console.log(e.responseText);
       }
     });
   }

    function smslogin() {
      var mobile = $("#mobile").val();
      var smsCode = $("#smsCode").val();
      if (mobile === "" || smsCode === "") {
        alert('手機(jī)號(hào)和短信驗(yàn)證碼均不能為空');
        return;
      }
      $.ajax({
        type: "POST",
        url: "/smslogin",
        data: {
          "mobile": mobile,
          "smsCode": smsCode
        },
        success: function (res) {
          console.log(res)
        },
        error: function (e) {
          console.log(e.responseText);
        }
      });
    }
</script>

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

   private ObjectMapper objectMapper=new ObjectMapper();

   @Resource
   private CaptchaCodeFilter captchaCodeFilter;

   @Bean
   PasswordEncoder passwordEncoder() {
      return NoOpPasswordEncoder.getInstance();
   }

   @Override
   public void configure(WebSecurity web) throws Exception {
      web.ignoring().antMatchers("/js/**", "/css/**","/images/**");
   }

   //數(shù)據(jù)源注入
   @Autowired
   DataSource dataSource;

   //持久化令牌配置
   @Bean
   JdbcTokenRepositoryImpl jdbcTokenRepository() {
      JdbcTokenRepositoryImpl jdbcTokenRepository = new JdbcTokenRepositoryImpl();
      jdbcTokenRepository.setDataSource(dataSource);
      return jdbcTokenRepository;
   }


   //用戶配置
   @Override
   @Bean
   protected UserDetailsService userDetailsService() {
      JdbcUserDetailsManager manager = new JdbcUserDetailsManager();
      manager.setDataSource(dataSource);
      if (!manager.userExists("dhy")) {
         manager.createUser(User.withUsername("dhy").password("123").roles("admin").build());
      }
      if (!manager.userExists("大忽悠")) {
         manager.createUser(User.withUsername("大忽悠").password("123").roles("user").build());
      }
      //模擬電話號(hào)碼
      if (!manager.userExists("123456789")) {
         manager.createUser(User.withUsername("123456789").password("").roles("user").build());
      }
      return manager;
   }

   @Override
   protected void configure(HttpSecurity http) throws Exception {
      http.//處理需要認(rèn)證的請(qǐng)求
              authorizeRequests()
              //放行請(qǐng)求，前提:是對(duì)應(yīng)的角色才行
              .antMatchers("/admin/**").hasRole("admin")
              .antMatchers("/user/**").hasRole("user")
              //無需登錄憑證，即可放行
              .antMatchers("/kaptcha","/smscode").permitAll()//放行驗(yàn)證碼的顯示請(qǐng)求
              //剩余的請(qǐng)求都需要認(rèn)證才可以放行
              .anyRequest().authenticated()
              .and()
              //表單形式登錄的個(gè)性化配置
              .formLogin()
              .loginPage("/login.html").permitAll()
              .loginProcessingUrl("/login").permitAll()
              .defaultSuccessUrl("/main.html")//可以記住上一次的請(qǐng)求路徑
              //登錄失敗的處理器
              .failureHandler(new MyFailHandler())
              .and()
              //退出登錄相關(guān)設(shè)置
              .logout()
              //退出登錄的請(qǐng)求，是再?zèng)]退出前發(fā)出的，因此此時(shí)還有登錄憑證
              //可以訪問
              .logoutUrl("/logout")
              //此時(shí)已經(jīng)退出了登錄，登錄憑證沒了
              //那么想要訪問非登錄頁面的請(qǐng)求，就必須保證這個(gè)請(qǐng)求無需憑證即可訪問
              .logoutSuccessUrl("/logout.html").permitAll()
              //退出登錄的時(shí)候，刪除對(duì)應(yīng)的cookie
              .deleteCookies("JSESSIONID")
              .and()
              //記住我相關(guān)設(shè)置
              .rememberMe()
              //預(yù)定義key相關(guān)設(shè)置，默認(rèn)是一串uuid
              .key("dhy")
              //令牌的持久化
              .tokenRepository(jdbcTokenRepository())
              .and()
              .addFilterBefore(captchaCodeFilter, UsernamePasswordAuthenticationFilter.class)
              //csrf關(guān)閉
              .csrf().disable();

   }

   //角色繼承
   @Bean
   RoleHierarchy roleHierarchy() {
      RoleHierarchyImpl hierarchy = new RoleHierarchyImpl();
      hierarchy.setHierarchy("ROLE_admin > ROLE_user");
      return hierarchy;
   }

}

@Component
public class SmsCodeValidateFilter extends OncePerRequestFilter {

    @Resource
    UserDetailsService userDetailsService;

