public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";

private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
private boolean postOnly = true;

// ~ Constructors
// ===================================================================================================

public UsernamePasswordAuthenticationFilter() {
	super(new AntPathRequestMatcher("/login", "POST"));
}

// ~ Methods
// ========================================================================================================

public Authentication attemptAuthentication(HttpServletRequest request,
		HttpServletResponse response) throws AuthenticationException {
	if (postOnly && !request.getMethod().equals("POST")) {
		throw new AuthenticationServiceException(
				"Authentication method not supported: " + request.getMethod());
	}

	String username = obtainUsername(request);
	String password = obtainPassword(request);

	if (username == null) {
		username = "";
	}

	if (password == null) {
		password = "";
	}

	username = username.trim();

	UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
			username, password);

	// Allow subclasses to set the "details" property
	setDetails(request, authRequest);

	return this.getAuthenticationManager().authenticate(authRequest);
}

public class UserLoginAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

    private static final Logger LOGGER = LoggerFactory.getLogger(UserAuthenticationManager.class);

    @Reference(version = "1.0")
    private UserService userService;

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request,
                                                HttpServletResponse response) throws AuthenticationException {
        System.out.println("UserLoginAuthenticationFilter --> attemptAuthentication");

        if (!request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException(
                    "Authentication method not supported: " + request.getMethod());
        }
        LoginRequest loginRequest = builderLoginRequest(request);
        TeResponse resp = userService.login(loginRequest);
        if (!resp.isStatus()) {
            throw new BadCredentialsException(resp.getMessage()+"="+resp.getStatusCode());
        }

        UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
                loginRequest.getAccount(), BCrypt.hashpw(loginRequest.getPassword(), BCrypt.gensalt()));

        setDetails(request, authRequest);
        return this.getAuthenticationManager().authenticate(authRequest);
    }

    /**
    * 构造请求参数
    **/
    @SuppressWarnings("unchecked")
    private LoginRequest builderLoginRequest(HttpServletRequest request){
        if(request.getContentType().equals(MediaType.APPLICATION_JSON_UTF8_VALUE)
                ||request.getContentType().equals(MediaType.APPLICATION_JSON_VALUE)){
            ObjectMapper mapper = new ObjectMapper();
            try (InputStream is = request.getInputStream()){
                Map<String,String> map = mapper.readValue(is, Map.class);
                return getLoginRequest(map);
            }catch (IOException e) {
                LOGGER.error("builderLoginRequest error-->",e);
                throw new BadCredentialsException("请求格式异常=1003");
            }
        }
        else{
            return getLoginRequest(request);
        }
    }

    /**
    * 构造请求参数 
    * application/x-www-form-urlencoded    
    **/
    private LoginRequest getLoginRequest(HttpServletRequest request){
        LoginRequest loginRequest = new LoginRequest();
        loginRequest.setUuid(request.getParameter(USER_UUID_KEY));
        loginRequest.setVerifyCode(request.getParameter(USER_VERIFY_CODE_KEY));
        loginRequest.setAccount(request.getParameter(USER_ACCOUNT_KEY));
        loginRequest.setPassword(request.getParameter(USER_PASSWORD_KEY));
        return loginRequest;
    }
    /**
    * 构造请求参数 
    * application/json 
    **/
    private LoginRequest getLoginRequest(Map<String,String> parameters ){
        LoginRequest loginRequest = new LoginRequest();
        loginRequest.setUuid(parameters.get(USER_UUID_KEY));
        loginRequest.setVerifyCode(parameters.get(USER_VERIFY_CODE_KEY));
        loginRequest.setAccount(parameters.get(USER_ACCOUNT_KEY));
        loginRequest.setPassword(parameters.get(USER_PASSWORD_KEY));
        return loginRequest;
    }

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    private static String[] pathArray = new String[]{
            "/user/captcha/base64Code","/user/forget/password"
    };

    @Autowired
    private UserAuthenticationManager userAuthenticationManager;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.cors().configurationSource(getSource());
        http.csrf().disable();

        http.authorizeRequests()
                .antMatchers(pathArray).permitAll()
                .anyRequest().authenticated();
        // 添加登录自定义过滤器
        http.addFilterAt(userLoginAuthenticationFilter(),UsernamePasswordAuthenticationFilter.class);


        http.logout()
                .logoutUrl("/logout")
                .deleteCookies("JSESSIONID")
                .invalidateHttpSession(true)
                .logoutSuccessHandler(logoutSuccessHandler())
                .permitAll();

        http.exceptionHandling()
                .authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint())
                .accessDeniedHandler(accessDeniedHandler());
    }

