yudao
/
spring-cloud
mirror of https://gitee.com/zhijiantianya/yudao-cloud.git
3
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

【功能优化】spring security：antMatchers 替换成 requestMatchers

pull/146/MERGE
YunaiV 2024-10-01 15:22:58 +08:00
parent 058eef0942
commit ad2cc100d2
15 changed files with 136 additions and 127 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/config/AuthorizeRequestsCustomizer.java
View File

@ -4,7 +4,7 @@ import cn.iocoder.yudao.framework.web.config.WebProperties;
import org.springframework.core.Ordered; import org.springframework.core.Ordered;
import org.springframework.security.config.Customizer; import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import javax.annotation.Resource; import javax.annotation.Resource;
@ -15,7 +15,7 @@ import javax.annotation.Resource;
* @author 芋道源码 * @author 芋道源码
*/ */
public abstract class AuthorizeRequestsCustomizer public abstract class AuthorizeRequestsCustomizer
implements Customizer<ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry>, Ordered { implements Customizer<AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry>, Ordered {
@Resource @Resource
private WebProperties webProperties; private WebProperties webProperties;

29
yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/config/YudaoWebSecurityConfigurerAdapter.java
View File

@ -126,22 +126,23 @@ public class YudaoWebSecurityConfigurerAdapter {
// 设置每个请求的权限 // 设置每个请求的权限
httpSecurity httpSecurity
// ①：全局共享规则 // ①：全局共享规则
.authorizeRequests() .authorizeHttpRequests(c -> c
// 1.1 静态资源，可匿名访问 // 1.1 静态资源，可匿名访问
.antMatchers(HttpMethod.GET, "/*.html", "/**/*.html", "/**/*.css", "/**/*.js").permitAll() .requestMatchers(HttpMethod.GET, "/*.html", "/*.html", "/*.css", "/*.js").permitAll()
// 1.2 设置 @PermitAll 无需认证 // 1.2 设置 @PermitAll 无需认证
.antMatchers(HttpMethod.GET, permitAllUrls.get(HttpMethod.GET).toArray(new String[0])).permitAll() .requestMatchers(HttpMethod.GET, permitAllUrls.get(HttpMethod.GET).toArray(new String[0])).permitAll()
.antMatchers(HttpMethod.POST, permitAllUrls.get(HttpMethod.POST).toArray(new String[0])).permitAll() .requestMatchers(HttpMethod.POST, permitAllUrls.get(HttpMethod.POST).toArray(new String[0])).permitAll()
.antMatchers(HttpMethod.PUT, permitAllUrls.get(HttpMethod.PUT).toArray(new String[0])).permitAll() .requestMatchers(HttpMethod.PUT, permitAllUrls.get(HttpMethod.PUT).toArray(new String[0])).permitAll()
.antMatchers(HttpMethod.DELETE, permitAllUrls.get(HttpMethod.DELETE).toArray(new String[0])).permitAll() .requestMatchers(HttpMethod.DELETE, permitAllUrls.get(HttpMethod.DELETE).toArray(new String[0])).permitAll()
// 1.3 基于 yudao.security.permit-all-urls 无需认证 .requestMatchers(HttpMethod.HEAD, permitAllUrls.get(HttpMethod.HEAD).toArray(new String[0])).permitAll()
.antMatchers(securityProperties.getPermitAllUrls().toArray(new String[0])).permitAll() .requestMatchers(HttpMethod.PATCH, permitAllUrls.get(HttpMethod.PATCH).toArray(new String[0])).permitAll()
// 1.3 基于 yudao.security.permit-all-urls 无需认证
.requestMatchers(securityProperties.getPermitAllUrls().toArray(new String[0])).permitAll()
)
// ②：每个项目的自定义规则 // ②：每个项目的自定义规则
.and().authorizeRequests(registry -> // 下面，循环设置自定义规则 .authorizeHttpRequests(c -> authorizeRequestsCustomizers.forEach(customizer -> customizer.customize(c)))
authorizeRequestsCustomizers.forEach(customizer -> customizer.customize(registry)))
// ③：兜底规则，必须认证 // ③：兜底规则，必须认证
.authorizeRequests() .authorizeHttpRequests(c -> c.anyRequest().authenticated());
.anyRequest().authenticated();
// 添加 Token Filter // 添加 Token Filter
httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class); httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);

5
yudao-framework/yudao-spring-boot-starter-websocket/src/main/java/cn/iocoder/yudao/framework/websocket/core/security/WebSocketAuthorizeRequestsCustomizer.java
View File

