0
0

SpringBoot3 + SpringSecurity6 前后端分离

  1.     网上能找到的SpringBoot项目一般都是SpringBoot2 + SpringSecurity5，甚至是SSM的项目。这些老版本的教程很多已经不适用了，对于现在大部分的初学者来说，学了可能也是经典白雪。我还是不愿学那些老版本的东西，所以自己摸索了一下新版的SpringBoot项目应该怎么写。学习的过程也是非常折磨人的，看了很多的教程才知道个大概。

  • 导入依赖

SpringSecurity依赖

  1. <!--SpringSecurity起步依赖-->
  2. <dependency>
  3.     <groupId>org.springframework.boot</groupId>
  4.     <artifactId>spring-boot-starter-security</artifactId>
  5. </dependency>

JWT依赖

  1. <!--jwt令牌-->
  2. <dependency>
  3.     <groupId>io.jsonwebtoken</groupId>
  4.     <artifactId>jjwt</artifactId>
  5.     <version>0.9.1</version>
  6. </dependency>

  • 添加配置类

对Security进行配置，Security中很多的默认配置都可以用自定义的替换。

  1. import lombok.RequiredArgsConstructor;
  2. import org.springframework.context.annotation.Bean;
  3. import org.springframework.context.annotation.Configuration;
  4. import org.springframework.http.HttpMethod;
  5. import org.springframework.security.authentication.AuthenticationManager;
  6. import org.springframework.security.authentication.AuthenticationProvider;
  7. import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
  8. import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
  9. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  10. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  11. import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
  12. import org.springframework.security.core.userdetails.UserDetailsService;
  13. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  14. import org.springframework.security.web.SecurityFilterChain;
  16. /**
  17.  * @Description: SpringSecurity配置类
  18.  * @Author: 翰戈.summer
  19.  * @Date: 2023/11/17
  20.  * @Param:
  21.  * @Return:
  22.  */
  23. @Configuration
  24. @EnableWebSecurity
  25. @RequiredArgsConstructor
  26. public class SecurityConfig {
  28.     private final UserDetailsService userDetailsService;
  30.     /**
  31.      * 加载用户信息
  32.      */
  33.     @Bean
  34.     public UserDetailsService userDetailsService() {
  35.         return userDetailsService;
  36.     }
  38.     /**
  39.      * 密码编码器
  40.      */
  41.     @Bean
  42.     public BCryptPasswordEncoder passwordEncoder() {
  43.         return new BCryptPasswordEncoder();
  44.     }
  46.     /**
  47.      * 身份验证管理器
  48.      */
  49.     @Bean
  50.     public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception {
  51.         return configuration.getAuthenticationManager();
  52.     }
  54.     /**
  55.      * 处理身份验证
  56.      */
  57.     @Bean
  58.     public AuthenticationProvider authenticationProvider() {
  59.         DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
  60.         daoAuthenticationProvider.setPasswordEncoder(passwordEncoder());
  61.         daoAuthenticationProvider.setUserDetailsService(userDetailsService);
  62.         return daoAuthenticationProvider;
  63.     }
  65.     /**
  66.      * @Description: 配置SecurityFilterChain过滤器链
  67.      * @Author: 翰戈.summer
  68.      * @Date: 2023/11/17
  69.      * @Param: HttpSecurity
  70.      * @Return: SecurityFilterChain
  71.      */
  72.     @Bean
  73.     public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity httpSecurity) throws Exception {
  74.         httpSecurity.authorizeHttpRequests(authorizeHttpRequests -> authorizeHttpRequests
  75.                 .requestMatchers(HttpMethod.POST, "/api/user/login").permitAll() //登录放行
  76.                 .anyRequest().authenticated()
  77.         );
  78.         httpSecurity.authenticationProvider(authenticationProvider());
  80.         //禁用登录页面
  81.         httpSecurity.formLogin(AbstractHttpConfigurer::disable);
  82.         //禁用登出页面
  83.         httpSecurity.logout(AbstractHttpConfigurer::disable);
  84.         //禁用session
  85.         httpSecurity.sessionManagement(AbstractHttpConfigurer::disable);
  86.         //禁用httpBasic
  87.         httpSecurity.httpBasic(AbstractHttpConfigurer::disable);
  88.         //禁用csrf保护
  89.         httpSecurity.csrf(AbstractHttpConfigurer::disable);
  91.         return httpSecurity.build();
  92.     }
  93. }

