package com.nova.sankuai.security;
|
|
import com.nova.sankuai.infra.constants.Constants;
|
import io.swagger.annotations.ApiModel;
|
import org.springframework.boot.web.servlet.FilterRegistrationBean;
|
import org.springframework.context.annotation.Bean;
|
import org.springframework.context.annotation.Configuration;
|
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
import org.springframework.security.config.http.SessionCreationPolicy;
|
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
|
import org.springframework.security.crypto.password.PasswordEncoder;
|
import org.springframework.security.web.authentication.logout.LogoutFilter;
|
import org.springframework.web.cors.CorsConfiguration;
|
import org.springframework.web.cors.CorsConfigurationSource;
|
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
|
|
import javax.annotation.Resource;
|
import java.util.Collections;
|
|
/**
|
* @author weikangdi
|
*/
|
@Configuration
|
@EnableWebSecurity
|
@EnableGlobalMethodSecurity(prePostEnabled = true)
|
@ApiModel("项目security配置")
|
public class SecurityConfig extends WebSecurityConfigurerAdapter {
|
|
@Bean
|
public PasswordEncoder passwordEncoder() {
|
return new BCryptPasswordEncoder();
|
}
|
|
@Resource
|
private AuthenticationEntryPoint unauthorizedHandler;
|
|
@Override
|
protected void configure(HttpSecurity httpSecurity) throws Exception {
|
httpSecurity
|
.antMatcher("/api/**")
|
.addFilterBefore(authenticationFilterBean(), LogoutFilter.class)
|
.authorizeRequests()
|
// 配置不需要登录即可访问的路径
|
.antMatchers(Constants.PUBLIC_URL).permitAll()
|
.antMatchers(Constants.PUBLIC_URL_V2).permitAll()
|
.antMatchers("/api/v2/protocolInfo/**").permitAll()
|
.anyRequest().authenticated()
|
.and()
|
.exceptionHandling().authenticationEntryPoint(unauthorizedHandler)
|
.and()
|
.cors()
|
.and()
|
.httpBasic().disable()
|
.csrf().disable()
|
.formLogin().disable()
|
.logout().disable();
|
httpSecurity.headers().cacheControl();
|
httpSecurity.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
|
}
|
|
@Bean
|
public CorsConfigurationSource corsConfigurationSource() {
|
CorsConfiguration corsConfiguration = new CorsConfiguration();
|
corsConfiguration.setAllowedOriginPatterns(Collections.singletonList("*"));
|
corsConfiguration.addAllowedHeader(CorsConfiguration.ALL);
|
corsConfiguration.addAllowedMethod(CorsConfiguration.ALL);
|
corsConfiguration.setAllowCredentials(true);
|
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
|
source.registerCorsConfiguration("/**", corsConfiguration);
|
return source;
|
}
|
|
@Bean
|
public FilterRegistrationBean<AuthenticationFilter> registerAuthenticationFilter() {
|
FilterRegistrationBean<AuthenticationFilter> bean = new FilterRegistrationBean<>();
|
bean.setFilter(authenticationFilterBean());
|
bean.setEnabled(false);
|
return bean;
|
}
|
|
@Bean
|
public AuthenticationFilter authenticationFilterBean() {
|
return new AuthenticationFilter();
|
}
|
|
}
|
