先從使用xml的方式來實現使用者的許可權登入

（1）需要在maven工程中加上關於spring-secutity的jar包的依賴

//spring-securityd 有關的依賴
    <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
        </dependency>

        <dependency
 
>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
        </dependency>

（2）建立一個spirng-security的配置檔案

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
 

    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"
 
>

    <!-- 設定頁面不登陸也可以訪問進行訪問所有的靜態資源。這裡可以自行配置 -->
    <http pattern="/*.html" security="none"></http>
    <http pattern="/css/**" security="none"></http>
    <http pattern="/img/**" security="none"></http>
    <http pattern="/js/**" security="none"></http>
    <http pattern="/plugins/**" security="none"></http>

    <!-- 頁面的攔截規則    use-expressions:是否啟動SPEL表示式 預設是true -->
    <http use-expressions="false" >
        <!-- 當前使用者必須有ROLE_USER的角色 才可以訪問根目錄及所屬子目錄的資源 -->
        <intercept-url pattern="/**" access="ROLE_ADMIN"/>
        <!-- 開啟表單登陸功能 -->
        <form-login  login-page="/login.html" default-target-url="/admin/index.html" authentication-failure-url="/login.html" always-use-default-target="true"/>
        <csrf disabled="true"/>
        <headers>
            <frame-options policy="SAMEORIGIN"/>
        </headers>
        <logout/>
    </http>


    <!-- 認證管理器 -->
    <authentication-manager>
        <authentication-provider>
            <user-service>
            //這個是你配置的可以登入的使用者，authorities的值必須是ROLE_XXX的命名方式
                <user name="admin" password="123456" authorities="ROLE_ADMIN"/>
                <user name="sunwukong" password="dasheng" authorities="ROLE_ADMIN"/>
                <user name="wangwei" password="123456" authorities="ROLE_ADMIN"/>
            </user-service>
        </authentication-provider>  
    </authentication-manager>

</beans:beans>

（3）還需要在web.xml檔案中進行配置一個springSecurityFilterChain的過濾鏈

    //這裡是把（2）步驟中新增的檔案進行引用
     <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring/spring-security.xml</param-value>
     </context-param>
     <listener>
        <listener-class>
            org.springframework.web.context.ContextLoaderListener
        </listener-class>
     </listener>
    <!-- 這個是配置的spring-security過濾鏈 -->
     <filter>  
        <filter-name>springSecurityFilterChain</filter-name>  
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>  
     </filter>  
     <filter-mapping>  
        <filter-name>springSecurityFilterChain</filter-name>  
        <url-pattern>/*</url-pattern>  
     </filter-mapping>