@Configuration
@EnableMethodSecurity()
@RequiredArgsConstructor
public class SecurityConfig {
	// 自定義成功處理，主要存儲(chǔ)登錄信息并返回jwt
	private final LoginSuccessHandler loginSuccessHandler;
	// 自定義失敗處理，返回json格式而非默認(rèn)的html
    private final LoginFailureHandler loginFailureHandler;
    private final CustomSessionAuthenticationStrategy customSessionAuthenticationStrategy;
	...
	@Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    	// 設(shè)置登錄成功后session處理, 認(rèn)證成功后
        // SessionAuthenticationStrategy的最早執(zhí)行，詳見(jiàn)AbstractAuthenticationProcessingFilter
        // 執(zhí)行順序：
        // 1. SessionAuthenticationStrategy#onAuthentication
        // 2. SecurityContextHolder#setContext
        // 3. SecurityContextRepository#saveContext
        // 4. RememberMeServices#loginSuccess
        // 5. ApplicationEventPublisher#publishEvent
        // 6. AuthenticationSuccessHandler#onAuthenticationSuccess
        http.sessionManagement().sessionAuthenticationStrategy(customSessionAuthenticationStrategy);
		...
		// 前后端不分離，可指定html返回。該項(xiàng)未測(cè)試
        // http.formLogin().loginPage("login").loginProcessingUrl("/hello/login");
        // 前后端分離下username/password登錄
        http.formLogin()
                .usernameParameter("userId")
                .passwordParameter("password")
                // 前端登陸頁(yè)面對(duì)這個(gè)url提交username/password即可
                // 必須為Post請(qǐng)求，且Body格式為x-www-form-urlencoded,如果要接受application/json格式，需另加配置
                .loginProcessingUrl("/hello/login")
                .successHandler(loginSuccessHandler)
                .failureHandler(loginFailureHandler);
                //  .securityContextRepository(...)  // pass
       ...
       return http.build();
	}
	...
}

public abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean
		implements ApplicationEventPublisherAware, MessageSourceAware {
	...
	// 委托給子類(lèi)ProviderManager執(zhí)行認(rèn)證，最終由DaoAuthenticationProvider認(rèn)證
	// DaoAuthenticationProvider中會(huì)調(diào)用UserDetailsService#loadUserByUsername(username)接口方法
	// 我們只需實(shí)現(xiàn)該UserDetailsService接口注入Bean容器即可
	private AuthenticationManager authenticationManager;
	private SessionAuthenticationStrategy sessionStrategy；
	protected ApplicationEventPublisher eventPublisher;
	private RememberMeServices rememberMeServices;
	private AuthenticationSuccessHandler successHandler;
	private AuthenticationFailureHandler failureHandler;
	private SecurityContextRepository securityContextRepository;
	...
	private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		...
		try {
			// 模板模式，該方法子類(lèi)實(shí)現(xiàn)
			Authentication authenticationResult = attemptAuthentication(request, response);
			// 1. 	
			this.sessionStrategy.onAuthentication(authenticationResult, request, response);
			// Authentication success
			if (this.continueChainBeforeSuccessfulAuthentication) {
				chain.doFilter(request, response);
			}
			// 成功后續(xù)處理
			successfulAuthentication(request, response, chain, authenticationResult);
		}
		catch (InternalAuthenticationServiceException failed) {
			// 失敗后續(xù)處理
			unsuccessfulAuthentication(request, response, failed);
		}
		catch (AuthenticationException ex) {
			// Authentication failed
			unsuccessfulAuthentication(request, response, ex);
		}
	}
	// 模板模式，由UsernamePasswordAuthenticationFilter完成
	public abstract Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
			throws AuthenticationException, IOException, ServletException;}
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
			Authentication authResult) throws IOException, ServletException {
		SecurityContext context = SecurityContextHolder.createEmptyContext();
		context.setAuthentication(authResult);
		// 2. 
		SecurityContextHolder.setContext(context);
		// 3. 
		this.securityContextRepository.saveContext(context, request, response);
		// 4.
		this.rememberMeServices.loginSuccess(request, response, authResult);
		if (this.eventPublisher != null) {
			// 5.
			this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
		}
		// 6.
		this.successHandler.onAuthenticationSuccess(request, response, authResult);
	}
}

public class UsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
	@Override
	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
			throws AuthenticationException {
		if (this.postOnly && !request.getMethod().equals("POST")) {
			throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
		}
		String username = obtainUsername(request);
		username = (username != null) ? username.trim() : "";
		String password = obtainPassword(request);
		password = (password != null) ? password : "";
		UsernamePasswordAuthenticationToken authRequest = UsernamePasswordAuthenticationToken.unauthenticated(username,
				password);
		// Allow subclasses to set the "details" property
		setDetails(request, authRequest);
		// 調(diào)用父類(lèi)中字段去認(rèn)證，最終是 UserDetailService#loadUserByUsername(String username)，該接口實(shí)現(xiàn)類(lèi)由程序員根據(jù)業(yè)務(wù)定義。
		return this.getAuthenticationManager().authenticate(authRequest);
	}
	// ************** 重要 **************
	// 這里只能通過(guò)x-www-urlencoded方式獲取，如果前端傳過(guò)來(lái)application/json，是解析不到的
	// 非要用application/json，建議重寫(xiě)UsernamePasswordAuthenticationFilter方法，但由于body中內(nèi)容默認(rèn)只能讀一次，又要做很多其他配置，比較麻煩，建議這里x-www-urlencoded
	// *********************************
	@Nullable
	protected String obtainUsername(HttpServletRequest request) {
		return request.getParameter(this.usernameParameter);
	}
	@Nullable
	protected String obtainPassword(HttpServletRequest request) {
		return request.getParameter(this.passwordParameter);
	}
}