    @Resource
    MyFailHandler myAuthenticationFailureHandler;

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain)
            throws ServletException, IOException {
       //該過濾器只負(fù)責(zé)攔截驗(yàn)證碼登錄的請(qǐng)求
       //并且請(qǐng)求必須是post
        if (request.getRequestURI().equals("/smslogin")
                && request.getMethod().equalsIgnoreCase("post")) {
            try {
                validate(new ServletWebRequest(request));

            }catch (AuthenticationException e){
                myAuthenticationFailureHandler.onAuthenticationFailure(
                        request,response,e);
                return;
            }
        }
        filterChain.doFilter(request,response);
    }

    private void validate(ServletWebRequest request) throws ServletRequestBindingException {
        HttpSession session = request.getRequest().getSession();
        //從session取出獲取驗(yàn)證碼時(shí),在session中存放驗(yàn)證碼相關(guān)信息的類
        SmsCode codeInSession = (SmsCode) session.getAttribute("sms_key");
        //取出用戶輸入的驗(yàn)證碼
        String codeInRequest = request.getParameter("smsCode");
        //取出用戶輸入的電話號(hào)碼
        String mobileInRequest = request.getParameter("mobile");
        
        //common-lang3包下的工具類
        if(StringUtils.isEmpty(mobileInRequest)){
            throw new SessionAuthenticationException("手機(jī)號(hào)碼不能為空！");
        }
        if(StringUtils.isEmpty(codeInRequest)){
            throw new SessionAuthenticationException("短信驗(yàn)證碼不能為空！");
        }
        if(Objects.isNull(codeInSession)){
            throw new SessionAuthenticationException("短信驗(yàn)證碼不存在！");
        }
        if(codeInSession.isExpired())
        {
            //從session中移除保存的驗(yàn)證碼相關(guān)信息
            session.removeAttribute("sms_key");
            throw new SessionAuthenticationException("短信驗(yàn)證碼已過期！");
        }
        if(!codeInSession.getCode().equals(codeInRequest)){
            throw new SessionAuthenticationException("短信驗(yàn)證碼不正確！");
        }

        if(!codeInSession.getMobile().equals(mobileInRequest)){
            throw new SessionAuthenticationException("短信發(fā)送目標(biāo)與該手機(jī)號(hào)不一致！");
        }
        //數(shù)據(jù)庫查詢當(dāng)前手機(jī)號(hào)是否注冊(cè)過
        UserDetails myUserDetails = userDetailsService.loadUserByUsername(mobileInRequest);
        if(Objects.isNull(myUserDetails)){
            throw new SessionAuthenticationException("您輸入的手機(jī)號(hào)不是系統(tǒng)的注冊(cè)用戶");
        }
        //校驗(yàn)完畢并且沒有拋出異常的情況下，移除session中保存的驗(yàn)證碼信息
        session.removeAttribute("sms_key");
    }
}

/**
 * 仿造UsernamePasswordAuthenticationFilter開發(fā)
 */
public class SmsCodeAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    public static final String SPRING_SECURITY_FORM_MOBILE_KEY = "mobile";
    private String mobileParameter = SPRING_SECURITY_FORM_MOBILE_KEY ;    //請(qǐng)求中攜帶手機(jī)號(hào)的參數(shù)名稱
    private boolean postOnly = true;    //指定當(dāng)前過濾器是否只處理POST請(qǐng)求
    //默認(rèn)處理的請(qǐng)求
    private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER = new AntPathRequestMatcher("/smslogin", "POST");

    public SmsCodeAuthenticationFilter() {
        //指定當(dāng)前過濾器處理的請(qǐng)求
        super(DEFAULT_ANT_PATH_REQUEST_MATCHER);
    }

    //嘗試進(jìn)行認(rèn)證
    public Authentication attemptAuthentication(
            HttpServletRequest request,
            HttpServletResponse response)
            throws AuthenticationException {
        if (this.postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
        } else {
            String mobile = this.obtainMobile(request);
            if (mobile == null) {
                mobile = "";
            }
            mobile = mobile.trim();
            //認(rèn)證前---手機(jī)號(hào)碼是認(rèn)證主體
            SmsCodeAuthenticationToken authRequest = new SmsCodeAuthenticationToken(mobile);
            //設(shè)置details---默認(rèn)是sessionid和remoteaddr
            this.setDetails(request, authRequest);
            return this.getAuthenticationManager().authenticate(authRequest);
        }
    }


    protected String obtainMobile(HttpServletRequest request) {
        return request.getParameter(this.mobileParameter);
    }


    protected void setDetails(HttpServletRequest request, SmsCodeAuthenticationToken authRequest) {
        authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
    }

    public void setMobileParameter(String mobileParameter) {
        Assert.hasText(mobileParameter, "Username parameter must not be empty or null");
        this.mobileParameter = mobileParameter;
    }


    public void setPostOnly(boolean postOnly) {
        this.postOnly = postOnly;
    }

    public final String getMobileParameter() {
        return this.mobileParameter;
    }

