| | |
| | | |
| | | /** |
| | | * spring security配置 |
| | | * |
| | | * |
| | | * @author ruoyi |
| | | */ |
| | | @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true) |
| | | public class SecurityConfig extends WebSecurityConfigurerAdapter |
| | | { |
| | | public class SecurityConfig extends WebSecurityConfigurerAdapter { |
| | | /** |
| | | * 自定义用户认证逻辑 |
| | | */ |
| | | @Autowired |
| | | private UserDetailsService userDetailsService; |
| | | |
| | | |
| | | /** |
| | | * 认证失败处理类 |
| | | */ |
| | |
| | | */ |
| | | @Autowired |
| | | private JwtAuthenticationTokenFilter authenticationTokenFilter; |
| | | |
| | | |
| | | /** |
| | | * 跨域过滤器 |
| | | */ |
| | |
| | | */ |
| | | @Bean |
| | | @Override |
| | | public AuthenticationManager authenticationManagerBean() throws Exception |
| | | { |
| | | public AuthenticationManager authenticationManagerBean() throws Exception { |
| | | return super.authenticationManagerBean(); |
| | | } |
| | | |
| | |
| | | * authenticated | 用户登录后可访问 |
| | | */ |
| | | @Override |
| | | protected void configure(HttpSecurity httpSecurity) throws Exception |
| | | { |
| | | protected void configure(HttpSecurity httpSecurity) throws Exception { |
| | | httpSecurity |
| | | // CSRF禁用,因为不使用session |
| | | .csrf().disable() |
| | | // 认证失败处理类 |
| | | .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and() |
| | | // 基于token,所以不需要session |
| | | .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and() |
| | | // 过滤请求 |
| | | .authorizeRequests() |
| | | .antMatchers( |
| | | HttpMethod.GET, |
| | | "/", |
| | | "/*.html", |
| | | "/**/*.html", |
| | | "/**/*.css", |
| | | "/**/*.js" |
| | | ).permitAll() |
| | | .antMatchers(securityProperties.getAnonymous()).anonymous() |
| | | .antMatchers(securityProperties.getPermitAll()).permitAll() |
| | | // 除上面外的所有请求全部需要鉴权认证 |
| | | .anyRequest().authenticated() |
| | | .and() |
| | | .headers().frameOptions().disable(); |
| | | // CSRF禁用,因为不使用session |
| | | .csrf().disable() |
| | | // 认证失败处理类 |
| | | .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and() |
| | | // 基于token,所以不需要session |
| | | .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and() |
| | | // 过滤请求 |
| | | .authorizeRequests() |
| | | .antMatchers( |
| | | HttpMethod.GET, |
| | | "/", |
| | | "/*.html", |
| | | "/**/*.html", |
| | | "/**/*.css", |
| | | "/**/*.js" |
| | | ).permitAll() |
| | | .antMatchers(securityProperties.getAnonymous()).anonymous() |
| | | .antMatchers(securityProperties.getPermitAll()).permitAll() |
| | | // 除上面外的所有请求全部需要鉴权认证 |
| | | .anyRequest().authenticated() |
| | | .and() |
| | | .headers().frameOptions().disable(); |
| | | httpSecurity.logout().logoutUrl(securityProperties.getLogoutUrl()).logoutSuccessHandler(logoutSuccessHandler); |
| | | // 添加JWT filter |
| | | httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class); |
| | |
| | | * 强散列哈希加密实现 |
| | | */ |
| | | @Bean |
| | | public BCryptPasswordEncoder bCryptPasswordEncoder() |
| | | { |
| | | public BCryptPasswordEncoder bCryptPasswordEncoder() { |
| | | return new BCryptPasswordEncoder(); |
| | | } |
| | | |
| | |
| | | * 身份认证接口 |
| | | */ |
| | | @Override |
| | | protected void configure(AuthenticationManagerBuilder auth) throws Exception |
| | | { |
| | | protected void configure(AuthenticationManagerBuilder auth) throws Exception { |
| | | auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder()); |
| | | } |
| | | } |