@ -4,6 +4,7 @@ import cn.iocoder.yudao.framework.security.config.AuthorizeRequestsCustomizer;
import cn.iocoder.yudao.framework.websocket.config.WebSocketProperties; import cn.iocoder.yudao.framework.websocket.config.WebSocketProperties;
import lombok.RequiredArgsConstructor; import lombok.RequiredArgsConstructor;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
/** /**
@ -17,8 +18,8 @@ public class WebSocketAuthorizeRequestsCustomizer extends AuthorizeRequestsCusto
private final WebSocketProperties webSocketProperties; private final WebSocketProperties webSocketProperties;
@Override @Override
public void customize(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry) { public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
registry.antMatchers(webSocketProperties.getPath()).permitAll(); registry.requestMatchers(webSocketProperties.getPath()).permitAll();
} }
} }

3
yudao-module-ai/yudao-module-ai-biz/src/main/java/cn/iocoder/yudao/module/ai/framework/security/config/SecurityConfiguration.java
View File

@ -13,8 +13,7 @@ import org.springframework.security.config.annotation.web.configurers.AuthorizeH
@Configuration(proxyBeanMethods = false, value = "aiSecurityConfiguration") @Configuration(proxyBeanMethods = false, value = "aiSecurityConfiguration")
public class SecurityConfiguration { public class SecurityConfiguration {
@Bean("aiAuthorizeRequestsCustomizer")
@Bean("infraAuthorizeRequestsCustomizer")
public AuthorizeRequestsCustomizer authorizeRequestsCustomizer() { public AuthorizeRequestsCustomizer authorizeRequestsCustomizer() {
return new AuthorizeRequestsCustomizer() { return new AuthorizeRequestsCustomizer() {

17
yudao-module-bpm/yudao-module-bpm-biz/src/main/java/cn/iocoder/yudao/module/bpm/framework/security/config/SecurityConfiguration.java
View File

@ -4,6 +4,7 @@ import cn.iocoder.yudao.framework.security.config.AuthorizeRequestsCustomizer;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
/** /**
@ -17,18 +18,18 @@ public class SecurityConfiguration {
return new AuthorizeRequestsCustomizer() { return new AuthorizeRequestsCustomizer() {
@Override @Override
public void customize(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry) { public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
// TODO 芋艿：这个每个项目都需要重复配置，得捉摸有没通用的方案 // TODO 芋艿：这个每个项目都需要重复配置，得捉摸有没通用的方案
// Swagger 接口文档 // Swagger 接口文档
registry.antMatchers("/v3/api-docs/**").permitAll() registry.requestMatchers("/v3/api-docs/**").permitAll()
.antMatchers("/webjars/**").permitAll() .requestMatchers("/webjars/**").permitAll()
.antMatchers("/swagger-ui").permitAll() .requestMatchers("/swagger-ui").permitAll()
.antMatchers("/swagger-ui/**").permitAll(); .requestMatchers("/swagger-ui/**").permitAll();
// Druid 监控 // Druid 监控
registry.antMatchers("/druid/**").anonymous(); registry.requestMatchers("/druid/**").permitAll();
// Spring Boot Actuator 的安全配置 // Spring Boot Actuator 的安全配置
registry.antMatchers("/actuator").anonymous() registry.requestMatchers("/actuator").permitAll()
.antMatchers("/actuator/**").anonymous(); .requestMatchers("/actuator/**").permitAll();
} }
}; };

19
yudao-module-crm/yudao-module-crm-biz/src/main/java/cn/iocoder/yudao/module/crm/framework/security/config/SecurityConfiguration.java
View File

@ -5,6 +5,7 @@ import cn.iocoder.yudao.module.crm.enums.ApiConstants;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
/** /**
@ -18,19 +19,19 @@ public class SecurityConfiguration {
return new AuthorizeRequestsCustomizer() { return new AuthorizeRequestsCustomizer() {
@Override @Override
public void customize(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry) { public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
// Swagger 接口文档 // Swagger 接口文档
registry.antMatchers("/v3/api-docs/**").permitAll() registry.requestMatchers("/v3/api-docs/**").permitAll()
.antMatchers("/webjars/**").permitAll() .requestMatchers("/webjars/**").permitAll()
.antMatchers("/swagger-ui").permitAll() .requestMatchers("/swagger-ui").permitAll()
.antMatchers("/swagger-ui/**").permitAll(); .requestMatchers("/swagger-ui/**").permitAll();
// Spring Boot Actuator 的安全配置 // Spring Boot Actuator 的安全配置
registry.antMatchers("/actuator").permitAll() registry.requestMatchers("/actuator").permitAll()
.antMatchers("/actuator/**").permitAll(); .requestMatchers("/actuator/**").permitAll();
// Druid 监控 // Druid 监控
registry.antMatchers("/druid/**").permitAll(); registry.requestMatchers("/druid/**").permitAll();
// RPC 服务的安全配置 // RPC 服务的安全配置
registry.antMatchers(ApiConstants.PREFIX + "/**").permitAll(); registry.requestMatchers(ApiConstants.PREFIX + "/**").permitAll();
} }
}; };