  • 实现UserDetailsService

其中UserMapper、AuthorityMapper需要自己创建，不是重点。这两个Mapper的作用是获取用户信息（用户名、密码、用户权限），封装到User中返回给Security。

  1. import com.demo.mapper.AuthorityMapper;
  2. import com.demo.mapper.UserMapper;
  3. import com.demo.pojo.AuthorityEntity;
  4. import com.demo.pojo.UserEntity;
  5. import lombok.RequiredArgsConstructor;
  6. import org.springframework.security.core.authority.AuthorityUtils;
  7. import org.springframework.security.core.userdetails.User;
  8. import org.springframework.security.core.userdetails.UserDetails;
  9. import org.springframework.security.core.userdetails.UserDetailsService;
  10. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  11. import org.springframework.stereotype.Service;
  13. import java.util.List;
  14. import java.util.StringJoiner;
  16. /**
  17.  * @Description: 用户登录
  18.  * @Author: 翰戈.summer
  19.  * @Date: 2023/11/16
  20.  * @Param:
  21.  * @Return:
  22.  */
  23. @Service
  24. @RequiredArgsConstructor
  25. public class UserLoginDetailsServiceImpl implements UserDetailsService {
  27.     private final UserMapper userMapper;
  28.     private final AuthorityMapper authorityMapper;
  30.     @Override
  31.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
  32.         UserEntity userEntity = userMapper.selectUserByUsername(username);
  34.         List<AuthorityEntity> authorities = authorityMapper.selectAuthorityByUsername(username);
  35.         StringJoiner stringJoiner = new StringJoiner(",", "", "");
  37.         authorities.forEach(authority -> stringJoiner.add(authority.getAuthorityName()));
  39.         return new User(userEntity.getUsername(), userEntity.getPassword(),
  40.                 AuthorityUtils.commaSeparatedStringToAuthorityList(stringJoiner.toString())
  41.         );
  42.     }
  43. }

  • 实现UserDetails

登录操作会用到UserDetails，用于获取用户名和权限。

  1. import lombok.AllArgsConstructor;
  2. import lombok.NoArgsConstructor;
  3. import org.springframework.security.core.GrantedAuthority;
  4. import org.springframework.security.core.userdetails.UserDetails;
  6. import java.util.Collection;
  8. /**
  9.  * @Description: SpringSecurity用户实体类
  10.  * @Author: 翰戈.summer
  11.  * @Date: 2023/11/18
  12.  * @Param:
  13.  * @Return:
  14.  */
  15. @NoArgsConstructor
  16. @AllArgsConstructor
  17. public class UserDetailsEntity implements UserDetails {
  19.     private String username;
  20.     private String password;
  21.     private Collection<? extends GrantedAuthority> authorities;
  23.     @Override
  24.     public Collection<? extends GrantedAuthority> getAuthorities() {
  25.         return authorities;
  26.     }
  28.     @Override
  29.     public String getPassword() {
  30.         return password;
  31.     }
  33.     @Override
  34.     public String getUsername() {
  35.         return username;
  36.     }
  38.     @Override
  39.     public boolean isAccountNonExpired() {
  40.         return true;
  41.     }
  43.     @Override
  44.     public boolean isAccountNonLocked() {
  45.         return true;
  46.     }
  48.     @Override
  49.     public boolean isCredentialsNonExpired() {
  50.         return true;
  51.     }
  53.     @Override
  54.     public boolean isEnabled() {
  55.         return true;
  56.     }
  58.     @Override
  59.     public String toString() {
  60.         return "UserDetailsEntity{" +
  61.                 "username='" + username + '\'' +
  62.                 ", password='" + password + '\'' +
  63.                 ", authorities=" + authorities +
  64.                 '}';
  65.     }
  66. }

