package com.gkhy.safePlatform.config.security; import com.gkhy.safePlatform.account.entity.user.UserInfo; import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.WebSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import javax.annotation.Resource; @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(securedEnabled = true,prePostEnabled = true) public class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Resource private TokenAuthenticationFilter tokenAuthenticationFilter; @Override protected void configure(HttpSecurity http) throws Exception { // 关闭跨域攻击 http.csrf().disable(); // 关闭session http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS); // 登录json放行 | websocket | 普通人员密码自行修改 http.authorizeRequests().antMatchers("/auth/login", "/ws/test/**", "/account/pwd/forget").permitAll(); // 关闭 http.headers().cacheControl(); // jwt过滤器 http.addFilterBefore(tokenAuthenticationFilter, UsernamePasswordAuthenticationFilter.class); // 请求认证访问 http.authorizeRequests().anyRequest().authenticated(); // 允许跨域访问 http.cors(); } /** * @Description: 自定义查询逻辑 & 密码处理器 */ @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userDetailsService()); } /** * @Description: 自定义查询逻辑 */ @Bean @Qualifier("myUserDetailService") protected UserDetailsService userDetailsService(){ return (username)-> new UserInfo(); } @Override public void configure(WebSecurity web) { web.ignoring().mvcMatchers(); } }