admin/lx-admin-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update 优化 过期的 Security 方法

Browse Source
This commit is contained in:
疯狂的狮子Li 2023-07-28 15:37:49 +08:00
parent e86765c6bc
commit 0c09adfe0a
1 changed files with 21 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
ruoyi-extend/ruoyi-monitor-admin/src/main/java/org/dromara/monitor/admin/config/SecurityConfig.java
View File

@ -3,10 +3,14 @@ package org.dromara.monitor.admin.config;
import de.codecentric.boot.admin.server.config.AdminServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
/**
* admin 监控 安全配置
@ -30,22 +34,22 @@ public class SecurityConfig {
successHandler.setDefaultTargetUrl(adminContextPath + "/");
return httpSecurity
.headers().frameOptions().disable()
.and().authorizeHttpRequests()
.requestMatchers(adminContextPath + "/assets/**"
, adminContextPath + "/login"
, "/actuator"
, "/actuator/**"
.headers((header) ->
header.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable))
.authorizeHttpRequests((authorize) ->
authorize.requestMatchers(
new AntPathRequestMatcher(adminContextPath + "/assets/**"),
new AntPathRequestMatcher(adminContextPath + "/login"),
new AntPathRequestMatcher("/actuator"),
new AntPathRequestMatcher("/actuator/**")
).permitAll()
.anyRequest().authenticated()
.and()
.formLogin().loginPage(adminContextPath + "/login")
.successHandler(successHandler).and()
.logout().logoutUrl(adminContextPath + "/logout")
.and()
.httpBasic().and()
.csrf()
.disable()
.anyRequest().authenticated())
.formLogin((formLogin) ->
formLogin.loginPage(adminContextPath + "/login").successHandler(successHandler))
.logout((logout) ->
logout.logoutUrl(adminContextPath + "/logout"))
.httpBasic(Customizer.withDefaults())
.csrf(AbstractHttpConfigurer::disable)
.build();
}