18
yudao-module-erp/yudao-module-erp-biz/src/main/java/cn/iocoder/yudao/module/erp/framework/security/config/SecurityConfiguration.java
View File

@ -19,19 +19,19 @@ public class SecurityConfiguration {
return new AuthorizeRequestsCustomizer() { return new AuthorizeRequestsCustomizer() {
@Override @Override
public void customize(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry) { public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
// Swagger 接口文档 // Swagger 接口文档
registry.antMatchers("/v3/api-docs/**").permitAll() registry.requestMatchers("/v3/api-docs/**").permitAll()
.antMatchers("/webjars/**").permitAll() .requestMatchers("/webjars/**").permitAll()
.antMatchers("/swagger-ui").permitAll() .requestMatchers("/swagger-ui").permitAll()
.antMatchers("/swagger-ui/**").permitAll(); .requestMatchers("/swagger-ui/**").permitAll();
// Spring Boot Actuator 的安全配置 // Spring Boot Actuator 的安全配置
registry.antMatchers("/actuator").permitAll() registry.requestMatchers("/actuator").permitAll()
.antMatchers("/actuator/**").permitAll(); .requestMatchers("/actuator/**").permitAll();
// Druid 监控 // Druid 监控
registry.antMatchers("/druid/**").permitAll(); registry.requestMatchers("/druid/**").permitAll();
// RPC 服务的安全配置 // RPC 服务的安全配置
registry.antMatchers(ApiConstants.PREFIX + "/**").permitAll(); registry.requestMatchers(ApiConstants.PREFIX + "/**").permitAll();
} }
}; };

25
yudao-module-infra/yudao-module-infra-biz/src/main/java/cn/iocoder/yudao/module/infra/framework/security/config/SecurityConfiguration.java
View File

@ -6,6 +6,7 @@ import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
/** /**
@ -22,26 +23,26 @@ public class SecurityConfiguration {
return new AuthorizeRequestsCustomizer() { return new AuthorizeRequestsCustomizer() {
@Override @Override
public void customize(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry) { public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
// Swagger 接口文档 // Swagger 接口文档
registry.antMatchers("/v3/api-docs/**").permitAll() registry.requestMatchers("/v3/api-docs/**").permitAll()
.antMatchers("/webjars/**").permitAll() .requestMatchers("/webjars/**").permitAll()
.antMatchers("/swagger-ui").permitAll() .requestMatchers("/swagger-ui").permitAll()
.antMatchers("/swagger-ui/**").permitAll(); .requestMatchers("/swagger-ui/**").permitAll();
// Spring Boot Actuator 的安全配置 // Spring Boot Actuator 的安全配置
registry.antMatchers("/actuator").anonymous() registry.requestMatchers("/actuator").permitAll()
.antMatchers("/actuator/**").anonymous(); .requestMatchers("/actuator/**").permitAll();
// Druid 监控 // Druid 监控
registry.antMatchers("/druid/**").anonymous(); registry.requestMatchers("/druid/**").permitAll();
// Spring Boot Admin Server 的安全配置 // Spring Boot Admin Server 的安全配置
registry.antMatchers(adminSeverContextPath).anonymous() registry.requestMatchers(adminSeverContextPath).permitAll()
.antMatchers(adminSeverContextPath + "/**").anonymous(); .requestMatchers(adminSeverContextPath + "/**").permitAll();
// 文件读取 // 文件读取
registry.antMatchers(buildAdminApi("/infra/file/*/get/**")).permitAll(); registry.requestMatchers(buildAdminApi("/infra/file/*/get/**")).permitAll();
// TODO 芋艿：这个每个项目都需要重复配置，得捉摸有没通用的方案 // TODO 芋艿：这个每个项目都需要重复配置，得捉摸有没通用的方案
// RPC 服务的安全配置 // RPC 服务的安全配置
registry.antMatchers(ApiConstants.PREFIX + "/**").permitAll(); registry.requestMatchers(ApiConstants.PREFIX + "/**").permitAll();
} }
}; };