}

public class SmsCodeAuthenticationToken extends AbstractAuthenticationToken {
    private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;

    //存放認(rèn)證信息，認(rèn)證之前存放手機(jī)號(hào)，認(rèn)證之后存放登錄的用戶
    private final Object principal;

//認(rèn)證前
    public SmsCodeAuthenticationToken(String mobile) {
        super((Collection)null);
        this.principal = mobile;
        this.setAuthenticated(false);
    }

//認(rèn)證后，會(huì)設(shè)置相關(guān)的權(quán)限
    public SmsCodeAuthenticationToken(Object principal, Collection<? extends GrantedAuthority> authorities) {
        super(authorities);
        this.principal = principal;
        super.setAuthenticated(true);
    }

    public Object getCredentials() {
        return null;
    }

    public Object getPrincipal() {
        return this.principal;
    }

    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        if (isAuthenticated) {
            throw new IllegalArgumentException("Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
        } else {
            super.setAuthenticated(false);
        }
    }

    public void eraseCredentials() {
        super.eraseCredentials();
    }
}

public class SmsCodeAuthenticationProvider implements AuthenticationProvider{


    private UserDetailsService userDetailsService;

    public UserDetailsService getUserDetailsService() {
        return userDetailsService;
    }

    public void setUserDetailsService(UserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }

    /**
     * 進(jìn)行身份認(rèn)證的邏輯
     * @param authentication    就是我們傳入的Token
     * @return
     * @throws AuthenticationException
     */
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {

        //利用UserDetailsService獲取用戶信息，拿到用戶信息后重新組裝一個(gè)已認(rèn)證的Authentication
        SmsCodeAuthenticationToken authenticationToken = (SmsCodeAuthenticationToken)authentication;
        UserDetails user = userDetailsService.loadUserByUsername((String) authenticationToken.getPrincipal());  //根據(jù)手機(jī)號(hào)碼拿到用戶信息
        if(user == null){
            throw new InternalAuthenticationServiceException("無法獲取用戶信息");
        }
        //設(shè)置新的認(rèn)證主體
        SmsCodeAuthenticationToken authenticationResult = new SmsCodeAuthenticationToken(user,user.getAuthorities());
        //copy details
        authenticationResult.setDetails(authenticationToken.getDetails());
        //返回新的令牌對(duì)象
        return authenticationResult;
    }

    /**
     * AuthenticationManager挑選一個(gè)AuthenticationProvider
     * 來處理傳入進(jìn)來的Token就是根據(jù)supports方法來判斷的
     * @param aClass
     * @return
     */
    @Override
    public boolean supports(Class<?> aClass) {
        //isAssignableFrom： 判斷當(dāng)前的Class對(duì)象所表示的類，
        // 是不是參數(shù)中傳遞的Class對(duì)象所表示的類的父類，超接口，或者是相同的類型。
        // 是則返回true，否則返回false。
        return SmsCodeAuthenticationToken.class.isAssignableFrom(aClass);
    }
}

@Component
public class SmsCodeSecurityConfig extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> {

    @Resource
    private MyFailHandler myAuthenticationFailureHandler;

      //這里不能直接注入，否則會(huì)造成依賴注入的問題發(fā)生
    private UserDetailsService myUserDetailsService;

    @Resource
    private SmsCodeValidateFilter smsCodeValidateFilter;

    @Override
    public void configure(HttpSecurity http) throws Exception {

        SmsCodeAuthenticationFilter smsCodeAuthenticationFilter = new SmsCodeAuthenticationFilter();
        smsCodeAuthenticationFilter.setAuthenticationManager(http.getSharedObject(AuthenticationManager.class));
        //有則配置，無則不配置
        //smsCodeAuthenticationFilter.setAuthenticationSuccessHandler(myAuthenticationSuccessHandler);
        smsCodeAuthenticationFilter.setAuthenticationFailureHandler(myAuthenticationFailureHandler);

        // 獲取驗(yàn)證碼登錄令牌校驗(yàn)的提供者
        SmsCodeAuthenticationProvider smsCodeAuthenticationProvider = new SmsCodeAuthenticationProvider();
        smsCodeAuthenticationProvider.setUserDetailsService(myUserDetailsService);

