From 098d3347a0df808908aab8c554cd7c4febc5e6d9 Mon Sep 17 00:00:00 2001
From: 疯狂的狮子Li <15040126243@163.com>
Date: 星期一, 26 八月 2024 11:43:59 +0800
Subject: [PATCH] !577 发布 5.2.2 正式版 安全性提升 Merge pull request !577 from 疯狂的狮子Li/dev
---
ruoyi-extend/ruoyi-monitor-admin/src/main/java/org/dromara/monitor/admin/config/SecurityConfig.java | 36 +++++++++++++++++++-----------------
1 files changed, 19 insertions(+), 17 deletions(-)
diff --git a/ruoyi-extend/ruoyi-monitor-admin/src/main/java/org/dromara/monitor/admin/config/SecurityConfig.java b/ruoyi-extend/ruoyi-monitor-admin/src/main/java/org/dromara/monitor/admin/config/SecurityConfig.java
index 4bd37ff..3458cc9 100644
--- a/ruoyi-extend/ruoyi-monitor-admin/src/main/java/org/dromara/monitor/admin/config/SecurityConfig.java
+++ b/ruoyi-extend/ruoyi-monitor-admin/src/main/java/org/dromara/monitor/admin/config/SecurityConfig.java
@@ -3,10 +3,14 @@
import de.codecentric.boot.admin.server.config.AdminServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
/**
* admin 鐩戞帶 瀹夊叏閰嶇疆
@@ -30,23 +34,21 @@
successHandler.setDefaultTargetUrl(adminContextPath + "/");
return httpSecurity
- .headers().frameOptions().disable()
- .and().authorizeHttpRequests()
- .requestMatchers(adminContextPath + "/assets/**"
- , adminContextPath + "/login"
- , "/actuator"
- , "/actuator/**"
- ).permitAll()
- .anyRequest().authenticated()
- .and()
- .formLogin().loginPage(adminContextPath + "/login")
- .successHandler(successHandler).and()
- .logout().logoutUrl(adminContextPath + "/logout")
- .and()
- .httpBasic().and()
- .csrf()
- .disable()
- .build();
+ .headers((header) ->
+ header.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable))
+ .authorizeHttpRequests((authorize) ->
+ authorize.requestMatchers(
+ new AntPathRequestMatcher(adminContextPath + "/assets/**"),
+ new AntPathRequestMatcher(adminContextPath + "/login")
+ ).permitAll()
+ .anyRequest().authenticated())
+ .formLogin((formLogin) ->
+ formLogin.loginPage(adminContextPath + "/login").successHandler(successHandler))
+ .logout((logout) ->
+ logout.logoutUrl(adminContextPath + "/logout"))
+ .httpBasic(Customizer.withDefaults())
+ .csrf(AbstractHttpConfigurer::disable)
+ .build();
}
}
--
Gitblit v1.9.3