  • JWT工具类

生成 jwt令牌 或解析，其中的JwtProperties（jwt令牌配置属性类）可以自己创建，不是重点。

  1. import io.jsonwebtoken.Claims;
  2. import io.jsonwebtoken.Jwts;
  3. import io.jsonwebtoken.SignatureAlgorithm;
  4. import lombok.RequiredArgsConstructor;
  5. import org.springframework.stereotype.Component;
  7. import java.util.Date;
  8. import java.util.Map;
  10. /**
  11.  * @Description: 生成和解析jwt令牌
  12.  * @Author: 翰戈.summer
  13.  * @Date: 2023/11/16
  14.  * @Param:
  15.  * @Return:
  16.  */
  17. @Component
  18. @RequiredArgsConstructor
  19. public class JwtUtils {
  21.     private final JwtProperties jwtProperties;
  23.     /**
  24.      * @Description: 生成令牌
  25.      * @Author: 翰戈.summer
  26.      * @Date: 2023/11/16
  27.      * @Param: Map
  28.      * @Return: String jwt
  29.      */
  30.     public String getJwt(Map<String, Object> claims) {
  32.         String signingKey = jwtProperties.getSigningKey();
  33.         Long expire = jwtProperties.getExpire();
  35.         return Jwts.builder()
  36.                 .setClaims(claims) //设置载荷内容
  37.                 .signWith(SignatureAlgorithm.HS256, signingKey) //设置签名算法
  38.                 .setExpiration(new Date(System.currentTimeMillis() + expire)) //设置有效时间
  39.                 .compact();
  40.     }
  42.     /**
  43.      * @Description: 解析令牌
  44.      * @Author: 翰戈.summer
  45.      * @Date: 2023/11/16
  46.      * @Param: String jwt
  47.      * @Return: Claims claims
  48.      */
  49.     public Claims parseJwt(String jwt) {
  51.         String signingKey = jwtProperties.getSigningKey();
  53.         return Jwts.parser()
  54.                 .setSigningKey(signingKey) //指定签名密钥
  55.                 .parseClaimsJws(jwt) //开始解析令牌
  56.                 .getBody();
  57.     }
  58. }

  • 登录接口

用户登录成功并返回 jwt令牌，Result为统一响应的结果，UserLoginDTO用于封装用户登录信息，其中的UserDetails必须实现后才能获取到用户信息。

  1. import lombok.RequiredArgsConstructor;
  2. import org.springframework.security.authentication.AuthenticationManager;
  3. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  4. import org.springframework.security.core.Authentication;
  5. import org.springframework.security.core.GrantedAuthority;
  6. import org.springframework.security.core.context.SecurityContextHolder;
  7. import org.springframework.security.core.userdetails.UserDetails;
  8. import org.springframework.web.bind.annotation.PostMapping;
  9. import org.springframework.web.bind.annotation.RequestBody;
  10. import org.springframework.web.bind.annotation.RequestMapping;
  11. import org.springframework.web.bind.annotation.RestController;
  13. import java.util.Collection;
  14. import java.util.HashMap;
  15. import java.util.Map;
  17. /**
  18.  * @Description: 用户登录操作相关接口
  19.  * @Author: 翰戈.summer
  20.  * @Date: 2023/11/20
  21.  * @Param:
  22.  * @Return:
  23.  */
  24. @RestController
  25. @RequestMapping("/api/user/login")
  26. @RequiredArgsConstructor
  27. public class UserLoginController {
  29.     private final AuthenticationManager authenticationManager;
  31.     private final JwtUtils jwtUtils;
  33.     @PostMapping
  34.     public Result<String> doLogin(@RequestBody UserLoginDTO userLoginDTO) {
  35.         try {
  36.             UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken(userLoginDTO.getUsername(), userLoginDTO.getPassword());
  37.             Authentication authentication = authenticationManager.authenticate(auth);
  38.             SecurityContextHolder.getContext().setAuthentication(authentication);
  39.             UserDetails userDetails = (UserDetails) authentication.getPrincipal();
  41.             //获取用户权限信息
  42.             String authorityString = "";
  43.             Collection<? extends GrantedAuthority> authorities = userDetails.getAuthorities();
  44.             for (GrantedAuthority authority : authorities) {
  45.                 authorityString = authority.getAuthority();
  46.             }
  48.             //用户身份验证成功，生成并返回jwt令牌
  49.             Map<String, Object> claims = new HashMap<>();
  50.             claims.put("username", userDetails.getUsername());
  51.             claims.put("authorityString", authorityString);
  52.             String jwtToken = jwtUtils.getJwt(claims);
  53.             return Result.success(jwtToken);
  54.         } catch (Exception ex) {
  55.             //用户身份验证失败，返回登陆失败提示
  56.             return Result.error("用户名或密码错误！");
  57.         }
  58.     }
  59. }

