我想知道-您可以拒绝访问（用户已经通过身份验证）早期，而不处理整个过滤链，您可以做同样的授予访问权吗？
目前我正在研究投票机制( AccessDecisionManager , AccessDecisionVoter )但这似乎不可能实现。

public class MyVoter implements AccessDecisionVoter<Object> {
    @Override
    public int vote(Authentication authentication, Object object, Collection collection) {
        var principal = authentication.getPrincipal();
        if (principal instanceof MyUserDetails) {
            var myUser = (MyUser)principal;
            if(myUser.isAdmin()) {
                // stop further processing at this point, admin has access anywhere
                return ACCESS_GRANTED;
            }
        }

        // could not decide - forward request to concrete, business logic evaluators
        return ACCESS_ABSTAIN;
    }

    @Override
    public boolean supports(ConfigAttribute attribute) {
        // no custom ConfigAttribute's - process all
        return true;
    }

    @Override
    public boolean supports(Class clazz) {
        // no customization for class - should process ALL requests
        return true;
    }
}

这里我只提供了一个虚拟的例子，实际授予访问权限的规则更复杂，但我的想法希望得到解释。