Skip to content

Commit 38a8516

Browse files
elunezelunez
committed
[代码完成](v2.5): 匿名接口SecurityConfig配置细腻化，支持不同类型的接口放行
1 parent 4ddf97c commit 38a8516

2 files changed

Lines changed: 137 additions & 16 deletions

File tree

‎eladmin-common/src/main/java/me/zhengjie/utils/enums/RequestMethodEnum.java‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
/*
2+
* Copyright 2019-2020 Zheng Jie
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package me.zhengjie.utils.enums;
17+
18+
import lombok.AllArgsConstructor;
19+
import lombok.Getter;
20+
21+
/**
22+
* @author Zheng Jie
23+
* @website https://el-admin.vip
24+
* @description
25+
* @date 2020-06-10
26+
**/
27+
@Getter
28+
@AllArgsConstructor
29+
public enum RequestMethodEnum {
30+
31+
/**
32+
* 搜寻 @AnonymousGetMapping
33+
*/
34+
GET("GET"),
35+
36+
/**
37+
* 搜寻 @AnonymousPostMapping
38+
*/
39+
POST("POST"),
40+
41+
/**
42+
* 搜寻 @AnonymousPutMapping
43+
*/
44+
PUT("PUT"),
45+
46+
/**
47+
* 搜寻 @AnonymousPatchMapping
48+
*/
49+
PATCH("PATCH"),
50+
51+
/**
52+
* 搜寻 @AnonymousDeleteMapping
53+
*/
54+
DELETE("DELETE"),
55+
56+
/**
57+
* 否则就是所有 Request 接口都放行
58+
*/
59+
ALL("All");
60+
61+
/**
62+
* Request 类型
63+
*/
64+
private final String type;
65+
66+
public static RequestMethodEnum find(String type) {
67+
for (RequestMethodEnum value : RequestMethodEnum.values()) {
68+
if (type.equals(value.getType())) {
69+
return value;
70+
}
71+
}
72+
return ALL;
73+
}
74+
}

‎eladmin-system/src/main/java/me/zhengjie/modules/security/config/SecurityConfig.java‎

Lines changed: 63 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
import lombok.RequiredArgsConstructor;
1919
import me.zhengjie.annotation.AnonymousAccess;
2020
import me.zhengjie.modules.security.security.*;
21+
import me.zhengjie.utils.enums.RequestMethodEnum;
2122
import org.springframework.context.ApplicationContext;
2223
import org.springframework.context.annotation.Bean;
2324
import org.springframework.context.annotation.Configuration;
@@ -31,13 +32,12 @@
3132
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
3233
import org.springframework.security.crypto.password.PasswordEncoder;
3334
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
35+
import org.springframework.web.bind.annotation.RequestMethod;
3436
import org.springframework.web.filter.CorsFilter;
3537
import org.springframework.web.method.HandlerMethod;
3638
import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
3739
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
38-
import java.util.HashSet;
39-
import java.util.Map;
40-
import java.util.Set;
40+
import java.util.*;
4141

