|
@@ -29,7 +29,6 @@ import org.springframework.security.authentication.dao.DaoAuthenticationProvider
|
|
|
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
|
|
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
|
|
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
|
|
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
|
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
|
|
-import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
|
|
|
|
|
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
|
|
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
|
|
|
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
|
|
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
|
|
|
import org.springframework.security.config.http.SessionCreationPolicy;
|
|
import org.springframework.security.config.http.SessionCreationPolicy;
|
|
@@ -118,6 +117,13 @@ public class SecurityConfig {
|
|
|
if (ArrayUtil.isNotEmpty(ignoreUrls)) {
|
|
if (ArrayUtil.isNotEmpty(ignoreUrls)) {
|
|
|
requestMatcherRegistry.requestMatchers(ignoreUrls).permitAll();
|
|
requestMatcherRegistry.requestMatchers(ignoreUrls).permitAll();
|
|
|
}
|
|
}
|
|
|
|
|
+
|
|
|
|
|
+ // 配置完全绕过安全检查的路径(原 unsecuredUrls)
|
|
|
|
|
+ String[] unsecuredUrls = securityProperties.getUnsecuredUrls();
|
|
|
|
|
+ if (ArrayUtil.isNotEmpty(unsecuredUrls)) {
|
|
|
|
|
+ requestMatcherRegistry.requestMatchers(unsecuredUrls).permitAll();
|
|
|
|
|
+ }
|
|
|
|
|
+
|
|
|
// 其他所有请求需登录后访问
|
|
// 其他所有请求需登录后访问
|
|
|
requestMatcherRegistry.anyRequest().authenticated();
|
|
requestMatcherRegistry.anyRequest().authenticated();
|
|
|
}
|
|
}
|
|
@@ -146,21 +152,6 @@ public class SecurityConfig {
|
|
|
.build();
|
|
.build();
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
- /**
|
|
|
|
|
- * 配置Web安全自定义器,以忽略特定请求路径的安全性检查。
|
|
|
|
|
- * <p>
|
|
|
|
|
- * 该配置用于指定哪些请求路径不经过Spring Security过滤器链。通常用于静态资源文件。
|
|
|
|
|
- */
|
|
|
|
|
- @Bean
|
|
|
|
|
- public WebSecurityCustomizer webSecurityCustomizer() {
|
|
|
|
|
- return (web) -> {
|
|
|
|
|
- String[] unsecuredUrls = securityProperties.getUnsecuredUrls();
|
|
|
|
|
- if (ArrayUtil.isNotEmpty(unsecuredUrls)) {
|
|
|
|
|
- web.ignoring().requestMatchers(unsecuredUrls);
|
|
|
|
|
- }
|
|
|
|
|
- };
|
|
|
|
|
- }
|
|
|
|
|
-
|
|
|
|
|
/**
|
|
/**
|
|
|
* 默认密码认证的 Provider
|
|
* 默认密码认证的 Provider
|
|
|
*/
|
|
*/
|