實現權限控制步驟如下： **1. 配置訪問權限** ```java @Configuration public class SecurityConfig extends WebSecurityConfigurerAdapter { @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } @Override protected void configure(HttpSecurity http) throws Exception { http.formLogin() .loginPage("/to/login") .loginProcessingUrl("/login") .successForwardUrl("/success") .failureForwardUrl("/fail"); http.authorizeRequests() .antMatchers("/layui/**", "/to/login") .permitAll() //當用戶有admin權限時才能訪問/account/list01 .antMatchers("/account/list01").hasAuthority("admin") //當用戶有admin02，或admin03權限時才能訪問/account/list02 .antMatchers("/account/list02").hasAnyAuthority("admin02", "admin03") //當用戶屬于role角色時才能訪問/account/list03，否則出現403頁面 .antMatchers("/account/list03").hasRole("role") //當用戶屬于role02，或role03角色時才能訪問 .antMatchers("/account/list04").hasAnyRole("role02", "role03") .anyRequest() .authenticated(); http.csrf().disable(); } } ``` **2. 在用戶登錄時加載當前用戶所有的權限與角色** ```java @Service @RequiredArgsConstructor public class LoginServiceImpl implements UserDetailsService { final AccountService accountService; final MenuMapper menuMapper; final RoleMapper roleMapper; @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { Account account = accountService.findByUsername(username); if (account == null) { throw new UsernameNotFoundException("用戶名不存在！"); } //從數據庫中查詢當前用戶的權限與角色 List<Menu> menuList = menuMapper.findByAccountId(account.getId()); List<Role> roleList = roleMapper.findByAccountId(account.getId()); //存儲權限與角色的集合 List<GrantedAuthority> authorities = new ArrayList<>(1); //處理權限 for (Menu menu : menuList) { authorities.add(new SimpleGrantedAuthority(menu.getPermission())); } //處理角色 for (Role role : roleList) { //角色必須以 ROLE_ 字符串為前綴 authorities.add(new SimpleGrantedAuthority("ROLE_" + role.getName())); } return new User(username, account.getPassword(), authorities); } } ``` **3. 測試** 登錄之后，有權限訪問的則正常訪問，沒有權限訪問的返回403頁面。 ``` Whitelabel Error Page This application has no explicit mapping for /error, so you are seeing this as a fallback. Fri Jun 10 20:21:37 CST 2022 There was an unexpected error (type=Forbidden, status=403). Forbidden ```