  • 自定义token过滤器

过滤器中抛出的异常是不会被全局异常处理器捕获到的，直接返回错误结果。这里用到了SpringContextUtils通过上下文来获取Bean组件，下面会提供。

过滤器属于Servlet（作用范围更大），拦截器属于SpringMVC（作用范围较小），全局异常处理器只能捕获到拦截器中的异常。在过滤器中无法初始化Bean组件，可以通过上下文来获取。

  1. import com.fasterxml.jackson.databind.ObjectMapper;
  2. import io.jsonwebtoken.Claims;
  3. import jakarta.servlet.FilterChain;
  4. import jakarta.servlet.http.HttpServletRequest;
  5. import jakarta.servlet.http.HttpServletResponse;
  6. import org.springframework.security.authentication.AuthenticationManager;
  7. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  8. import org.springframework.security.core.Authentication;
  9. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  10. import org.springframework.security.core.context.SecurityContextHolder;
  11. import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
  12. import org.springframework.util.StringUtils;
  14. import java.io.IOException;
  15. import java.util.Collections;
  17. /**
  18.  * @Description: 自定义token验证过滤器，验证成功后将用户信息放入SecurityContext上下文
  19.  * @Author: 翰戈.summer
  20.  * @Date: 2023/11/18
  21.  * @Param:
  22.  * @Return:
  23.  */
  24. public class JwtAuthenticationFilter extends BasicAuthenticationFilter {
  26.     public JwtAuthenticationFilter(AuthenticationManager authenticationManager) {
  27.         super(authenticationManager);
  28.     }
  30.     @Override
  31.     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException {
  32.         try {
  33.             //获取请求头中的token
  34.             String jwtToken = request.getHeader("token");
  35.             if (!StringUtils.hasLength(jwtToken)) {
  36.                 //token不存在，交给其他过滤器处理
  37.                 filterChain.doFilter(request, response);
  38.                 return; //结束方法
  39.             }
  41.             //过滤器中无法初始化Bean组件，使用上下文获取
  42.             JwtUtils jwtUtils = SpringContextUtils.getBean("jwtUtils");
  43.             if (jwtUtils == null) {
  44.                 throw new RuntimeException();
  45.             }
  47.             //解析jwt令牌
  48.             Claims claims;
  49.             try {
  50.                 claims = jwtUtils.parseJwt(jwtToken);
  51.             } catch (Exception ex) {
  52.                 throw new RuntimeException();
  53.             }
  55.             //获取用户信息
  56.             String username = (String) claims.get("username"); //用户名
  57.             String authorityString = (String) claims.get("authorityString"); //权限信息
  59.             Authentication authentication = new UsernamePasswordAuthenticationToken(
  60.                     username, null,
  61.                     Collections.singleton(new SimpleGrantedAuthority(authorityString))
  62.             );
  64.             //将用户信息放入SecurityContext上下文
  65.             SecurityContextHolder.getContext().setAuthentication(authentication);
  67.             filterChain.doFilter(request, response);
  68.         } catch (Exception ex) {
  69.             //过滤器中抛出的异常无法被全局异常处理器捕获，直接返回错误结果
  70.             response.setCharacterEncoding("utf-8");
  71.             response.setContentType("application/json; charset=utf-8");
  72.             String value = new ObjectMapper().writeValueAsString(Result.error("用户未登录！"));
  73.             response.getWriter().write(value);
  74.         }
  75.     }
  76. }

  • SpringContextUtils工具类

  1. import jakarta.annotation.Nonnull;
  2. import org.springframework.beans.BeansException;
  3. import org.springframework.context.ApplicationContext;
  4. import org.springframework.context.ApplicationContextAware;
  5. import org.springframework.stereotype.Component;
  7. /**
  8.  * @Description: 用于创建上下文，实现ApplicationContextAware接口
  9.  * @Author: 翰戈.summer
  10.  * @Date: 2023/11/17
  11.  * @Param:
  12.  * @Return:
  13.  */
  14. @Component
  15. public class SpringContextUtils implements ApplicationContextAware {
  17.     private static ApplicationContext applicationContext;
  19.     public static ApplicationContext getApplicationContext() {
  20.         return applicationContext;
  21.     }
  23.     @Override
  24.     public void setApplicationContext(@Nonnull ApplicationContext applicationContext) throws BeansException {
  25.         SpringContextUtils.applicationContext = applicationContext;
  26.     }
  28.     @SuppressWarnings("unchecked")
  29.     public static <T> T getBean(String name) throws BeansException {
  30.         if (applicationContext == null) {
  31.             return null;
  32.         }
  33.         return (T) applicationContext.getBean(name);
  34.     }
  35. }

