Spring Security：为特定URL模式配置JWT过滤器

http.addFilterBefore(customJwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.security.web.util.matcher.RequestMatcher;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * 自定义JWT认证过滤器，仅对匹配特定RequestMatcher的请求进行处理。
 */
public class CustomJwtAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    /**
     * 构造函数。
     * @param requiresAuthenticationRequestMatcher 定义哪些请求需要此过滤器处理的RequestMatcher
     * @param authenticationManager 认证管理器，用于执行认证逻辑
     */
    public CustomJwtAuthenticationFilter(RequestMatcher requiresAuthenticationRequestMatcher, AuthenticationManager authenticationManager) {
        super(requiresAuthenticationRequestMatcher); // 将RequestMatcher传递给父类
        setAuthenticationManager(authenticationManager); // 设置认证管理器
    }

    /**
     * 实现JWT认证的核心逻辑。
     * 只有当RequestMatcher匹配时，此方法才会被调用。
     */
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException, IOException, ServletException {
        // 在这里实现你的JWT解析和认证逻辑
        // 例如：从请求头中获取JWT令牌
        String authorizationHeader = request.getHeader("Authorization");
        if (authorizationHeader == null || !authorizationHeader.startsWith("Bearer ")) {
            // 如果没有Bearer Token，抛出认证异常，或返回null让后续认证机制处理
            throw new AuthenticationException("Missing or invalid JWT token in Authorization header") {};
        }

        String jwtToken = authorizationHeader.substring(7); // 提取JWT字符串

        // TODO: 根据你的JWT库和业务逻辑验证jwtToken，并构建一个Authentication对象
        // 例如：
        // JwtAuthenticationToken authenticationToken = new JwtAuthenticationToken(jwtToken);
        // return getAuthenticationManager().authenticate(authenticationToken); // 委托给AuthenticationManager进行认证

        // 示例：此处仅为演示，实际应替换为你的JWT验证逻辑
        System.out.println("Processing JWT for path: " + request.getRequestURI());
        // 假设成功验证并返回一个Authentication对象
        // return new UsernamePasswordAuthenticationToken("user", null, Collections.emptyList());
        throw new UnsupportedOperationException("JWT认证逻辑待实现，请替换为实际的令牌验证和用户身份构建。");
    }

    // 可选：重写successfulAuthentication和unsuccessfulAuthentication方法来处理认证成功或失败后的逻辑
    // @Override
    // protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
    //     super.successfulAuthentication(request, response, chain, authResult);
    //     // 认证成功后继续过滤器链
    //     chain.doFilter(request, response);
    // }

    // @Override
    // protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException {
    //     // 认证失败处理，例如返回401 Unauthorized
    //     response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
    //     response.getWriter().write("Authentication Failed: " + failed.getMessage());
    // }
}

import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;
import org.springframework.security.web.util.matcher.OrRequestMatcher;
import java.util.Arrays;
import java.util.List;
import java.util.stream.Collectors;

// 简单匹配单个路径模式
// RequestMatcher apiRequestMatcher = new AntPathRequestMatcher("/api/**");

// 如果需要匹配多个路径模式，可以使用OrRequestMatcher
// RequestMatcher multiPathMatcher = new OrRequestMatcher(
//     new AntPathRequestMatcher("/api/v1/**"),
//     new AntPathRequestMatcher("/secure/**")
// );

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    // 假设你有一个JwtAuthenticationEntryPoint处理认证失败的入口点
    // @Autowired
    // private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;

    // 假设你有一个UserDetailsService用于加载用户详情（如果JWT认证需要）
    // @Autowired
    // private UserDetailsService userDetailsService;

    /**
     * 配置HTTP安全策略。
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable() // 禁用CSRF，因为JWT是无状态的
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) // 设置会话管理为无状态
            .and()
            // .exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint).and() // 配置认证入口点处理未认证请求
            .authorizeRequests()
            .antMatchers("/api/**").authenticated() // 明确指定 /api/** 路径需要认证
            .anyRequest().permitAll() // 其他所有请求都允许访问
            .and()
            // 将我们定制的JWT过滤器添加到UsernamePasswordAuthenticationFilter之前
            .addFilterBefore(customJwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    }

    /**
     * 将CustomJwtAuthenticationFilter注册为Spring Bean。
     * 注意：这里需要捕获AuthenticationManagerBean()抛出的异常。