        //在用戶密碼過濾器前面加入短信驗(yàn)證碼校驗(yàn)過濾器
        http.addFilterBefore(smsCodeValidateFilter, UsernamePasswordAuthenticationFilter.class);
        //在用戶密碼過濾器后面加入短信驗(yàn)證碼認(rèn)證授權(quán)過濾器        
        http.authenticationProvider(smsCodeAuthenticationProvider)
            .addFilterAfter(smsCodeAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

    }
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

   private ObjectMapper objectMapper=new ObjectMapper();

   @Resource
   private CaptchaCodeFilter captchaCodeFilter;

   @Resource
   private SmsCodeSecurityConfig smsCodeSecurityConfig;

   @Bean
   PasswordEncoder passwordEncoder() {
      return NoOpPasswordEncoder.getInstance();
   }

   @Override
   public void configure(WebSecurity web) throws Exception {
      web.ignoring().antMatchers("/js/**", "/css/**","/images/**");
   }

   //數(shù)據(jù)源注入
   @Autowired
   DataSource dataSource;

   //持久化令牌配置
   @Bean
   JdbcTokenRepositoryImpl jdbcTokenRepository() {
      JdbcTokenRepositoryImpl jdbcTokenRepository = new JdbcTokenRepositoryImpl();
      jdbcTokenRepository.setDataSource(dataSource);
      return jdbcTokenRepository;
   }


   //用戶配置
   @Override
   @Bean
   protected UserDetailsService userDetailsService() {
      JdbcUserDetailsManager manager = new JdbcUserDetailsManager();
      manager.setDataSource(dataSource);
      if (!manager.userExists("dhy")) {
         manager.createUser(User.withUsername("dhy").password("123").roles("admin").build());
      }
      if (!manager.userExists("大忽悠")) {
         manager.createUser(User.withUsername("大忽悠").password("123").roles("user").build());
      }
      //模擬電話號(hào)碼
      if (!manager.userExists("123456789")) {
         manager.createUser(User.withUsername("123456789").password("").roles("user").build());
      }
      return manager;
   }

   @Override
   protected void configure(HttpSecurity http) throws Exception {

 //設(shè)置一下userDetailService
      smsCodeSecurityConfig.setMyUserDetailsService(userDetailsService());

      http.//處理需要認(rèn)證的請(qǐng)求
              authorizeRequests()
              //放行請(qǐng)求，前提:是對(duì)應(yīng)的角色才行
              .antMatchers("/admin/**").hasRole("admin")
              .antMatchers("/user/**").hasRole("user")
              //無需登錄憑證，即可放行
              .antMatchers("/kaptcha","/smscode","/smslogin").permitAll()//放行驗(yàn)證碼的顯示請(qǐng)求
              //剩余的請(qǐng)求都需要認(rèn)證才可以放行
              .anyRequest().authenticated()
              .and()
              //表單形式登錄的個(gè)性化配置
              .formLogin()
              .loginPage("/login.html").permitAll()
              .loginProcessingUrl("/login").permitAll()
              .defaultSuccessUrl("/main.html")//可以記住上一次的請(qǐng)求路徑
              //登錄失敗的處理器
              .failureHandler(new MyFailHandler())
              .and()
              //退出登錄相關(guān)設(shè)置
              .logout()
              //退出登錄的請(qǐng)求，是再?zèng)]退出前發(fā)出的，因此此時(shí)還有登錄憑證
              //可以訪問
              .logoutUrl("/logout")
              //此時(shí)已經(jīng)退出了登錄，登錄憑證沒了
              //那么想要訪問非登錄頁面的請(qǐng)求，就必須保證這個(gè)請(qǐng)求無需憑證即可訪問
              .logoutSuccessUrl("/logout.html").permitAll()
              //退出登錄的時(shí)候，刪除對(duì)應(yīng)的cookie
              .deleteCookies("JSESSIONID")
              .and()
              //記住我相關(guān)設(shè)置
              .rememberMe()
              //預(yù)定義key相關(guān)設(shè)置，默認(rèn)是一串uuid
              .key("dhy")
              //令牌的持久化
              .tokenRepository(jdbcTokenRepository())
              .and()
              //應(yīng)用手機(jī)驗(yàn)證碼的配置
              .apply(smsCodeSecurityConfig)
              .and()
              //圖形驗(yàn)證碼
              .addFilterBefore(captchaCodeFilter, UsernamePasswordAuthenticationFilter.class)
              //csrf關(guān)閉
              .csrf().disable();

   }

   //角色繼承
   @Bean
   RoleHierarchy roleHierarchy() {
      RoleHierarchyImpl hierarchy = new RoleHierarchyImpl();
      hierarchy.setHierarchy("ROLE_admin > ROLE_user");
      return hierarchy;
   }

}