4242
/**
4343
* @author Zheng Jie
@@ -70,14 +70,8 @@ public PasswordEncoder passwordEncoder() {
7070
protected void configure(HttpSecurity httpSecurity) throws Exception {
7171
// 搜寻匿名标记 url： @AnonymousAccess
7272
Map<RequestMappingInfo, HandlerMethod> handlerMethodMap = applicationContext.getBean(RequestMappingHandlerMapping.class).getHandlerMethods();
73-
Set<String> anonymousUrls = new HashSet<>();
74-
for (Map.Entry<RequestMappingInfo, HandlerMethod> infoEntry : handlerMethodMap.entrySet()) {
75-
HandlerMethod handlerMethod = infoEntry.getValue();
76-
AnonymousAccess anonymousAccess = handlerMethod.getMethodAnnotation(AnonymousAccess.class);
77-
if (null != anonymousAccess) {
78-
anonymousUrls.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
79-
}
80-
}
73+
// 获取匿名标记
74+
Map<String, Set<String>> anonymousUrls = getAnonymousUrl(handlerMethodMap);
8175
httpSecurity
8276
// 禁用 CSRF
8377
.csrf().disable()
@@ -86,18 +80,15 @@ protected void configure(HttpSecurity httpSecurity) throws Exception {
8680
.exceptionHandling()
8781
.authenticationEntryPoint(authenticationErrorHandler)
8882
.accessDeniedHandler(jwtAccessDeniedHandler)
89-
9083
// 防止iframe 造成跨域
9184
.and()
9285
.headers()
9386
.frameOptions()
9487
.disable()
95-
9688
// 不创建会话
9789
.and()
9890
.sessionManagement()
9991
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
100-
10192
.and()
10293
.authorizeRequests()
10394
// 静态资源等等
@@ -121,13 +112,69 @@ protected void configure(HttpSecurity httpSecurity) throws Exception {
121112
.antMatchers("/druid/**").permitAll()
122113
// 放行OPTIONS请求
123114
.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
124-
// 自定义匿名访问所有url放行 ： 允许匿名和带权限以及登录用户访问
125-
.antMatchers(anonymousUrls.toArray(new String[0])).permitAll()
115+
// 自定义匿名访问所有url放行：允许匿名和带Token访问，细腻化到每个 Request 类型
116+
// GET
117+
.antMatchers(HttpMethod.GET, anonymousUrls.get(RequestMethodEnum.GET.getType()).toArray(new String[0])).permitAll()
118+
// POST
119+
.antMatchers(HttpMethod.POST, anonymousUrls.get(RequestMethodEnum.POST.getType()).toArray(new String[0])).permitAll()
120+
// PUT
121+
.antMatchers(HttpMethod.PUT, anonymousUrls.get(RequestMethodEnum.PUT.getType()).toArray(new String[0])).permitAll()
122+
// PATCH
123+
.antMatchers(HttpMethod.PATCH, anonymousUrls.get(RequestMethodEnum.PATCH.getType()).toArray(new String[0])).permitAll()
124+
// DELETE
125+
.antMatchers(HttpMethod.DELETE, anonymousUrls.get(RequestMethodEnum.DELETE.getType()).toArray(new String[0])).permitAll()
126+
// 所有类型的接口都放行
127+
.antMatchers(anonymousUrls.get(RequestMethodEnum.ALL.getType()).toArray(new String[0])).permitAll()
126128
// 所有请求都需要认证
127129
.anyRequest().authenticated()
128130
.and().apply(securityConfigurerAdapter());
129131
}
130132

133+
private Map<String, Set<String>> getAnonymousUrl(Map<RequestMappingInfo, HandlerMethod> handlerMethodMap) {
134+
Map<String, Set<String>> anonymousUrls = new HashMap<>();
135+
Set<String> get = new HashSet<>();
136+
Set<String> post = new HashSet<>();
137+
Set<String> put = new HashSet<>();
138+
Set<String> patch = new HashSet<>();
139+
Set<String> delete = new HashSet<>();
140+
Set<String> all = new HashSet<>();
141+
for (Map.Entry<RequestMappingInfo, HandlerMethod> infoEntry : handlerMethodMap.entrySet()) {
142+
HandlerMethod handlerMethod = infoEntry.getValue();
143+
AnonymousAccess anonymousAccess = handlerMethod.getMethodAnnotation(AnonymousAccess.class);
144+
if (null != anonymousAccess) {
145+
List<RequestMethod> requestMethods = new ArrayList<>(infoEntry.getKey().getMethodsCondition().getMethods());
146+
RequestMethodEnum request = RequestMethodEnum.find(requestMethods.size() == 0 ? RequestMethodEnum.ALL.getType() : requestMethods.get(0).name());
147+
switch (Objects.requireNonNull(request)){
148+
case GET:
149+
get.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
150+
break;
151+
case POST:
152+
post.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
153+
break;
154+
case PUT:
155+
put.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
156+
break;
157+
case PATCH:
158+
patch.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
159+
break;
160+
case DELETE:
161+
delete.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
162+
break;
163+
default:
164+
all.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
165+
break;
166+
}
167+
}
168+
}
169+
anonymousUrls.put(RequestMethodEnum.GET.getType(), get);
170+
anonymousUrls.put(RequestMethodEnum.POST.getType(), post);
171+
anonymousUrls.put(RequestMethodEnum.PUT.getType(), put);
172+
anonymousUrls.put(RequestMethodEnum.PATCH.getType(), patch);
173+
anonymousUrls.put(RequestMethodEnum.DELETE.getType(), delete);
174+
anonymousUrls.put(RequestMethodEnum.ALL.getType(), all);
175+
return anonymousUrls;
176+
}
177+
131178
private TokenConfigurer securityConfigurerAdapter() {
132179
return new TokenConfigurer(tokenProvider);
133180
}

0 commit comments

Comments
 (0)