131 lines
5.5 KiB
Java
131 lines
5.5 KiB
Java
package com.macro.mall.config;
|
||
|
||
import com.macro.mall.bo.AdminUserDetails;
|
||
import com.macro.mall.component.JwtAuthenticationTokenFilter;
|
||
import com.macro.mall.component.RestAuthenticationEntryPoint;
|
||
import com.macro.mall.component.RestfulAccessDeniedHandler;
|
||
import com.macro.mall.model.UmsAdmin;
|
||
import com.macro.mall.service.UmsAdminService;
|
||
import org.springframework.beans.factory.annotation.Autowired;
|
||
import org.springframework.boot.web.servlet.FilterRegistrationBean;
|
||
import org.springframework.context.annotation.Bean;
|
||
import org.springframework.context.annotation.Configuration;
|
||
import org.springframework.http.HttpMethod;
|
||
import org.springframework.security.authentication.encoding.Md5PasswordEncoder;
|
||
import org.springframework.security.authentication.encoding.PasswordEncoder;
|
||
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
|
||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
||
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
||
import org.springframework.security.config.http.SessionCreationPolicy;
|
||
import org.springframework.security.core.userdetails.UserDetails;
|
||
import org.springframework.security.core.userdetails.UserDetailsService;
|
||
import org.springframework.security.core.userdetails.UsernameNotFoundException;
|
||
import org.springframework.security.web.access.AccessDeniedHandler;
|
||
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
|
||
import org.springframework.web.cors.CorsConfiguration;
|
||
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
|
||
import org.springframework.web.filter.CorsFilter;
|
||
|
||
|
||
/**
|
||
* SpringSecurity的配置
|
||
* Created by macro on 2018/4/26.
|
||
*/
|
||
@Configuration
|
||
@EnableWebSecurity
|
||
public class SecurityConfig extends WebSecurityConfigurerAdapter {
|
||
@Autowired
|
||
private UmsAdminService adminService;
|
||
@Autowired
|
||
private RestfulAccessDeniedHandler restfulAccessDeniedHandler;
|
||
@Autowired
|
||
private RestAuthenticationEntryPoint restAuthenticationEntryPoint;
|
||
|
||
@Override
|
||
protected void configure(HttpSecurity httpSecurity) throws Exception {
|
||
httpSecurity.csrf()// 由于使用的是JWT，我们这里不需要csrf
|
||
.disable()
|
||
.sessionManagement()// 基于token，所以不需要session
|
||
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
|
||
.and()
|
||
.authorizeRequests()
|
||
.antMatchers(HttpMethod.GET, // 允许对于网站静态资源的无授权访问
|
||
"/",
|
||
"/*.html",
|
||
"/favicon.ico",
|
||
"/**/*.html",
|
||
"/**/*.css",
|
||
"/**/*.js",
|
||
"/swagger-resources/**",
|
||
"/v2/api-docs/**"
|
||
)
|
||
.permitAll()
|
||
.antMatchers("/admin/login", "/admin/register")// 对登录注册要允许匿名访问
|
||
.permitAll()
|
||
.antMatchers(HttpMethod.OPTIONS)//跨域请求会先进行一次options请求
|
||
.permitAll()
|
||
// .antMatchers("/**")//测试时全部运行访问
|
||
// .permitAll()
|
||
.anyRequest()// 除上面外的所有请求全部需要鉴权认证
|
||
.authenticated();
|
||
// 禁用缓存
|
||
httpSecurity.headers().cacheControl();
|
||
// 添加JWT filter
|
||
httpSecurity.addFilterBefore(jwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class);
|
||
//添加自定义未授权和未登录结果返回
|
||
httpSecurity.exceptionHandling()
|
||
.accessDeniedHandler(restfulAccessDeniedHandler)
|
||
.authenticationEntryPoint(restAuthenticationEntryPoint);
|
||
}
|
||
|
||
@Override
|
||
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
|
||
auth.userDetailsService(userDetailsService())
|
||
.passwordEncoder(passwordEncoder());
|
||
}
|
||
|
||
@Bean
|
||
public PasswordEncoder passwordEncoder() {
|
||
return new Md5PasswordEncoder();
|
||
}
|
||
|
||
@Bean
|
||
public UserDetailsService userDetailsService() {
|
||
//获取登录用户信息
|
||
return new UserDetailsService() {
|
||
@Override
|
||
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
|
||
UmsAdmin admin = adminService.getAdminByUsername(username);
|
||
if (admin != null) {
|
||
return new AdminUserDetails(admin);
|
||
}
|
||
throw new UsernameNotFoundException("用户名或密码错误");
|
||
}
|
||
};
|
||
}
|
||
|
||
@Bean
|
||
public JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter(){
|
||
return new JwtAuthenticationTokenFilter();
|
||
}
|
||
|
||
/**
|
||
* 允许跨域调用的过滤器
|
||
*/
|
||
@Bean
|
||
public FilterRegistrationBean corsFilter() {
|
||
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
|
||
CorsConfiguration config = new CorsConfiguration();
|
||
config.addAllowedOrigin("*");
|
||
config.setAllowCredentials(true);
|
||
config.addAllowedHeader("*");
|
||
config.addAllowedMethod("*");
|
||
source.registerCorsConfiguration("/**", config);
|
||
|
||
FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
|
||
bean.setOrder(0);
|
||
return bean;
|
||
}
|
||
}
|