    @Bean
    UserLoginAuthenticationFilter userLoginAuthenticationFilter(){
        UserLoginAuthenticationFilter filter = new UserLoginAuthenticationFilter();
        filter.setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher("/user/login", "POST"));
        filter.setAuthenticationFailureHandler(failureHandler());
        filter.setAuthenticationSuccessHandler(authSuccessHandler());
        filter.setAuthenticationManager(userAuthenticationManager);
        return filter;
    }

    private UrlBasedCorsConfigurationSource getSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        String corsAllowedOrigins = "http://127.0.0.1:20880,http://127.0.0.1:20881";
        configuration.setAllowedOrigins(Arrays.asList(corsAllowedOrigins.split(",")));
        String corsAllowedMethod = "POST, GET, OPTIONS";
        configuration.setAllowedMethods(Arrays.asList(corsAllowedMethod.split(",")));
        configuration.applyPermitDefaultValues();
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        String corsPath = "/**";
        source.registerCorsConfiguration(corsPath, configuration);
        return source;
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.securityInterceptor(new SecurityInterceptor());
    }

    @Bean
    AuthenticationSuccessHandler authSuccessHandler() {
        return new UserAuthenticationHandler();
    }

    @Bean
    AuthenticationFailureHandler failureHandler() {
        return new UserAuthenticationFailureHandler();
    }

    @Bean
    LogoutSuccessHandler logoutSuccessHandler() {
        return new UserLogoutSuccessHandler();
    }

    @Bean
    AccessDeniedHandler accessDeniedHandler() {
        return new UserAccessDeniedHandler();
    }
}

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        String[] pathArray = new String[] {"/user/captcha/base64Code","/user/send/sms/verifyCode","/user/forget/password"};
        http.cors();
        http.csrf().disable();
        http.authorizeRequests()
                .anyRequest().authenticated()
                // 请求访问控制
                .accessDecisionManager(accessDecisionManager())
                .antMatchers(pathArray).permitAll()
                .anyRequest().authenticated();

        http.formLogin()
                .loginProcessingUrl("/user/login")
                //登录成功
                .successHandler(authSuccessHandler())
                //登录失败
                .failureHandler(failureHandler())
                .permitAll();

        http.logout()
                .logoutUrl("/logout")
                .deleteCookies("JSESSIONID")
                .invalidateHttpSession(true)
                //退出成功
                .logoutSuccessHandler(logoutSuccessHandler())
                .permitAll();
        http.exceptionHandling()
                //未授权拦截调转
                .authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint())
                .accessDeniedHandler(accessDeniedHandler());
    }
    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        System.out.println("configure");
        auth.userDetailsService(userDetailsService);
    }

    @Bean
    @Override
    protected AuthenticationManager authenticationManager() {
        System.out.println("authenticationManager");
        return new UserAuthenticationManager();
    }

    @Bean
    AuthenticationSuccessHandler authSuccessHandler() {
        return new UserAuthenticationHandler();
    }

    @Bean
    AuthenticationFailureHandler failureHandler() {
        return new UserFailureHandler();
    }

    @Bean
    public AccessDecisionManager accessDecisionManager() {
        List<AccessDecisionVoter<?>> decisionVoters = Arrays.asList(
                new RoleVoter(),
                authorityVoter()
        );
        return new UnanimousBased(decisionVoters);
    }

    @Bean
    UserAccessDecisionVoter authorityVoter() {
        return new UserAccessDecisionVoter();
    }

    @Bean
    LogoutSuccessHandler logoutSuccessHandler() {
        return new UserLogoutSuccessHandler();
    }

    @Bean
    AccessDeniedHandler accessDeniedHandler() {
        return new UserAccessDeniedHandler();
    }

@Service
public class UserDetailsServiceImpl implements UserDetailsService {
    /**
     *  通过用户名查询用户详细信息
     * @param username
     * @return
     * @throws UsernameNotFoundException
     */
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        System.out.println("loadUserByUsername");
        //查询 User
        return null;
    }
}

public class UserAccessDecisionVoter implements AccessDecisionVoter {
    @Override
    public boolean supports(ConfigAttribute attribute) {
        return true;
    }

    @Override
    public int vote(Authentication authentication, Object object, Collection collection) {
        System.out.println("UserAccessDecisionVoter");
        FilterInvocation fi = (FilterInvocation) object;
        System.out.println(fi.getRequestUrl());
        return 1;
    }

