http //--------------授权相关的配置 ---------------------
            .authorizeRequests()  // /authentication/require：处理登录，securityProperties.getBrowser().getLoginPage():用户配置的登录页
                .antMatchers(SecurityConstants.DEFAULT_UNAUTHENTICATION_URL, securityProperties.getBrowser().getLoginPage(),//放过登录页不过滤，否则报错
                SecurityConstants.DEFAULT_LOGIN_PROCESSING_URL_MOBILE,SecurityConstants.SESSION_INVALID_PAGE,SecurityConstants.DEFAULT_VALIDATE_CODE_URL_PREFIX+"/*")//验证码.permitAll() //-------上边的不用授权也允许访问------//~=========简单的权限控制，只区分是否登录的情况可以配置在这里=======//  /user 的post请求需要ADMIN权限  .antMatchers("/user/*").hasRole("ADMIN").anyRequest()        //任何请求.authenticated()    //都需要身份认证

private SocialUserDetails buildUser(String userId) {String password = passwordEncoder.encode("123456");System.err.println("加密后密码：  "+password);//参数：用户名|密码|是否启用|账户是否过期|密码是否过期|账户是否锁定|权限集合return new SocialUser(userId,password,true,true,true,true,//工具类 将字符串转换为权限集合，ROLE_角色 是spring要求的权限格式 AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_ADMIN"));}

package com.imooc.security.rbac;import java.util.HashSet;
import java.util.Set;import javax.servlet.http.HttpServletRequest;import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;
import org.springframework.util.AntPathMatcher;@Component("rbacService")
public class RbacServiceImpl implements RbacService {private AntPathMatcher antPathMatcher = new AntPathMatcher();@Overridepublic boolean hasPermission(HttpServletRequest request, Authentication authentication) {Object principal = authentication.getPrincipal();boolean hasPermission = false;if(principal instanceof UserDetails){String username = ((UserDetails)principal).getUsername();//读取用户所有权限的url，需要查询数据库Set<String> urls = new HashSet<>();urls.add("/user/*");for(String url : urls){if(antPathMatcher.match(url, request.getRequestURI())){hasPermission = true ;break ;}}}return hasPermission;}}