|
|
@@ -1,6 +1,8 @@
|
|
1
|
1
|
package com.ruoyi.framework.config;
|
|
2
|
2
|
|
|
|
3
|
+
|
|
3
|
4
|
import org.springframework.beans.factory.annotation.Autowired;
|
|
|
5
|
+import org.springframework.beans.factory.annotation.Value;
|
|
4
|
6
|
import org.springframework.context.annotation.Bean;
|
|
5
|
7
|
import org.springframework.context.annotation.Configuration;
|
|
6
|
8
|
import org.springframework.http.HttpMethod;
|
|
|
@@ -24,6 +26,8 @@ import com.ruoyi.framework.security.filter.JwtAuthenticationTokenFilter;
|
|
24
|
26
|
import com.ruoyi.framework.security.handle.AuthenticationEntryPointImpl;
|
|
25
|
27
|
import com.ruoyi.framework.security.handle.LogoutSuccessHandlerImpl;
|
|
26
|
28
|
|
|
|
29
|
+import java.util.List;
|
|
|
30
|
+
|
|
27
|
31
|
/**
|
|
28
|
32
|
* spring security配置
|
|
29
|
33
|
*
|
|
|
@@ -60,9 +64,11 @@ public class SecurityConfig
|
|
60
|
64
|
/**
|
|
61
|
65
|
* 跨域过滤器
|
|
62
|
66
|
*/
|
|
63
|
|
- @Autowired
|
|
64
|
|
- private CorsFilter corsFilter;
|
|
65
|
|
-
|
|
|
67
|
+ //@Autowired
|
|
|
68
|
+ //private CorsFilter corsFilter;
|
|
|
69
|
+// 代码中读取配置
|
|
|
70
|
+ @Value("${cors.allowed-origins}")
|
|
|
71
|
+ private List<String> allowedOrigins;
|
|
66
|
72
|
/**
|
|
67
|
73
|
* 允许匿名访问的地址
|
|
68
|
74
|
*/
|
|
|
@@ -104,7 +110,10 @@ public class SecurityConfig
|
|
104
|
110
|
permitAllUrl.getUrls().add("/ad/**");
|
|
105
|
111
|
permitAllUrl.getUrls().add("/swagger-ui/**");
|
|
106
|
112
|
permitAllUrl.getUrls().add("/v3/api-docs/**");
|
|
107
|
|
-
|
|
|
113
|
+ // 确保登录相关接口也在白名单
|
|
|
114
|
+ permitAllUrl.getUrls().add("/login");
|
|
|
115
|
+ permitAllUrl.getUrls().add("/register");
|
|
|
116
|
+ permitAllUrl.getUrls().add("/captchaImage");
|
|
108
|
117
|
http
|
|
109
|
118
|
// 禁用CSRF
|
|
110
|
119
|
.csrf(csrf -> csrf.disable())
|
|
|
@@ -147,7 +156,8 @@ public class SecurityConfig
|
|
147
|
156
|
// 添加JWT过滤器
|
|
148
|
157
|
.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
|
|
149
|
158
|
// 添加CORS过滤器
|
|
150
|
|
- .addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
|
|
|
159
|
+ //.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class)
|
|
|
160
|
+ ;
|
|
151
|
161
|
|
|
152
|
162
|
return http.build();
|
|
153
|
163
|
}
|
|
|
@@ -155,7 +165,9 @@ public class SecurityConfig
|
|
155
|
165
|
// CORS配置
|
|
156
|
166
|
private CorsConfigurationSource corsConfigurationSource() {
|
|
157
|
167
|
CorsConfiguration configuration = new CorsConfiguration();
|
|
158
|
|
- configuration.addAllowedOrigin("*"); // 允许所有来源
|
|
|
168
|
+ configuration.setAllowedOriginPatterns(allowedOrigins);
|
|
|
169
|
+ //configuration.addAllowedOriginPattern("http://localhost:9090"); // 前端地址
|
|
|
170
|
+ //configuration.addAllowedOrigin("*"); // 允许所有来源
|
|
159
|
171
|
configuration.addAllowedMethod("*"); // 允许所有方法
|
|
160
|
172
|
configuration.addAllowedHeader("*"); // 允许所有头部
|
|
161
|
173
|
configuration.setAllowCredentials(true); // 允许凭证
|