在www.example.com上查看FilterRegistrationBean参考指南https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#boot-features-embedded-container-servlets-filters-listeners-beans。
通过@Configuration类使FilterRegistrationBean可用于Spring，下面的示例将确保authFilter仅为/getUserData运行。请注意，它是基于URL（而不是方法）的过滤。

@Autowired AuthFilter authfilter;
....
....
@Bean
public FilterRegistrationBean authFilterRegistration() {
    FilterRegistrationBean registration = new FilterRegistrationBean(authfilter);
    registration.addUrlPatterns("/web-app-name/getUserData/");
    return registration;
}

我会推荐你做拦截者

@Configuration 
public class Config extends WebMvcConfigurerAdapter {

@Autowired
RequestInterceptor requestInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(requestInterceptor).addPathPatterns("/getUserData","/user");
    }

}

拦截器-

@Component
public class RequestInterceptor extends HandlerInterceptorAdapter {

@Override
public boolean preHandle(HttpServletRequest request,
        HttpServletResponse response, Object object) throws Exception {
}

您可以根据需要覆盖Interceptor的prehandle和postHandle。

这是更容易的方式，只是有所有的方法背后的身份验证有一个网址前缀，如。admin/或其他。
建议的定义所有URL路径模式的选项效率不高，应用程序可以有数百个URL模式进行过滤
您的示例将如下所示

@RestController
@RequestMapping("/users")
public class UserController {

    //...
    // changed here - added '/admin'
    @RequestMapping("/admin/getUserData")
    public String getUserData(@PathVariable Long userId) {
        return user;
    }
}

创建一个HandlerInterceptor-Spring 3.1.0或使用HandlerInterceptorAdapter为较低版本阅读有关它在 Spring 网站。
创建一个方法来检查所有URL前缀为admin/或任何你喜欢的请求。使用prehandle覆盖方法中的方法。如果URL具有admin/前缀，则可以运行身份验证代码，否则忽略，请参阅下文

@Component
public class AdminAuthInterceptor implements HandlerInterceptor
{
    @Override
    public boolean preHandle(HttpServletRequest request,HttpServletResponse response, Object handler) throws Exception
    {
        boolean result = true;
        if (this.isAdminPath(request))
        {
            /*
            boolean validation = true; // plug here you validation service
            if(!validation)
            {
                    try
                    {
                        response.setStatus(HttpStatus.UNAUTHORIZED.value());
                        response.setContentType("application/json");
                        response.getWriter().write("{'status':false,'msg':'User Authentication Failed'}");
                    } catch (IOException e)
                    {
                        // TODO Auto-generated catch block
                        e.printStackTrace();
                    }
                }
             */
        }
        return result;
    }
    private boolean isAdminPath(HttpServletRequest request)
    {
        String urlPath = request.getRequestURI();
        return urlPath != null && urlPath.contains("admin/");
    }
}