|
@@ -38,7 +38,7 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
|
|
|
@Autowired
|
|
@Autowired
|
|
|
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
|
|
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
|
|
|
auth.userDetailsService(jwtUserDetailsService)
|
|
auth.userDetailsService(jwtUserDetailsService)
|
|
|
- .passwordEncoder(passwordEncoderBean());
|
|
|
|
|
|
|
+ .passwordEncoder(passwordEncoderBean());
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
@Bean
|
|
@Bean
|
|
@@ -56,29 +56,32 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
|
|
|
protected void configure(HttpSecurity httpSecurity) throws Exception {
|
|
protected void configure(HttpSecurity httpSecurity) throws Exception {
|
|
|
// We don't need CSRF for this example
|
|
// We don't need CSRF for this example
|
|
|
httpSecurity.csrf().disable()
|
|
httpSecurity.csrf().disable()
|
|
|
- .cors().and()
|
|
|
|
|
- // dont authenticate this particular request
|
|
|
|
|
- .authorizeRequests()
|
|
|
|
|
- //swagger-ui放行路径
|
|
|
|
|
- .antMatchers("/v2/api-docs", "/swagger-ui.html", "/swagger-resources/**", "/webjars/**").permitAll()
|
|
|
|
|
- .antMatchers("/user/register").permitAll()
|
|
|
|
|
- .antMatchers("/upload/**").permitAll()
|
|
|
|
|
- .antMatchers("/static/**").permitAll()
|
|
|
|
|
- .antMatchers("/auth/**").permitAll()
|
|
|
|
|
- .antMatchers("/admin/**").permitAll()
|
|
|
|
|
- .antMatchers("/orderNotify/**").permitAll()
|
|
|
|
|
- .antMatchers("/order/logistic").permitAll()
|
|
|
|
|
- .antMatchers("/systemVariable/all").permitAll()
|
|
|
|
|
- .antMatchers("/**/excel").permitAll()
|
|
|
|
|
- .antMatchers("/wx/**").permitAll()
|
|
|
|
|
- .antMatchers("/sms/sendVerify").permitAll()
|
|
|
|
|
- // all other requests need to be authenticated
|
|
|
|
|
- .anyRequest().authenticated().and()
|
|
|
|
|
- // make sure we use stateless session; session won't be used to
|
|
|
|
|
- // store user's state.
|
|
|
|
|
- .exceptionHandling().authenticationEntryPoint(unauthorizedHandler)
|
|
|
|
|
- .and().sessionManagement()
|
|
|
|
|
- .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
|
|
|
|
|
|
|
+ .cors().and()
|
|
|
|
|
+ // dont authenticate this particular request
|
|
|
|
|
+ .authorizeRequests()
|
|
|
|
|
+ //swagger-ui放行路径
|
|
|
|
|
+ .antMatchers("/v2/api-docs", "/swagger-ui.html", "/swagger-resources/**", "/webjars/**").permitAll()
|
|
|
|
|
+ .antMatchers("/user/register").permitAll()
|
|
|
|
|
+ .antMatchers("/upload/**").permitAll()
|
|
|
|
|
+ .antMatchers("/static/**").permitAll()
|
|
|
|
|
+ .antMatchers("/auth/**").permitAll()
|
|
|
|
|
+ .antMatchers("/admin/**").permitAll()
|
|
|
|
|
+ .antMatchers("/systemVariable/all").permitAll()
|
|
|
|
|
+ .antMatchers("/**/excel").permitAll()
|
|
|
|
|
+ .antMatchers("/wx/**").permitAll()
|
|
|
|
|
+ .antMatchers("/sms/sendVerify").permitAll()
|
|
|
|
|
+ .antMatchers("/error").permitAll()
|
|
|
|
|
+ .antMatchers("/401").permitAll()
|
|
|
|
|
+ .antMatchers("/404").permitAll()
|
|
|
|
|
+ .antMatchers("/500").permitAll()
|
|
|
|
|
+ .antMatchers("/test500").permitAll()
|
|
|
|
|
+ // all other requests need to be authenticated
|
|
|
|
|
+ .anyRequest().authenticated().and()
|
|
|
|
|
+ // make sure we use stateless session; session won't be used to
|
|
|
|
|
+ // store user's state.
|
|
|
|
|
+ .exceptionHandling().authenticationEntryPoint(unauthorizedHandler)
|
|
|
|
|
+ .and().sessionManagement()
|
|
|
|
|
+ .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
|
|
|
// Add a filter to validate the tokens with every request
|
|
// Add a filter to validate the tokens with every request
|
|
|
httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
|
|
httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
|
|
|
}
|
|
}
|
|
@@ -87,19 +90,19 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
|
|
|
public void configure(WebSecurity web) throws Exception {
|
|
public void configure(WebSecurity web) throws Exception {
|
|
|
// AuthenticationTokenFilter will ignore the below paths
|
|
// AuthenticationTokenFilter will ignore the below paths
|
|
|
web.ignoring()
|
|
web.ignoring()
|
|
|
- .antMatchers("/auth/**")
|
|
|
|
|
|
|
+ .antMatchers("/auth/**")
|
|
|
|
|
|
|
|
- // allow anonymous resource requests
|
|
|
|
|
- .and()
|
|
|
|
|
- .ignoring()
|
|
|
|
|
- .antMatchers(
|
|
|
|
|
- HttpMethod.GET,
|
|
|
|
|
- "/",
|
|
|
|
|
- "/*.html",
|
|
|
|
|
- "/**/favicon.ico",
|
|
|
|
|
- "/**/*.html",
|
|
|
|
|
- "/**/*.css",
|
|
|
|
|
- "/**/*.js"
|
|
|
|
|
- );
|
|
|
|
|
|
|
+ // allow anonymous resource requests
|
|
|
|
|
+ .and()
|
|
|
|
|
+ .ignoring()
|
|
|
|
|
+ .antMatchers(
|
|
|
|
|
+ HttpMethod.GET,
|
|
|
|
|
+ "/",
|
|
|
|
|
+ "/*.html",
|
|
|
|
|
+ "/**/favicon.ico",
|
|
|
|
|
+ "/**/*.html",
|
|
|
|
|
+ "/**/*.css",
|
|
|
|
|
+ "/**/*.js"
|
|
|
|
|
+ );
|
|
|
}
|
|
}
|
|
|
}
|
|
}
|