要想實現 Spring Security 返回 JSON 格式串，只需重寫以下幾個處理器（JavaConfig）

• http.exceptionHandling().accessDeniedHandler()
• http.exceptionHandling().authenticationEntryPoint()
• http.formLogin().successHandler()
• http.formLogin().failureHandler()
• http.logout().logoutSuccessHandler()

最終實現的效果為：

//登入失敗(賬號不存在)
{"code":1,"message"
 
:"User is disabled"}
//登入失敗(密碼錯誤)
{"code":1,"message":"Bad credentials"}

//登入成功
{"code":0,"message":"登入成功"}

//訪問拒絕
{"code":1,"message":"Access is denied"}

//登出成功
{"code":0,"message":"已登出"}

//未經授權就訪問資源
{"code":1,"message":"Full authentication is required to access this resource"}

（1）build.gradle 新增專案依賴

compile 'org
 
.springframework.security:spring-security-web:4.2.3.RELEASE'
compile group: 'org.springframework.security', name: 'spring-security-config', version: '4.2.3.RELEASE'

（2）訪問控制配置（JavaConfig）：SecurityConfigurer《Filter, WebSecurity> 是 WebSecurityConfigurerAdapter 的父類，Spring Security 會在容器內尋找上述介面的實現類 Bean，因此只要我們新建一個派生類繼承 WebSecurityConfigurerAdapter 並注入容器內，就能被自動配置（經由被重寫的模板方法）

@Configuration
@Import(RootConfig.class)
public class GoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    //......

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .exceptionHandling()
                    .accessDeniedHandler(new GoAccessDeniedHandler())
                    .authenticationEntryPoint(new GoAuthenticationEntryPoint())
                .and().authorizeRequests()
                    .antMatchers("/", "/csrf").permitAll()
                    .antMatchers("/hello").hasAuthority("ADMIN")
                    .anyRequest().authenticated()
                .and().formLogin()
                    .loginProcessingUrl("/login").permitAll()
                    .successHandler(new GoAuthenticationSuccessHandler())
                    .failureHandler(new GoAuthenticationFailureHandler())
                .and().logout()
                    .logoutUrl("/logout")
                    .logoutSuccessHandler(new GoLogoutSuccessHandler())
                    .invalidateHttpSession(true)
                    .deleteCookies("JSESSIONID")
                .and().requiresChannel()
                    .antMatchers("/pomer").requiresSecure()
                    .anyRequest().requiresInsecure()
                .and().rememberMe()
                    .tokenValiditySeconds(1800)
                    .key("token_key");
    }
}

GoAccessDeniedHandler

public class GoAccessDeniedHandler implements AccessDeniedHandler {

    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response,
                       AccessDeniedException exception) throws IOException, ServletException {
        response.setHeader("Content-Type", "application/json;charset=utf-8");
        response.getWriter().print("{\"code\":1,\"message\":\""+exception.getMessage()+"\"}");
        response.getWriter().flush();
    }
}

GoAuthenticationEntryPoint

public class GoAuthenticationEntryPoint implements AuthenticationEntryPoint {

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response,
                         AuthenticationException exception) throws IOException, ServletException {
        response.setHeader("Content-Type", "application/json;charset=utf-8");
        response.getWriter().print("{\"code\":1,\"message\":\""+exception.getMessage()+"\"}");
        response.getWriter().flush();
    }
}

GoAuthenticationFailureHandler

public class GoAuthenticationFailureHandler implements AuthenticationFailureHandler {

    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
                                        AuthenticationException exception) throws IOException, ServletException {
        response.setHeader("Content-Type", "application/json;charset=utf-8");
        response.getWriter().print("{\"code\":1,\"message\":\""+exception.getMessage()+"\"}");
        response.getWriter().flush();
    }
}

GoAuthenticationSuccessHandler

public class GoAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                                        Authentication authentication) throws IOException, ServletException {
        response.setHeader("Content-Type", "application/json;charset=utf-8");
        response.getWriter().print("{\"code\":0,\"message\":\"登入成功\"}");
        response.getWriter().flush();
    }
}

GoLogoutSuccessHandler

public class GoLogoutSuccessHandler implements LogoutSuccessHandler {

    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response,
                                Authentication authentication) throws IOException, ServletException {
        response.setHeader("Content-Type", "application/json;charset=utf-8");
        response.getWriter().print("{\"code\":0,\"message\":\"已登出\"}");
        response.getWriter().flush();
    }
}