    @Override
    public boolean supports(Class clazz) {
        return clazz.equals(FilterInvocation.class);
    }
}

public class UserAuthenticationManager implements AuthenticationManager {

    private static final Logger LOGGER = LoggerFactory.getLogger(UserAuthenticationManager.class);
    @Reference(version = "1.0")
    private UserService userService;

    private final List<GrantedAuthority> AUTHORITIES = new ArrayList<>();

    public UserAuthenticationManager() {
        AUTHORITIES.add(new SimpleGrantedAuthority("ROLE_USER"));
    }

    @Override
    public Authentication authenticate(Authentication auth) throws AuthenticationException {

        if (check(auth)) {
            LOGGER.info("UserAuthenticationManager -->");
            return new UsernamePasswordAuthenticationToken(auth.getPrincipal(), auth.getCredentials(), AUTHORITIES);
        }
        throw new BadCredentialsException("Bad Credentials");
    }  
    ...
}

public class UserAuthenticationHandler extends SimpleUrlAuthenticationSuccessHandler {
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request
            , HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        response.setCharacterEncoding("UTF-8");
        System.out.println("onAuthenticationSuccess");
        // 定义调转方式
        // JSON.writeJSONString(response.getWriter(), result);
    }
}

public class UserFailureHandler extends SimpleUrlAuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response
            , AuthenticationException exception) throws IOException, ServletException {
        response.setCharacterEncoding("UTF-8");
        logger.info("onAuthenticationFailure "+exception.getMessage(),exception);

        if(exception instanceof BadCredentialsException){
            String[] array = exception.getMessage().split("=");
            if(array.length>1){
              JSON.writeJSONString(response.getWriter(), TeResponse.error(array[0],array[1]));
              return;
            }
        }
        JSON.writeJSONString(response.getWriter(), TeResponse.error(StateEnum.S_1004));
    }
}

public class UserLogoutSuccessHandler implements LogoutSuccessHandler {
    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        SessionUtil.removeSessionAttribute(Const.LOGIN_SESSION_KEY, request);
        SecurityContextHolder.clearContext();
        response.setCharacterEncoding("UTF-8");
        JSON.writeJSONString(response.getWriter(), TeResponse.success());
    }
}

### UserAccessDeniedHandler 自定义权限不足
```java
public class UserAccessDeniedHandler implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
        TeUser user = SessionUtil.getSessionAttribute(Const.LOGIN_SESSION_KEY, request);
        System.out.println("UserAccessDeniedHandler");
        response.setCharacterEncoding("UTF-8");
        if (null == user) {
            JSON.writeJSONString(response.getWriter(), TeResponse.error(StateEnum.S_401));
        }
        else{
            JSON.writeJSONString(response.getWriter(), TeResponse.error(StateEnum.S_403));
        }
    }
}

public class UserAccessDeniedHandler implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
        TeUser user = SessionUtil.getSessionAttribute(Const.LOGIN_SESSION_KEY, request);
        System.out.println("UserAccessDeniedHandler");
        response.setCharacterEncoding("UTF-8");
        if (null == user) {
            JSON.writeJSONString(response.getWriter(), TeResponse.error(StateEnum.S_401));
        }
        else{
            JSON.writeJSONString(response.getWriter(), TeResponse.error(StateEnum.S_403));
        }
    }
}

public class LoginUrlAuthenticationEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
       System.out.println("LoginUrlAuthenticationEntryPoint");
        response.setContentType("application/json;charset=utf-8");
        PrintWriter out = response.getWriter();
        out.write(JsonUtil.toJSON(TeResponse.error(StateEnum.S_401)));
        out.flush();
        out.close();
    }
}

@Activate(group = Constants.PROVIDER)
public class DubboFilter implements Filter {

    private final static Logger logger = LoggerFactory.getLogger(DubboFilter.class);

    @Override
    public Result invoke(Invoker<?> invoker, Invocation invocation) {
        logger.info("#############DubboFilter start###############" );
        Result result  = invoker.invoke(invocation);
        Throwable exception = result.getException();
        if (exception != null) {
            logger.error("dubbo " + invocation.getMethodName()+" error-->" , exception);
            result = new RpcResult(Result.error("请求异常拦截", "-1"));
        }
        logger.info("#############DubboFilter end###############" );
        return result;
    }
}

[10-11 13:37:31.031] [WARN] [cat] Cat is lazy initialized!
this app is start
{"message":"请求异常拦截","result":null,"status":false,"statusCode":"-1"}