  • 添加自定义token验证过滤器

将自定义token验证过滤器，添加到UsernamePasswordAuthenticationFilter前面。

UsernamePasswordAuthenticationFilter实现了基于用户名和密码的认证逻辑，我们利用token进行身份验证，所以用不到这个过滤器。

  1.     /**
  2.      * @Description: 配置SecurityFilterChain过滤器链
  3.      * @Author: 翰戈.summer
  4.      * @Date: 2023/11/17
  5.      * @Param: HttpSecurity
  6.      * @Return: SecurityFilterChain
  7.      */
  8.     @Bean
  9.     public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity httpSecurity) throws Exception {
  10.         httpSecurity.authorizeHttpRequests(authorizeHttpRequests -> authorizeHttpRequests
  11.                 .requestMatchers(HttpMethod.POST, "/api/user/login").permitAll() //登录放行
  12.                 .anyRequest().authenticated()
  13.         );
  14.         httpSecurity.authenticationProvider(authenticationProvider());
  16.         //禁用登录页面
  17.         httpSecurity.formLogin(AbstractHttpConfigurer::disable);
  18.         //禁用登出页面
  19.         httpSecurity.logout(AbstractHttpConfigurer::disable);
  20.         //禁用session
  21.         httpSecurity.sessionManagement(AbstractHttpConfigurer::disable);
  22.         //禁用httpBasic
  23.         httpSecurity.httpBasic(AbstractHttpConfigurer::disable);
  24.         //禁用csrf保护
  25.         httpSecurity.csrf(AbstractHttpConfigurer::disable);
  27.         //通过上下文获取AuthenticationManager
  28.         AuthenticationManager authenticationManager = SpringContextUtils.getBean("authenticationManager");
  29.         //添加自定义token验证过滤器
  30.         httpSecurity.addFilterBefore(new JwtAuthenticationFilter(authenticationManager), UsernamePasswordAuthenticationFilter.class);
  32.         return httpSecurity.build();
  33.     }

  • 自定义用户未登录的处理

用户请求未携带token的处理，替换AuthenticationEntryPoint

  1. import com.fasterxml.jackson.databind.ObjectMapper;
  2. import jakarta.servlet.http.HttpServletRequest;
  3. import jakarta.servlet.http.HttpServletResponse;
  4. import org.springframework.security.core.AuthenticationException;
  5. import org.springframework.security.web.AuthenticationEntryPoint;
  6. import org.springframework.stereotype.Component;
  8. import java.io.IOException;
  10. /**
  11.  * @Description: 自定义用户未登录的处理（未携带token）
  12.  * @Author: 翰戈.summer
  13.  * @Date: 2023/11/19
  14.  * @Param:
  15.  * @Return:
  16.  */
  17. @Component
  18. public class AuthEntryPointHandler implements AuthenticationEntryPoint {
  20.     @Override
  21.     public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
  22.         response.setCharacterEncoding("utf-8");
  23.         response.setContentType("application/json; charset=utf-8");
  24.         String value = new ObjectMapper().writeValueAsString(Result.error("未携带token！"));
  25.         response.getWriter().write(value);
  26.     }
  27. }

  • 自定义用户权限不足的处理

用户权限不足的处理，替换AccessDeniedHandler

  1. import com.fasterxml.jackson.databind.ObjectMapper;
  2. import jakarta.servlet.http.HttpServletRequest;
  3. import jakarta.servlet.http.HttpServletResponse;
  4. import org.springframework.security.access.AccessDeniedException;
  5. import org.springframework.security.web.access.AccessDeniedHandler;
  6. import org.springframework.stereotype.Component;
  8. import java.io.IOException;
  10. /**
  11.  * @Description: 自定义用户权限不足的处理
  12.  * @Author: 翰戈.summer
  13.  * @Date: 2023/11/19
  14.  * @Param:
  15.  * @Return:
  16.  */
  17. @Component
  18. public class AuthAccessDeniedHandler implements AccessDeniedHandler {
  20.     @Override
  21.     public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException {
  22.         response.setCharacterEncoding("utf-8");
  23.         response.setContentType("application/json; charset=utf-8");
  24.         String value = new ObjectMapper().writeValueAsString(Result.error("权限不足！"));
  25.         response.getWriter().write(value);
  26.     }
  27. }

