重构客户档案

huminmin

10 天以前 c383c8ca7053005ffa3ee58efd89956fbf52c9ea

 src/main/java/com/ruoyi/framework/config/SecurityConfig.java

@@ -1,64 +1,76 @@
package com.ruoyi.framework.config;



import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Bean;

import org.springframework.http.HttpMethod;

import org.springframework.security.authentication.AuthenticationManager;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.config.http.SessionCreationPolicy;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import com.ruoyi.framework.config.properties.PermitAllUrlProperties;

import com.ruoyi.framework.security.filter.JwtAuthenticationTokenFilter;

import com.ruoyi.framework.security.handle.AuthenticationEntryPointImpl;

import com.ruoyi.framework.security.handle.LogoutSuccessHandlerImpl;

import lombok.RequiredArgsConstructor;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.http.HttpMethod;

import org.springframework.security.authentication.AuthenticationManager;

import org.springframework.security.authentication.ProviderManager;

import org.springframework.security.authentication.dao.DaoAuthenticationProvider;

import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.http.SessionCreationPolicy;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.web.SecurityFilterChain;

import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import org.springframework.security.web.authentication.logout.LogoutFilter;

import org.springframework.web.filter.CorsFilter;



/**

 * spring security配置

 * 

 * @author ruoyi

 */

@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)

public class SecurityConfig extends WebSecurityConfigurerAdapter

@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)

@Configuration

@RequiredArgsConstructor

public class SecurityConfig

{

    /**

     * 自定义用户认证逻辑

     */

    @Autowired

    private UserDetailsService userDetailsService;

    private final UserDetailsService userDetailsService;

    

    /**

     * 认证失败处理类

     */

    @Autowired

    private AuthenticationEntryPointImpl unauthorizedHandler;

    private final AuthenticationEntryPointImpl unauthorizedHandler;



    /**

     * 退出处理类

     */

    @Autowired

    private LogoutSuccessHandlerImpl logoutSuccessHandler;

    private final LogoutSuccessHandlerImpl logoutSuccessHandler;



    /**

     * token认证过滤器

     */

    @Autowired

    private JwtAuthenticationTokenFilter authenticationTokenFilter;

    private final JwtAuthenticationTokenFilter authenticationTokenFilter;

    

    /**

     * 解决 无法直接注入 AuthenticationManager

     *

     * @return

     * @throws Exception

     * 跨域过滤器

     */

    private final CorsFilter corsFilter;



    /**

     * 允许匿名访问的地址

     */

    private final PermitAllUrlProperties permitAllUrl;



    /**

     * 身份验证实现

     */

    @Bean

    @Override

    public AuthenticationManager authenticationManagerBean() throws Exception

    public AuthenticationManager authenticationManager()

    {

        return super.authenticationManagerBean();

        DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();

        daoAuthenticationProvider.setUserDetailsService(userDetailsService);

        daoAuthenticationProvider.setPasswordEncoder(bCryptPasswordEncoder());

        return new ProviderManager(daoAuthenticationProvider);

    }



    /**

@@ -76,45 +88,76 @@
     * rememberMe          |   允许通过remember-me登录的用户访问

     * authenticated       |   用户登录后可访问

     */

    @Override

    protected void configure(HttpSecurity httpSecurity) throws Exception

    @Bean

    protected SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception

    {

        httpSecurity

                // CRSF禁用，因为不使用session

                .csrf().disable()

                // 认证失败处理类

                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()

                // 基于token，所以不需要session

                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()

                // 过滤请求

                .authorizeRequests()

                // 对于登录login 验证码captchaImage 允许匿名访问

                .antMatchers("/login", "/captchaImage").anonymous()

                .antMatchers(

                        HttpMethod.GET,

                        "/*.html",

                        "/**/*.html",

                        "/**/*.css",

                        "/**/*.js"

                ).permitAll()

                .antMatchers("/profile/**").anonymous()

                .antMatchers("/common/download**").anonymous()

                .antMatchers("/common/download/resource**").anonymous()

                .antMatchers("/swagger-ui.html").anonymous()

                .antMatchers("/swagger-resources/**").anonymous()

                .antMatchers("/webjars/**").anonymous()

                .antMatchers("/*/api-docs").anonymous()

                .antMatchers("/druid/**").anonymous()

                // 除上面外的所有请求全部需要鉴权认证

                .anyRequest().authenticated()

                .and()

                .headers().frameOptions().disable();

        httpSecurity.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler);

        // 添加JWT filter

        httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);

        return httpSecurity

            // CSRF禁用，因为不使用session

            .csrf(csrf -> csrf.disable())

            // 禁用HTTP响应标头

            .headers((headersCustomizer) -> {

                headersCustomizer.cacheControl(cache -> cache.disable()).frameOptions(options -> options.sameOrigin());

            })

            // 认证失败处理类

            .exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler))

            // 基于token，所以不需要session

            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))

            // 注解标记允许匿名访问的url

                // todo ai生成， 后期若有问题请自行优化

                .authorizeHttpRequests(requests -> {



                    // 1. 放行动态配置的 URL

                    permitAllUrl.getUrls().forEach(url ->

                            requests.requestMatchers(url).permitAll()

                    );



                    // 2. 登录 / 注册 / 验证码 / 等放行

                    requests.requestMatchers(

                            "/login",

                            "/register",

                            "/captchaImage",

                            "/loginCheck",

                            "/userLoginFacotryList/**",

                            "/loginCheckFactory"

                    ).permitAll();



                    // 3. 静态资源放行

                    requests.requestMatchers(HttpMethod.GET,

                            "/",

                            "/*.html",

                            "/**/*.html",

                            "/**/*.css",

                            "/**/*.js",

                            "/profile/**",

                            "/javaWork/**",

                            "/**/*.pdf"

                    ).permitAll();



                    // 4. swagger / druid 放行

                    requests.requestMatchers(
                            "/swagger-ui.html",
                            "/doc.html",
                            "/swagger-ui/**",
                            "/swagger-resources/**",
                            "/v3/api-docs/**",
                            "/webjars/**",
                            "/*/api-docs",
                            "/druid/**"
                    ).permitAll();



                    // 5. 其他全部拦截

                    requests.anyRequest().authenticated();

                })

            // 添加Logout filter

            .logout(logout -> logout.logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler))

            // 添加JWT filter

            .addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)

            // 添加CORS filter

            .addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class)

            .addFilterBefore(corsFilter, LogoutFilter.class)

            .build();

    }



    
    /**

     * 强散列哈希加密实现

     */

@@ -122,14 +165,5 @@
    public BCryptPasswordEncoder bCryptPasswordEncoder()

    {

        return new BCryptPasswordEncoder();

    }



    /**

     * 身份认证接口

     */

    @Override

    protected void configure(AuthenticationManagerBuilder auth) throws Exception

    {

        auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());

    }

}