@Component
public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 在這里自定義配置
    }
}

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 在這里自定義配置
        http.authorizeRequests()
                .anyRequest()
                .authenticated()
                .and()
                .exceptionHandling()
                // 認(rèn)證失敗返回401狀態(tài)碼，前端頁面可以根據(jù)401狀態(tài)碼跳轉(zhuǎn)到登錄頁面
                .authenticationEntryPoint((request, response, authException) ->
                        response.sendError(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase()))
                .and().cors()
                // csrf是否決定禁用，請自行考量
                .and().csrf().disable()
//                .antMatcher("/**")
                // 采用http 的基本認(rèn)證.
                .httpBasic();
    }

@RequestMapping("/login")
@RestController
public class LoginController {

    @PostMapping()
    public Object login() {
        return "login success";
    }

    @GetMapping("/captcha")
    public Object captcha() {
        return "1234";
    }
}

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 在這里自定義配置
        http.authorizeRequests()
                // 登錄相關(guān)接口都允許訪問
                .antMatchers("/login/**").permitAll()
                // 還有其它接口就這樣繼續(xù)寫
                .antMatchers("/other/**").permitAll()
                .anyRequest()
                .authenticated()
				... 省略下面的
    }