YiWuProject.git

			@@ -2,23 +2,40 @@


			import com.mes.common.filter.JwtAuthenticationTokenFilter;
			import com.mes.common.handler.*;
			import org.springframework.beans.factory.annotation.Autowired;
			import org.springframework.context.annotation.Bean;
			import org.springframework.context.annotation.Configuration;
			import org.springframework.security.authentication.AuthenticationManager;
			import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
			import org.springframework.security.config.annotation.web.builders.HttpSecurity;
			import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
			import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
			import org.springframework.security.config.http.SessionCreationPolicy;
			import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
			import org.springframework.security.crypto.password.PasswordEncoder;
			import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

			@Configuration
			//@EnableWebSecurity
			@EnableWebSecurity
			@EnableGlobalMethodSecurity(prePostEnabled = true)
			public class TokenWebSecurityConfig extends WebSecurityConfigurerAdapter {
			@Autowired
			private JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter;
			@Autowired
			LoginFailureHandler loginFailureHandler;

			@Autowired
			LoginSuccessHandler loginSuccessHandler;

			@Autowired
			JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;

			@Autowired
			JwtAccessDeniedHandler jwtAccessDeniedHandler;

			@Autowired
			JwtLogoutSuccessHandler jwtLogoutSuccessHandler;

			@Bean
			public PasswordEncoder passwordEncoder() {
			@@ -30,19 +47,42 @@
			*/
			@Override
			protected void configure(HttpSecurity http) throws Exception {
			http
			//关闭csrf
			.csrf().disable()
			//不通过Session获取SecurityContext
			.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

			http.cors().and().csrf().disable()

			// 登录配置
			.formLogin()
			.successHandler(loginSuccessHandler)
			.failureHandler(loginFailureHandler)

			.and()
			.logout()
			.logoutSuccessHandler(jwtLogoutSuccessHandler)

			// 禁用session
			.and()
			.sessionManagement()
			.sessionCreationPolicy(SessionCreationPolicy.STATELESS)

			// 配置拦截规则
			.and()
			.authorizeRequests()
			// 对于登录接口允许匿名访问
			.antMatchers("/userinfo/login").anonymous()
			.antMatchers("/hello").permitAll()
			// 除上面外的所有请求全部需要鉴权认证
			.anyRequest().permitAll();
			// http.addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
			.antMatchers("/sys/user/login").anonymous()
			.antMatchers("/swagger-ui.html").permitAll()
			.antMatchers("/webjars/**").permitAll()
			.antMatchers("/v2/**").permitAll()
			.antMatchers("/swagger-resources/**").permitAll()
			.anyRequest().authenticated()

			// 异常处理器
			.and()
			.exceptionHandling()
			.authenticationEntryPoint(jwtAuthenticationEntryPoint)
			.accessDeniedHandler(jwtAccessDeniedHandler)

			// 配置自定义的过滤器
			.and()
			.addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
			}

			@Bean