Spring Security和WT登录认证实现

下面是Spring Security和WT登录认证的实现步骤：

1. 配置Spring Security

在Spring Security的配置文件中，需要定义用户的身份认证方式，可以使用基于数据库、LDAP等多种方式。具体的配置可以参考Spring Security的官方文档。

2. 添加WT支持

可以使用第三方库，如jjwt，来实现WT的支持。在生成WT Token时，需要指定过期时间、用户信息等内容。

3. 实现登录接口

在登录接口中，需要使用Spring Security进行身份认证，验证用户名和密码是否正确。如果验证通过，可以生成WT Token，并将Token返回给前端。

4. 实现Token验证拦截器

在拦截器中，需要解析前端传递的Token，并验证Token的有效性。如果Token有效，则允许用户访问对应的资源。

具体实现的代码可以参考以下示例：

1. 配置Spring Security

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/login").permitAll()
            .anyRequest().authenticated()
            .and()
            .addFilter(new JWTAuthenticationFilter(authenticationManager()))
            .addFilter(new JWTAuthorizationFilter(authenticationManager()))
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .csrf().disable();
    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder());
    }
}

2. 添加WT支持

public class JWTUtils {

    private static final String SECRET = "mySecret";
    private static final long EXPIRATION_TIME = 864_000_000; // 10 days
    private static final String TOKEN_PREFIX = "Bearer ";
    private static final String HEADER_STRING = "Authorization";

    public static String generateToken(Authentication auth) {
        UserDetails user = (UserDetails) auth.getPrincipal();
        Date expirationDate = new Date(System.currentTimeMillis() + EXPIRATION_TIME);
        String token = Jwts.builder()
                .setSubject(user.getUsername())
                .setExpiration(expirationDate)
                .signWith(SignatureAlgorithm.HS512, SECRET)
                .compact();
        return TOKEN_PREFIX + token;
    }

    public static Authentication verifyToken(HttpServletRequest request) {
        String token = request.getHeader(HEADER_STRING);
        if (token != null) {
            String user = Jwts.parser()
                    .setSigningKey(SECRET)
                    .parseClaimsJws(token.replace(TOKEN_PREFIX, ""))
                    .getBody()
                    .getSubject();
            if (user != null) {
                return new UsernamePasswordAuthenticationToken(user, null, new ArrayList<>());
            }
            return null;
        }
        return null;
    }
}

3. 实现登录接口

@RestController
public class LoginController {

    @Autowired
    private AuthenticationManager authenticationManager;

    @PostMapping("/login")
    public ResponseEntity<?> login(@RequestBody User user) {
        try {
            Authentication auth = authenticationManager.authenticate(
                    new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword()));
            String token = JWTUtils.generateToken(auth);
            return ResponseEntity.ok(new AuthResponse(token));
        } catch (BadCredentialsException e) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
        }
    }
}

4. 实现Token验证拦截器

public class JWTAuthorizationFilter extends BasicAuthenticationFilter {

    public JWTAuthorizationFilter(AuthenticationManager authenticationManager) {
        super(authenticationManager);
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
        Authentication auth = JWTUtils.verifyToken(request);
        if (auth != null) {
            SecurityContextHolder.getContext().setAuthentication(auth);
            chain.doFilter(request, response);
        } else {
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        }
    }
}

以上代码仅供参考，具体的实现方式可能因为业务需求和框架版本等因素而有所不同。