|
本文参考
【1】江南一点雨的SpringSecurity配置 【2】WebMvcConfiguer配置
问题需求
学习微人事项目中，我想在后端加入静态资源，我的静态资源就在static目录下，可怎么配置都返回需要权限认证，调试后发现，如下代码访问的所有路径，都会进到FilterInvocationSecurityMetadataSource中进行处理，松哥原话
getAttributes(Object o)方法返回null的话，意味着当前这个请求不需要任何角色就能访问，甚至不需要登录
 代码可修改如下（初始版本），后有通用解决方案
@Component
public class CusomFilterIncovationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
@Autowired
MenuService menuService;
// ant路径匹配的类
AntPathMatcher antPathMatcher = new AntPathMatcher();
@Override
public Collection getAttributes(Object o) throws IllegalArgumentException {
String requestUrl = ((FilterInvocation) o).getRequestUrl();
List menus = menuService.getAllMenusRole();
System.out.println("开始匹配路径");
for(Menu menu: menus){
if(antPathMatcher.match(menu.getUrl(), requestUrl)){
List roles = menu.getRoles();
String[] str = new String[roles.size()];
for(int i=0; i
//System.out.println(url);
//System.out.println(requestUrl);
if(antPathMatcher.match(url,requestUrl)){
return null;
}
}
// 标记而已
return SecurityConfig.createList("ROLE_LOGIN");
}
@Override
// 不用管
public Collection getAllConfigAttributes() {
return null;
}
@Override
public boolean supports(Class aClass) {
return true;
}
}
@Component
public class CustomUrlDecisionManager implements AccessDecisionManager {
@Override
/**
* @param:
* authentication 用户登陆信息
* collection Filter的返回值
*/
public void decide(Authentication authentication, Object o, Collection collection) throws AccessDeniedException, InsufficientAuthenticationException {
//System.out.println(collection.size());
//System.out.println(collection);
// 修改内容
if(collection == null || collection.isEmpty()){
return;
}
for(ConfigAttribute configAttribute: collection){
String needRole = configAttribute.getAttribute();
if("ROLE_LOGIN".equals(needRole)){
// 判断用户是否登陆
if(authentication instanceof AnonymousAuthenticationToken){
throw new AccessDeniedException("尚未登陆，请登陆");
}else{
return;
}
}
Collectionauthorities = authentication.getAuthorities();
// A,B两个角色有一个即可访问
for (GrantedAuthority authority:authorities) {
// 匹配到角色，立刻返回
if(authority.getAuthority().equals(needRole)){
return;
}
}
}
throw new AccessDeniedException("权限不足，请联系管理员");
}
@Override
public boolean supports(ConfigAttribute configAttribute) {
return true;
}
@Override
public boolean supports(Class aClass) {
return true;
}
}
public class StaticSource {
public static final String[] source = new String[]{"/img/**","/js/**","/css/**","/favicon.ico"};
}
通用解决
// 不起作用的配置
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/img/**");
}
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().antMatchers("/img/**").permitAll()
}
根据参考资料【2】的描述，在SpringBoot2.0中WebMvcConfigurerAdapter已被废弃，访问静态资源就会被HandlerInterceptor拦截，为了防止静态资源被拦截，我们需要实现自己的inteceptor的规则
通用解决方案:
// 创建自己的拦截器类，实现HandlerInterceptor 接口
public class MyInterceptor implements HandlerInterceptor {
}
@Configuration
public class MyWebMvcConfigurer implements WebMvcConfigurer {
@Override
public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(new MyInterceptor()).addPathPatterns("/**").excludePathPatterns("/swagger-ui.html","/js/**","/css/**","/img/**");
}
}
|