FatttSnake/Pinnacle-OA
1
0
Fork 0
mirror of https://github.com/FatttSnake/Pinnacle-OA.git synced 2026-04-05 15:01:23 +08:00
Code Packages Releases Activity

Updated SecurityConfig

Browse Source
This commit is contained in:
Fat Snake
2023-06-11 18:26:03 +08:00
parent 80190dc6bc
commit c80e13dc00
1 changed files with 19 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
Pinnacle/src/main/java/com/cfive/pinnacle/config/SecurityConfig.java
View File

@@ -2,14 +2,14 @@ package com.cfive.pinnacle.config;
import com.cfive.pinnacle.filter.JwtAuthenticationTokenFilter; import com.cfive.pinnacle.filter.JwtAuthenticationTokenFilter;
import com.cfive.pinnacle.handler.CustomAuthenticationEntryPointHandler; import com.cfive.pinnacle.handler.CustomAuthenticationEntryPointHandler;
import com.cfive.pinnacle.service.permission.impl.UserDetailsServiceImpl;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder;
@@ -24,15 +24,9 @@ import java.util.List;
@Configuration @Configuration
@EnableMethodSecurity() @EnableMethodSecurity()
public class SecurityConfig { public class SecurityConfig {
private UserDetailsServiceImpl userDetailsService;
private JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter; private JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter;
private CustomAuthenticationEntryPointHandler authenticationEntryPointHandler; private CustomAuthenticationEntryPointHandler authenticationEntryPointHandler;
@Autowired
public void setUserDetailsService(UserDetailsServiceImpl userDetailsService) {
this.userDetailsService = userDetailsService;
}
@Autowired @Autowired
public void setJwtAuthenticationTokenFilter(JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter) { public void setJwtAuthenticationTokenFilter(JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter) {
this.jwtAuthenticationTokenFilter = jwtAuthenticationTokenFilter; this.jwtAuthenticationTokenFilter = jwtAuthenticationTokenFilter;
@@ -49,23 +43,19 @@ public class SecurityConfig {
} }
@Bean @Bean
public AuthenticationManager authenticationManager(HttpSecurity httpSecurity, PasswordEncoder passwordEncoder) throws Exception { public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
return httpSecurity.getSharedObject(AuthenticationManagerBuilder.class) return authenticationConfiguration.getAuthenticationManager();
.userDetailsService(userDetailsService)
.passwordEncoder(passwordEncoder)
.and()
.build();
} }
@Bean @Bean
public CorsConfigurationSource corsConfigurationSource(){ public CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration corsConfiguration = new CorsConfiguration(); CorsConfiguration corsConfiguration = new CorsConfiguration();
corsConfiguration.setAllowedMethods(List.of("*")); corsConfiguration.setAllowedMethods(List.of("*"));
corsConfiguration.setAllowedHeaders(List.of("*")); corsConfiguration.setAllowedHeaders(List.of("*"));
corsConfiguration.setMaxAge(3600L); corsConfiguration.setMaxAge(3600L);
corsConfiguration.setAllowedOrigins(List.of("*")); corsConfiguration.setAllowedOrigins(List.of("*"));
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**",corsConfiguration); source.registerCorsConfiguration("/**", corsConfiguration);
return source; return source;
} }
@@ -73,34 +63,26 @@ public class SecurityConfig {
public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception { public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
return httpSecurity return httpSecurity
// Disable CSRF // Disable CSRF
.csrf() .csrf(AbstractHttpConfigurer::disable)
.disable()
// Do not get SecurityContent by Session // Do not get SecurityContent by Session
.sessionManagement() .sessionManagement(sessionManagement -> sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
// Allow anonymous access .authorizeHttpRequests(authorizeHttpRequests ->
.authorizeHttpRequests() authorizeHttpRequests
.requestMatchers("/login", "/error/thrown", "/doc.html", "/swagger-ui/**", "/webjars/**", "/v3/**", "/swagger-ui.html") // Allow anonymous access
.anonymous() .requestMatchers("/login", "/error/thrown", "/doc.html", "/swagger-ui/**", "/webjars/**", "/v3/**", "/swagger-ui.html")
.anonymous()
// Authentication required
.anyRequest()
.authenticated())
// Authentication required
.anyRequest()
.authenticated()
.and()
.logout() .logout(AbstractHttpConfigurer::disable)
.disable()
.exceptionHandling() .exceptionHandling(exceptionHandling -> exceptionHandling.authenticationEntryPoint(authenticationEntryPointHandler))
.authenticationEntryPoint(authenticationEntryPointHandler)
.and()
.cors() .cors(cors -> cors.configurationSource(corsConfigurationSource()))
.configurationSource(corsConfigurationSource())
.and()
.addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class) .addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
.build(); .build();