义乌项目
blame | 历史 | 补丁 | 提交 | 提交对比 | ignore whitespace
zhoushihao
2024-04-28 1b4d9b2dd4ed07758241d1143890b3a86b3c0641 
 hangzhoumesParent/common/springsecurity/src/main/java/com/mes/common/config/TokenWebSecurityConfig.java


@@ -2,6 +2,7 @@






import com.mes.common.filter.JwtAuthenticationTokenFilter;


import com.mes.common.handler.*;


import org.springframework.beans.factory.annotation.Autowired;


import org.springframework.context.annotation.Bean;


import org.springframework.context.annotation.Configuration;


@@ -13,8 +14,6 @@


import org.springframework.security.config.http.SessionCreationPolicy;


import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;


import org.springframework.security.crypto.password.PasswordEncoder;


import org.springframework.security.web.AuthenticationEntryPoint;


import org.springframework.security.web.access.AccessDeniedHandler;


import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;




@Configuration


@@ -23,12 +22,20 @@


public class TokenWebSecurityConfig extends WebSecurityConfigurerAdapter {


    @Autowired


    private JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter;


    @Autowired


    LoginFailureHandler loginFailureHandler;




    @Autowired


    private AuthenticationEntryPoint authenticationEntryPoint;


    LoginSuccessHandler loginSuccessHandler;




    @Autowired


    private AccessDeniedHandler accessDeniedHandler;


    JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;




    @Autowired


    JwtAccessDeniedHandler jwtAccessDeniedHandler;




    @Autowired


    JwtLogoutSuccessHandler jwtLogoutSuccessHandler;




    @Bean


    public PasswordEncoder passwordEncoder() {


@@ -40,25 +47,42 @@


     */


    @Override


    protected void configure(HttpSecurity http) throws Exception {


        http


                //关闭csrf


                .csrf().disable()


                //不通过Session获取SecurityContext


                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)




        http.cors().and().csrf().disable()




                // 登录配置


                .formLogin()


                .successHandler(loginSuccessHandler)


                .failureHandler(loginFailureHandler)




                .and()


                .logout()


                .logoutSuccessHandler(jwtLogoutSuccessHandler)




                // 禁用session


                .and()


                .sessionManagement()


                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)




                // 配置拦截规则


                .and()


                .authorizeRequests()


                // 对于登录接口 允许匿名访问


                .antMatchers("/userinfo/login").anonymous()


                // 除上面外的所有请求全部需要鉴权认证


                .anyRequest().authenticated();


        http.addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);


                .antMatchers("/sys/user/login").anonymous()


                .antMatchers("/swagger-ui.html").permitAll()


                .antMatchers("/webjars/**").permitAll()


                .antMatchers("/v2/**").permitAll()


                .antMatchers("/swagger-resources/**").permitAll()


                .anyRequest().authenticated()




        //配置异常处理器


        http.exceptionHandling()


                .authenticationEntryPoint(authenticationEntryPoint)


                .accessDeniedHandler(accessDeniedHandler);


        //允许跨域


        http.cors();


                // 异常处理器


                .and()


                .exceptionHandling()


                .authenticationEntryPoint(jwtAuthenticationEntryPoint)


                .accessDeniedHandler(jwtAccessDeniedHandler)




                // 配置自定义的过滤器


                .and()


                .addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);


    }




    @Bean