21
yudao-module-mall/yudao-module-product-biz/src/main/java/cn/iocoder/yudao/module/product/framework/security/config/SecurityConfiguration.java
View File

@ -5,10 +5,11 @@ import cn.iocoder.yudao.module.product.enums.ApiConstants;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
/** /**
* Member 模块的 Security 配置 * Product 模块的 Security 配置
*/ */
@Configuration("productSecurityConfiguration") @Configuration("productSecurityConfiguration")
public class SecurityConfiguration { public class SecurityConfiguration {
@ -18,19 +19,19 @@ public class SecurityConfiguration {
return new AuthorizeRequestsCustomizer() { return new AuthorizeRequestsCustomizer() {
@Override @Override
public void customize(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry) { public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
// Swagger 接口文档 // Swagger 接口文档
registry.antMatchers("/v3/api-docs/**").permitAll() registry.requestMatchers("/v3/api-docs/**").permitAll()
.antMatchers("/webjars/**").permitAll() .requestMatchers("/webjars/**").permitAll()
.antMatchers("/swagger-ui").permitAll() .requestMatchers("/swagger-ui").permitAll()
.antMatchers("/swagger-ui/**").permitAll(); .requestMatchers("/swagger-ui/**").permitAll();
// Spring Boot Actuator 的安全配置 // Spring Boot Actuator 的安全配置
registry.antMatchers("/actuator").anonymous() registry.requestMatchers("/actuator").permitAll()
.antMatchers("/actuator/**").anonymous(); .requestMatchers("/actuator/**").permitAll();
// Druid 监控 // Druid 监控
registry.antMatchers("/druid/**").anonymous(); registry.requestMatchers("/druid/**").permitAll();
// RPC 服务的安全配置 // RPC 服务的安全配置
registry.antMatchers(ApiConstants.PREFIX + "/**").permitAll(); registry.requestMatchers(ApiConstants.PREFIX + "/**").permitAll();
} }
}; };

19
yudao-module-mall/yudao-module-promotion-biz/src/main/java/cn/iocoder/yudao/module/promotion/framework/security/config/SecurityConfiguration.java
View File

@ -5,6 +5,7 @@ import cn.iocoder.yudao.module.promotion.enums.ApiConstants;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
/** /**
@ -18,19 +19,19 @@ public class SecurityConfiguration {
return new AuthorizeRequestsCustomizer() { return new AuthorizeRequestsCustomizer() {
@Override @Override
public void customize(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry) { public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
// Swagger 接口文档 // Swagger 接口文档
registry.antMatchers("/v3/api-docs/**").permitAll() registry.requestMatchers("/v3/api-docs/**").permitAll()
.antMatchers("/webjars/**").permitAll() .requestMatchers("/webjars/**").permitAll()
.antMatchers("/swagger-ui").permitAll() .requestMatchers("/swagger-ui").permitAll()
.antMatchers("/swagger-ui/**").permitAll(); .requestMatchers("/swagger-ui/**").permitAll();
// Spring Boot Actuator 的安全配置 // Spring Boot Actuator 的安全配置
registry.antMatchers("/actuator").anonymous() registry.requestMatchers("/actuator").permitAll()
.antMatchers("/actuator/**").anonymous(); .requestMatchers("/actuator/**").permitAll();
// Druid 监控 // Druid 监控
registry.antMatchers("/druid/**").anonymous(); registry.requestMatchers("/druid/**").permitAll();
// RPC 服务的安全配置 // RPC 服务的安全配置
registry.antMatchers(ApiConstants.PREFIX + "/**").permitAll(); registry.requestMatchers(ApiConstants.PREFIX + "/**").permitAll();
} }
}; };

19
yudao-module-member/yudao-module-member-biz/src/main/java/cn/iocoder/yudao/module/member/framework/security/config/SecurityConfiguration.java
View File

