springSecurity配置（整合jwt）

springSecurity配置（整合jwt）"/>

springSecurity配置（整合jwt）

springsecurtty config

/**

• @author shuang.kou Saving

• @version 1.1

• @date 2020.11.28 14:16

• @description Spring Security配置类
  **/
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

  private final StringRedisTemplate stringRedisTemplate;

  public SecurityConfiguration(StringRedisTemplate stringRedisTemplate) {
  this.stringRedisTemplate = stringRedisTemplate;
  }

  /**

  • 密码编码器
    */
    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder() {
    return new BCryptPasswordEncoder();
    }

  @Override
  protected void configure(HttpSecurity http) throws Exception {
  http.cors(withDefaults())
  // 禁用 CSRF
  .csrf().disable()
  .authorizeRequests()
  // 指定的接口直接放行
  // swagger
  .antMatchers(SecurityConstants.SWAGGER_WHITELIST).permitAll()
  .antMatchers(HttpMethod.POST, SecurityConstants.SYSTEM_WHITELIST).permitAll()
  // 其他的接口都需要认证后才能请求
  .anyRequest().authenticated()
  .and()
  //添加自定义Filter
  .addFilter(new JwtAuthenticationFilter(authenticationManager(), stringRedisTemplate))
  //添加自定义Filter
  .addFilter(new JwtAuthorizationFilter(authenticationManager(), stringRedisTemplate))
  // 不需要session（不创建会话）
  .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
  // 授权异常处理
  .exceptionHandling().authenticationEntryPoint(new JwtAuthenticationEntryPoint())
  .accessDeniedHandler(new JwtAccessDeniedHandler());
  // 防止H2 web 页面的Frame 被拦截
  http.headers().frameOptions().disable();
  }

  /**

  • Cors配置优化
    /
    @Bean
    CorsConfigurationSource corsConfigurationSource() {
    org.springframework.web.cors.CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(singletonList(""));
    configuration.setAllowedHeaders(singletonList(""));
    configuration.setAllowedMethods(Arrays.asList(“GET”, “POST”, “DELETE”, “PUT”, “OPTIONS”));
    configuration.setExposedHeaders(singletonList(SecurityConstants.TOKEN_HEADER));
    configuration.setAllowCredentials(false);
    configuration.setMaxAge(3600L);
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/", configuration);
    return source;
    }

}