@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
   public static final List<String> WHITE_LIST = asList("/authenticate");
   public static final List<String> TOKEN1_LIST = asList("/get-access-token");
   public static final List<String> TOKEN2_LIST = asList("/add-new-user");
   @Autowired
   private Token1Filter token1Filter;
   @Autowired
   private Token2Filter token2Filter;
   @Override
   protected void configure(HttpSecurity http) throws Exception {
     http.csrf().disable()
            .formLogin().disable()
            .httpBasic().disable()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .exceptionHandling().authenticationEntryPoint((req, rsp, e) -> rsp.sendError(HttpServletResponse.SC_UNAUTHORIZED))
            .and()
            .authorizeRequests()
            .antMatchers(OPTIONS).permitAll()
            .antMatchers(GET, WHITE_LIST.toArray(new String[WHITE_LIST.size()])).permitAll()
            .anyRequest().authenticated()
            .and()
            .addFilterBefore(token1Filter, UsernamePasswordAuthenticationFilter.class)
            .addFilterBefore(token2Filter, UsernamePasswordAuthenticationFilter.class);
  }
}

@AllArgsConstructor
@Component
public class Token1Filter extends OncePerRequestFilter {
  private static final String TOKEN_PREFIX = "Bearer ";
  @Override
  protected void doFilterInternal (HttpServletRequest request, HttpServletResponse response,
                                 FilterChain filterChain) throws ServletException, IOException {
    getJwt(request)
            .ifPresent(jwt1 -> {
                /**
                 *    在这里，您可以使用功能来检查提供的Jwt令牌1，
                 * 将包含的数据添加到Spring SecurityContextHolder中。
                 */
                // 用于测试目的
                SecurityContextHolder.getContext().setAuthentication(
                        new UsernamePasswordAuthenticationToken("testUserToken1", null, new ArrayList<>())
                );
            });
    filterChain.doFilter(request, response);
  }
  @Override
  protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException {
    return !WebSecurityConfiguration.TOKEN1_LIST.contains(request.getRequestURI());
  }
  private Optional<String> getJwt(HttpServletRequest request) {
    return ofNullable(request)
            .map(r -> r.getHeader(AUTHORIZATION))
            .filter(Predicate.not(String::isEmpty))
            .map(t -> t.replace(TOKEN_PREFIX, ""))
            .filter(Predicate.not(String::isEmpty));
  }
}
@AllArgsConstructor
@Component
public class Token2Filter extends OncePerRequestFilter {
  private static final String TOKEN_PREFIX = "Bearer ";
  @Override
  protected void doFilterInternal (HttpServletRequest request, HttpServletResponse response,
                                 FilterChain filterChain) throws ServletException, IOException {
    getJwt(request)
            .ifPresent(jwt2 -> {
                /**
                 *    在这里，您可以使用功能来检查提供的Jwt令牌2，
                 * 将包含的数据添加到Spring SecurityContextHolder中。
                 */
                // 用于测试目的
                SecurityContextHolder.getContext().setAuthentication(
                        new UsernamePasswordAuthenticationToken("testUserToken2", null,
                                asList(new SimpleGrantedAuthority("ADMIN")))
                );
            });
    filterChain.doFilter(request, response);
  }
  @Override
  protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException {
    return !WebSecurityConfiguration.TOKEN2_LIST.contains(request.getRequestURI());
  }
  private Optional<String> getJwt(HttpServletRequest request) {
    return ofNullable(request)
            .map(r -> r.getHeader(AUTHORIZATION))
            .filter(Predicate.not(String::isEmpty))
            .map(t -> t.replace(TOKEN_PREFIX, ""))
            .filter(Predicate.not(String::isEmpty));
  }
}

@AllArgsConstructor
@RestController
public class TestController {
  @GetMapping("/authenticate")
  public ResponseEntity<String> authenticate(@RequestParam String username, @RequestParam String password) {
    return new ResponseEntity("[authenticate] Testing purpose", OK);
  }
  @GetMapping("/get-access-token")
  public ResponseEntity<String> getAccessToken() {
    return new ResponseEntity("[get-access-token] Testing purpose", OK);
  }
  @GetMapping("/add-new-user")
  @PreAuthorize("hasAuthority('ADMIN')")
  public ResponseEntity<String> addNewUser() {
    return new ResponseEntity("[add-new-user] Testing purpose", OK);
  }
}