From 340a30e278d10a43aa5b81b55af7fe2ebfe7d300 Mon Sep 17 00:00:00 2001 From: yizzuide Date: Tue, 7 Jul 2020 20:37:35 +0800 Subject: [PATCH] fix(crust): Fix the problem that the request failed after login. --- Milkomeda/pom.xml | 4 +- .../crust/CrustConfigurerAdapter.java | 37 +++++++++---------- MilkomedaDemo/pom.xml | 2 +- .../demo/crust/controller/CaseController.java | 9 +++++ 4 files changed, 29 insertions(+), 23 deletions(-) diff --git a/Milkomeda/pom.xml b/Milkomeda/pom.xml index 2be3cd57..f8eb26f9 100755 --- a/Milkomeda/pom.xml +++ b/Milkomeda/pom.xml @@ -11,7 +11,7 @@ 1.8 - 3.10.0-SNAPSHOT + 3.10.1-SNAPSHOT 2.2.4 Hoxton.RELEASE 2.1.1 @@ -67,7 +67,7 @@ sonatype-oss-release - 3.10.0 + 3.10.1 diff --git a/Milkomeda/src/main/java/com/github/yizzuide/milkomeda/crust/CrustConfigurerAdapter.java b/Milkomeda/src/main/java/com/github/yizzuide/milkomeda/crust/CrustConfigurerAdapter.java index 3d8f6e24..18f6a233 100644 --- a/Milkomeda/src/main/java/com/github/yizzuide/milkomeda/crust/CrustConfigurerAdapter.java +++ b/Milkomeda/src/main/java/com/github/yizzuide/milkomeda/crust/CrustConfigurerAdapter.java @@ -2,7 +2,6 @@ import com.github.yizzuide.milkomeda.universe.context.ApplicationContextHolder; import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.context.ApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.http.HttpMethod; import org.springframework.http.HttpStatus; @@ -14,12 +13,12 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.WebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.web.authentication.AuthenticationFailureHandler; import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint; import org.springframework.security.web.authentication.logout.HttpStatusReturningLogoutSuccessHandler; -import org.springframework.security.web.csrf.CookieCsrfTokenRepository; import org.springframework.util.CollectionUtils; import org.springframework.web.cors.CorsConfiguration; import org.springframework.web.cors.CorsConfigurationSource; @@ -37,7 +36,7 @@ * * @author yizzuide * @since 1.14.0 - * @version 3.10.0 + * @version 3.10.1 * @see org.springframework.security.web.session.SessionManagementFilter * @see org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer * Create at 2019/11/11 18:25 @@ -51,7 +50,7 @@ public class CrustConfigurerAdapter extends WebSecurityConfigurerAdapter { private BCryptPasswordEncoder passwordEncoder; @Autowired - private ApplicationContext applicationContext; + private ApplicationContextHolder applicationContextHolder; @Override public void configure(AuthenticationManagerBuilder auth) { @@ -64,15 +63,14 @@ public void configure(AuthenticationManagerBuilder auth) { @Override protected void configure(HttpSecurity http) throws Exception { List allowURLs = new ArrayList<>(props.getPermitURLs()); - // 登录、登出 + // 登录 allowURLs.add(props.getLoginUrl()); - allowURLs.add(props.getLogoutUrl()); // 额外添加的排除项 if (!CollectionUtils.isEmpty(props.getAdditionPermitUrls())) { allowURLs.addAll(props.getAdditionPermitUrls()); } // 标记匿名访问 - Map handlerMethodMap = applicationContext.getBean(RequestMappingHandlerMapping.class).getHandlerMethods(); + Map handlerMethodMap = applicationContextHolder.getApplicationContext().getBean(RequestMappingHandlerMapping.class).getHandlerMethods(); Set anonUrls = new HashSet<>(); for (Map.Entry infoEntry : handlerMethodMap.entrySet()) { HandlerMethod handlerMethod = infoEntry.getValue(); @@ -85,10 +83,8 @@ protected void configure(HttpSecurity http) throws Exception { allowURLs.addAll(anonUrls); } String[] permitAllMapping = allowURLs.toArray(new String[0]); - String httpOnly = ApplicationContextHolder.getEnvironment().get("server.servlet.session.cookie.http-only"); http.csrf() - .ignoringAntMatchers(permitAllMapping) - .csrfTokenRepository(Boolean.parseBoolean(httpOnly) ? new CookieCsrfTokenRepository() : CookieCsrfTokenRepository.withHttpOnlyFalse()).and() + .disable() .sessionManagement().sessionCreationPolicy(props.isStateless() ? SessionCreationPolicy.STATELESS : SessionCreationPolicy.IF_REQUIRED).and() .formLogin().disable() @@ -108,8 +104,8 @@ protected void configure(HttpSecurity http) throws Exception { // 其他所有请求需要身份认证 .anyRequest().authenticated(); - // 配置预设置 - presetConfigure(http); + // 添加自定义匿名路径 + additionalConfigure(http.authorizeRequests(), http); // 如果是无状态方式 if (props.isStateless()) { @@ -156,6 +152,15 @@ public void configure(WebSecurity web) { } } + /** + * 自定义添加允许匿名访问的路径 + * + * @param urlRegistry URL配置对象 + * @param http HttpSecurity + * @throws Exception 配置异常 + */ + protected void additionalConfigure(ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry urlRegistry, HttpSecurity http) throws Exception { } + /** * 自定义配置数据源提供及PasswordEncoder * @param provider DaoAuthenticationProvider @@ -172,14 +177,6 @@ protected Supplier authFailureHandler() { return () -> (request, response, exception) -> response.setStatus(HttpStatus.UNAUTHORIZED.value()); } - /** - * 预设置添加允许访问路径 - * - * @param http HttpSecurity - * @throws Exception 配置异常 - */ - protected void presetConfigure(HttpSecurity http) throws Exception { } - @Bean(name = BeanIds.AUTHENTICATION_MANAGER) @Override public AuthenticationManager authenticationManager() throws Exception { diff --git a/MilkomedaDemo/pom.xml b/MilkomedaDemo/pom.xml index 65e834a4..c31bc4be 100644 --- a/MilkomedaDemo/pom.xml +++ b/MilkomedaDemo/pom.xml @@ -20,7 +20,7 @@ UTF-8 1.8 Hoxton.RELEASE - 3.10.0-SNAPSHOT + 3.10.1-SNAPSHOT 2.1.1 3.12.5 3.4.14 diff --git a/MilkomedaDemo/src/main/java/com/github/yizzuide/milkomeda/demo/crust/controller/CaseController.java b/MilkomedaDemo/src/main/java/com/github/yizzuide/milkomeda/demo/crust/controller/CaseController.java index 29e6fee4..7a3282dd 100644 --- a/MilkomedaDemo/src/main/java/com/github/yizzuide/milkomeda/demo/crust/controller/CaseController.java +++ b/MilkomedaDemo/src/main/java/com/github/yizzuide/milkomeda/demo/crust/controller/CaseController.java @@ -6,6 +6,7 @@ import lombok.extern.slf4j.Slf4j; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PathVariable; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RestController; @@ -38,4 +39,12 @@ public Map info() { log.info("比较两个对象：{}", userInfo == userInfo2); return data; } + + @GetMapping("find/{id}") + public Map find(@PathVariable("id") Long id) { + Map data = new HashMap<>(); + data.put("id", id); + data.put("name", "case-01"); + return data; + } }