@ -5,6 +5,7 @@ import cn.iocoder.yudao.module.member.enums.ApiConstants;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
/** /**
@ -18,19 +19,19 @@ public class SecurityConfiguration {
return new AuthorizeRequestsCustomizer() { return new AuthorizeRequestsCustomizer() {
@Override @Override
public void customize(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry) { public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
// Swagger 接口文档 // Swagger 接口文档
registry.antMatchers("/v3/api-docs/**").permitAll() registry.requestMatchers("/v3/api-docs/**").permitAll()
.antMatchers("/webjars/**").permitAll() .requestMatchers("/webjars/**").permitAll()
.antMatchers("/swagger-ui").permitAll() .requestMatchers("/swagger-ui").permitAll()
.antMatchers("/swagger-ui/**").permitAll(); .requestMatchers("/swagger-ui/**").permitAll();
// Spring Boot Actuator 的安全配置 // Spring Boot Actuator 的安全配置
registry.antMatchers("/actuator").anonymous() registry.requestMatchers("/actuator").permitAll()
.antMatchers("/actuator/**").anonymous(); .requestMatchers("/actuator/**").permitAll();
// Druid 监控 // Druid 监控
registry.antMatchers("/druid/**").anonymous(); registry.requestMatchers("/druid/**").permitAll();
// RPC 服务的安全配置 // RPC 服务的安全配置
registry.antMatchers(ApiConstants.PREFIX + "/**").permitAll(); registry.requestMatchers(ApiConstants.PREFIX + "/**").permitAll();
} }
}; };

26
yudao-module-mp/yudao-module-mp-biz/src/main/java/cn/iocoder/yudao/module/mp/framework/security/config/SecurityConfiguration.java
View File

@ -5,33 +5,33 @@ import cn.iocoder.yudao.module.system.enums.ApiConstants;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
/** /**
* System 模块的 Security 配置 * MP 模块的 Security 配置
*/ */
@Configuration(proxyBeanMethods = false, value = "systemSecurityConfiguration") @Configuration(proxyBeanMethods = false, value = "mpSecurityConfiguration")
public class SecurityConfiguration { public class SecurityConfiguration {
@Bean("systemAuthorizeRequestsCustomizer") @Bean("mpAuthorizeRequestsCustomizer")
public AuthorizeRequestsCustomizer authorizeRequestsCustomizer() { public AuthorizeRequestsCustomizer authorizeRequestsCustomizer() {
return new AuthorizeRequestsCustomizer() { return new AuthorizeRequestsCustomizer() {
@Override @Override
public void customize(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry) { public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
// TODO 芋艿：这个每个项目都需要重复配置，得捉摸有没通用的方案 // TODO 芋艿：这个每个项目都需要重复配置，得捉摸有没通用的方案
// Swagger 接口文档 // Swagger 接口文档
registry.antMatchers("/v3/api-docs/**").permitAll() registry.requestMatchers("/v3/api-docs/**").permitAll()
.antMatchers("/webjars/**").permitAll() .requestMatchers("/webjars/**").permitAll()
.antMatchers("/swagger-ui").permitAll() .requestMatchers("/swagger-ui").permitAll()
.antMatchers("/swagger-ui/**").permitAll(); .requestMatchers("/swagger-ui/**").permitAll();
// Druid 监控 // Druid 监控
registry.antMatchers("/druid/**").anonymous(); registry.requestMatchers("/druid/**").permitAll();
// Spring Boot Actuator 的安全配置 // Spring Boot Actuator 的安全配置
registry.antMatchers("/actuator").anonymous() registry.requestMatchers("/actuator").permitAll()
.antMatchers("/actuator/**").anonymous(); .requestMatchers("/actuator/**").permitAll();
// RPC 服务的安全配置 // RPC 服务的安全配置
registry.antMatchers(ApiConstants.PREFIX + "/**").permitAll(); registry.requestMatchers(ApiConstants.PREFIX + "/**").permitAll();
} }
}; };

19
yudao-module-pay/yudao-module-pay-biz/src/main/java/cn/iocoder/yudao/module/pay/framework/security/config/SecurityConfiguration.java
View File

