@ConfigurationpublicclassSecurityConfigextendsWebSecurityConfigurerAdapter{@Overrideprotectedvoidconfigure(HttpSecurityhttp)throwsException{RequestMatchercsrfRequestMatcher=newRequestMatcher(){// CSRF対象外URL:privateAntPathRequestMatcher[]requestMatchers={newAntPathRequestMatcher("/api/login")};@Overridepublicbooleanmatches(HttpServletRequestrequest){for(AntPathRequestMatcherrm:requestMatchers){if(rm.matches(request)){returnfalse;}}returntrue;}};http.authorizeRequests().antMatchers("/images/**","/scripts/**","/styles/**","/views/**","/index.html","/api/login").permitAll().anyRequest().authenticated()//上記にマッチしなければ未認証の場合エラー.and().csrf().requireCsrfProtectionMatcher(csrfRequestMatcher).csrfTokenRepository(this.csrfTokenRepository());}privateCsrfTokenRepositorycsrfTokenRepository(){HttpSessionCsrfTokenRepositoryrepository=newHttpSessionCsrfTokenRepository();repository.setHeaderName("X-XSRF-TOKEN");returnrepository;}}

@ConfigurationpublicclassGlobalAuthenticationConfigextendsGlobalAuthenticationConfigurerAdapter{@Overridepublicvoidinit(AuthenticationManagerBuilderauth)throwsException{auth.userDetailsService(userDetailsService());}@BeanUserDetailsServiceuserDetailsService(){returnnewFooAuthService();}}

@RestController@RequestMapping("/api/")publicclassLoginRestController{@AutowiredLoginServiceloginService;@RequestMapping(value="login",method=RequestMethod.POST)ResponseEntity<PageDto>login(@RequestBodyLoginDtologinDto,HttpServletRequestrequest,HttpServletResponseresponse){PageDtopageDto=loginService.login(loginDto);if(pageDto.getHeaderDto().isAuth()){CsrfTokencsrf=(CsrfToken)request.getAttribute(CsrfToken.class.getName());if(csrf!=null){Cookiecookie=WebUtils.getCookie(request,"XSRF-TOKEN");Stringtoken=csrf.getToken();Authenticationauthentication=SecurityContextHolder.getContext().getAuthentication();if((cookie==null||token!=null&&!token.equals(cookie.getValue()))&&(authentication!=null&&authentication.isAuthenticated())){cookie=newCookie("XSRF-TOKEN",token);cookie.setPath("/");//適切なスコープでresponse.addCookie(cookie);}}returnnewResponseEntity<>(pageDto,null,HttpStatus.OK);}else{returnnewResponseEntity<>(pageDto,null,HttpStatus.UNAUTHORIZED);}}@RequestMapping(value="logout",method=RequestMethod.POST)voidlogout(HttpServletRequestrequest){try{request.logout();}catch(ServletExceptione){thrownewRuntimeException(e);}}}

@ServicepublicclassLoginService{@AutowiredprotectedMappermapper;@AutowiredprivateAuthenticationManagerauthManager;/**     * ログイン処理を行います.     * @return     */publicPageDtologin(LoginDtologinDto){PageDtopageDto=newPageDto();LoginDtooutLoginDto=mapper.map(loginDto,LoginDto.class);pageDto.setLoginDto(outLoginDto);HeaderDtoheaderDto=newHeaderDto();pageDto.setHeaderDto(headerDto);//Spring Security認証処理AuthenticationauthResult=null;try{Authenticationrequest=newUsernamePasswordAuthenticationToken(loginDto.getMailAddress(),loginDto.getPassword());authResult=authManager.authenticate(request);SecurityContextHolder.getContext().setAuthentication(authResult);FooUserDetailsprincipal=(FooUserDetails)authResult.getPrincipal();headerDto.setNickName(principal.getUserInfo().getNickName());headerDto.setAuth(true);}catch(AuthenticationExceptione){outLoginDto.setMessage("メールアドレスかパスワードがまちがっています。");headerDto.setAuth(false);}returnpageDto;}}

<!-- 略 --><divclass="header"ng-controller="HeaderCtrl"><!-- 略 --><divclass="collapse navbar-collapse"id="js-navbar-collapse"><ulclass="nav navbar-nav"><liclass="active"><ahref="#/">Home</a></li><ling-if="!headerDto.auth"><inputtype="button"class="btn btn-info"value="ログイン"ng-click="loginDialog()"/></li><ling-if="headerDto.auth"><inputtype="button"class="btn btn-info"value="ログアウト"ng-click="logout()"/></li><li><divng-if="headerDto.auth">{{headerDto.nickName}}さん</div></li></ul><divng-includesrc="'./views/login.html'"></div></div><!-- 略 --></div><!-- 略 -->

<div><scripttype="text/ng-template"id="login.tmpl.html"><divclass="modal-header"><h4>ログイン</h4></div><divclass="modal-body"><span>{{loginDto.message}}</span><br/><label>メールアドレス</label><inputtype="text"class="form-control"ng-model="loginDto.mailAddress"><br/><label>パスワード</label><inputtype="password"class="form-control"ng-model="loginDto.password"><br/><inputtype="button"class="btn btn-info"value="ログイン"ng-click="login()"/><inputtype="button"class="btn btn-default"value="cancel"ng-click="cancel()"/></div></script></div>

angular.module('fooApp').factory('loginHttp',['$http',function($http){varlogin={login:function(param){return$http.post('/foo/api/login',param);},logout:function(){return$http.post('/foo/api/logout');}}returnlogin;}]);

angular.module('fooApp').controller('HeaderCtrl',['$scope','$modal','loginHttp',function($scope,$modal,loginHttp){$scope.loginDialog=function(){varmodalInstance=$modal.open({size:'sm',templateUrl:'login.tmpl.html',controller:'LoginCtrl'});modalInstance.result.then(function(data){$scope.headerDto=data;});};$scope.logout=function(){loginHttp.logout();$scope.headerDto={};}}]);

angular.module('fooApp').controller('LoginCtrl',['$scope','loginHttp','$modalInstance',function($scope,loginHttp,$modalInstance){$scope.login=function(){loginHttp.login({mailAddress:$scope.loginDto.mailAddress,password:$scope.loginDto.password}).success(function(data){$scope.loginDto=data.loginDto;$modalInstance.close(data.headerDto);}).error(function(data){$scope.loginDto=data.loginDto;})}$scope.cancel=function(){$modalInstance.close();}}]);