  • 添加自定义处理器

修改 SecurityConfig 配置类，注入 AuthAccessDeniedHandler 和 AuthEntryPointHandler

  1.     /**
  2.      * @Description: 配置SecurityFilterChain过滤器链
  3.      * @Author: 翰戈.summer
  4.      * @Date: 2023/11/17
  5.      * @Param: HttpSecurity
  6.      * @Return: SecurityFilterChain
  7.      */
  8.     @Bean
  9.     public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity httpSecurity) throws Exception {
  10.         httpSecurity.authorizeHttpRequests(authorizeHttpRequests -> authorizeHttpRequests
  11.                 .requestMatchers(HttpMethod.POST, "/api/user/login").permitAll() //登录放行
  12.                 .anyRequest().authenticated()
  13.         );
  14.         httpSecurity.authenticationProvider(authenticationProvider());
  16.         //禁用登录页面
  17.         httpSecurity.formLogin(AbstractHttpConfigurer::disable);
  18.         //禁用登出页面
  19.         httpSecurity.logout(AbstractHttpConfigurer::disable);
  20.         //禁用session
  21.         httpSecurity.sessionManagement(AbstractHttpConfigurer::disable);
  22.         //禁用httpBasic
  23.         httpSecurity.httpBasic(AbstractHttpConfigurer::disable);
  24.         //禁用csrf保护
  25.         httpSecurity.csrf(AbstractHttpConfigurer::disable);
  27.         //通过上下文获取AuthenticationManager
  28.         AuthenticationManager authenticationManager = SpringContextUtils.getBean("authenticationManager");
  29.         //添加自定义token验证过滤器
  30.         httpSecurity.addFilterBefore(new JwtAuthenticationFilter(authenticationManager), UsernamePasswordAuthenticationFilter.class);
  32.         //自定义处理器
  33.         httpSecurity.exceptionHandling(exceptionHandling -> exceptionHandling
  34.                 .accessDeniedHandler(authAccessDeniedHandler) //处理用户权限不足
  35.                 .authenticationEntryPoint(authEntryPointHandler) //处理用户未登录（未携带token）
  36.         );
  38.         return httpSecurity.build();
  39.     }

  • 静态资源放行

SpringBoot3 中使用 Swagger3 接口文档，在整合了 SpringSecurity 后会出现无法访问的情况，需要给静态资源放行。

在 SecurityConfig 中添加

  1.     /**
  2.      * 静态资源放行
  3.      */
  4.     @Bean
  5.     public WebSecurityCustomizer webSecurityCustomizer() {
  6.         return (web) -> web.ignoring().requestMatchers(
  7.                 "/doc.html",
  8.                 "/doc.html/**",
  9.                 "/v3/api-docs",
  10.                 "/v3/api-docs/**",
  11.                 "/webjars/**",
  12.                 "/authenticate",
  13.                 "/swagger-ui.html/**",
  14.                 "/swagger-resources",
  15.                 "/swagger-resources/**"
  16.         );
  17.     }

  • 总结

SpringSecurity6 的用法和以前版本的有较大差别，比如WebSecurityConfigurerAdapter的废除，看到配置类继承了这个的都是过时的教程。因为不再继承，所以不能通过重写方法的方式去配置。另外很多配置的方式都变成使用Lambda表达式，或者是方法引用。

创作不易，如果对你有帮助的话就点个赞鼓励一下吧 (人 •͈ᴗ•͈) (୨୧•͈ᴗ•͈)◞ᵗʱᵃᵑᵏઽ*♡

标签： spring security spring boot java
本文转载自: https://blog.csdn.net/qq_74312711/article/details/134558633
版权归原作者 翰戈.summer 所有， 如有侵权，请联系我们删除。
登录后发布评论

“SpringBoot3 + SpringSecurity6 前后端分离”的评论:

还没有评论
关于作者
...
overfit同步小助手
文章同步
相关阅读

网络安全法-网络运行安全

使用selenium/drissionpage时如何阻止chrome自动跳转http到https

docker desktop 里部署的Open WebUI 管理员密码忘记了的处理方法

在ubuntu20.04中搭建onsite比赛运行环境

利用开源的低代码表单设计器FcDesigner高效管理和渲染复杂表单结构

Kafka学习笔记

【前端】浏览器输入url到页面呈现发生了什么？

文章导航
没有找到文章内容分段。。。