SpringBoot Security权限控制自定义failureHandler实例

package com.edurt.hander;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.WebAttributes;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
import org.springframework.stereotype.Component;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@Component(value = "customAuthenticationFailHander")
public class CustomAuthenticationFailHander extends SimpleUrlAuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        System.out.println("登录失败!!!");
        this.returnJson(response, exception);
    }
    
    private void returnJson(HttpServletResponse response,
                            AuthenticationException exception) throws IOException {
        response.setCharacterEncoding("UTF-8");
        response.setContentType("application/json");
        response.getWriter().println("{\"ok\":0,\"msg\":\"" + exception.getLocalizedMessage() + "\"}");
    }
    
    private void returnErrorPage(HttpServletRequest request, HttpServletResponse response,
                                 AuthenticationException exception) throws IOException, ServletException {
        String strUrl = request.getContextPath() + "/loginErrorPath";
        request.getSession().setAttribute("status", 0);
        request.getSession().setAttribute("message", exception.getLocalizedMessage());
        request.getSession().setAttribute(WebAttributes.AUTHENTICATION_EXCEPTION, exception);
        // 使用该方法会出现错误
//        request.getRequestDispatcher(strUrl).forward(request, response);
        response.sendRedirect(strUrl);
    }
}

@Autowired
private CustomAuthenticationFailHander customAuthenticationFailHander;
@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable()
            // 允许直接访问/路径
            .authorizeRequests().antMatchers("/").permitAll()
            // 使其支持跨域
            .requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
            // 其他路径需要授权访问
            .anyRequest().authenticated()
            // 指定登录页面
            .and().formLogin().loginPage("/user/login")
            // 指定登录失败跳转地址, 使用自定义错误信息
            .failureHandler(customAuthenticationFailHander)
            // 登录成功后的默认路径
            .defaultSuccessUrl("/").permitAll()
            // 退出登录后的默认路径
            .and().logout().logoutSuccessUrl("/user/login").permitAll();
}