@ -5,6 +5,7 @@ import cn.iocoder.yudao.module.pay.enums.ApiConstants;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
/** /**
@ -18,19 +19,19 @@ public class SecurityConfiguration {
return new AuthorizeRequestsCustomizer() { return new AuthorizeRequestsCustomizer() {
@Override @Override
public void customize(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry) { public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
// Swagger 接口文档 // Swagger 接口文档
registry.antMatchers("/v3/api-docs/**").permitAll() registry.requestMatchers("/v3/api-docs/**").permitAll()
.antMatchers("/webjars/**").permitAll() .requestMatchers("/webjars/**").permitAll()
.antMatchers("/swagger-ui").permitAll() .requestMatchers("/swagger-ui").permitAll()
.antMatchers("/swagger-ui/**").permitAll(); .requestMatchers("/swagger-ui/**").permitAll();
// Spring Boot Actuator 的安全配置 // Spring Boot Actuator 的安全配置
registry.antMatchers("/actuator").anonymous() registry.requestMatchers("/actuator").permitAll()
.antMatchers("/actuator/**").anonymous(); .requestMatchers("/actuator/**").permitAll();
// Druid 监控 // Druid 监控
registry.antMatchers("/druid/**").anonymous(); registry.requestMatchers("/druid/**").permitAll();
// RPC 服务的安全配置 // RPC 服务的安全配置
registry.antMatchers(ApiConstants.PREFIX + "/**").permitAll(); registry.requestMatchers(ApiConstants.PREFIX + "/**").permitAll();
} }
}; };

19
yudao-module-report/yudao-module-report-biz/src/main/java/cn/iocoder/yudao/module/report/framework/security/config/SecurityConfiguration.java
View File

@ -4,6 +4,7 @@ import cn.iocoder.yudao.framework.security.config.AuthorizeRequestsCustomizer;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
/** /**
@ -17,19 +18,19 @@ public class SecurityConfiguration {
return new AuthorizeRequestsCustomizer() { return new AuthorizeRequestsCustomizer() {
@Override @Override
public void customize(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry) { public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
// Swagger 接口文档 // Swagger 接口文档
registry.antMatchers("/v3/api-docs/**").permitAll() registry.requestMatchers("/v3/api-docs/**").permitAll()
.antMatchers("/webjars/**").permitAll() .requestMatchers("/webjars/**").permitAll()
.antMatchers("/swagger-ui").permitAll() .requestMatchers("/swagger-ui").permitAll()
.antMatchers("/swagger-ui/**").permitAll(); .requestMatchers("/swagger-ui/**").permitAll();
// Spring Boot Actuator 的安全配置 // Spring Boot Actuator 的安全配置
registry.antMatchers("/actuator").anonymous() registry.requestMatchers("/actuator").permitAll()
.antMatchers("/actuator/**").anonymous(); .requestMatchers("/actuator/**").permitAll();
// Druid 监控 // Druid 监控
registry.antMatchers("/druid/**").anonymous(); registry.requestMatchers("/druid/**").permitAll();
// 积木报表 // 积木报表
registry.antMatchers("/jmreport/**").permitAll(); registry.requestMatchers("/jmreport/**").permitAll();
} }
}; };

20
yudao-module-system/yudao-module-system-biz/src/main/java/cn/iocoder/yudao/module/system/framework/security/config/SecurityConfiguration.java
View File

@ -5,7 +5,7 @@ import cn.iocoder.yudao.module.system.enums.ApiConstants;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
/** /**
* System 模块的 Security 配置 * System 模块的 Security 配置
@ -18,20 +18,20 @@ public class SecurityConfiguration {
return new AuthorizeRequestsCustomizer() { return new AuthorizeRequestsCustomizer() {
@Override @Override
public void customize(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry) { public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
// TODO 芋艿：这个每个项目都需要重复配置，得捉摸有没通用的方案 // TODO 芋艿：这个每个项目都需要重复配置，得捉摸有没通用的方案
// Swagger 接口文档 // Swagger 接口文档
registry.antMatchers("/v3/api-docs/**").permitAll() registry.requestMatchers("/v3/api-docs/**").permitAll()
.antMatchers("/webjars/**").permitAll() .requestMatchers("/webjars/**").permitAll()
.antMatchers("/swagger-ui").permitAll() .requestMatchers("/swagger-ui").permitAll()
.antMatchers("/swagger-ui/**").permitAll(); .requestMatchers("/swagger-ui/**").permitAll();
// Druid 监控 // Druid 监控
registry.antMatchers("/druid/**").anonymous(); registry.requestMatchers("/druid/**").permitAll();
// Spring Boot Actuator 的安全配置 // Spring Boot Actuator 的安全配置
registry.antMatchers("/actuator").anonymous() registry.requestMatchers("/actuator").permitAll()
.antMatchers("/actuator/**").anonymous(); .requestMatchers("/actuator/**").permitAll();
// RPC 服务的安全配置 // RPC 服务的安全配置
registry.antMatchers(ApiConstants.PREFIX + "/**").permitAll(); registry.requestMatchers(ApiConstants.PREFIX + "/**").permitAll();
} }
}; };