mirrors/pig
1
0
Fork 0
mirror of https://gitee.com/log4j/pig.git synced 2024-12-31 08:14:18 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Spring Security 6.1 Lambda

Browse Source
This commit is contained in:
TwelveT 2023-05-26 10:34:50 +08:00
parent ff6759e2a5
commit 4aaf739854
4 changed files with 42 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pig-auth/src/main/java/com/pig4cloud/pig/auth/config/WebSecurityConfiguration.java
View File

@ -22,6 +22,9 @@ import org.springframework.context.annotation.Bean;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
import org.springframework.security.config.annotation.web.configurers.RequestCacheConfigurer;
import org.springframework.security.web.SecurityFilterChain;
/**
@ -42,8 +45,10 @@ public class WebSecurityConfiguration {
@Bean
SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(authorizeRequests -> authorizeRequests.requestMatchers("/token/*").permitAll()// 开放自定义的部分端点
.anyRequest().authenticated()).headers().frameOptions().sameOrigin()// 避免iframe同源无法登录
.and().apply(new FormIdentityLoginConfigurer()); // 表单登录个性化
.anyRequest().authenticated()).headers(httpSecurityHeadersConfigurer -> {
// 避免iframe同源无法登录
httpSecurityHeadersConfigurer.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin);
}).apply(new FormIdentityLoginConfigurer()); // 表单登录个性化
// 处理 UsernamePasswordAuthenticationToken
http.authenticationProvider(new PigDaoAuthenticationProvider());
return http.build();
@ -51,7 +56,7 @@ public class WebSecurityConfiguration {
/**
* 暴露静态资源
*
* <p>
* https://github.com/spring-projects/spring-security/issues/10938
* @param http
* @return
@ -61,8 +66,9 @@ public class WebSecurityConfiguration {
@Order(0)
SecurityFilterChain resources(HttpSecurity http) throws Exception {
http.securityMatchers((matchers) -> matchers.requestMatchers("/actuator/**", "/css/**", "/error"))
.authorizeHttpRequests((authorize) -> authorize.anyRequest().permitAll()).requestCache().disable()
.securityContext().disable().sessionManagement().disable();
.authorizeHttpRequests((authorize) -> authorize.anyRequest().permitAll())
.requestCache(RequestCacheConfigurer::disable).securityContext(AbstractHttpConfigurer::disable)
.sessionManagement(AbstractHttpConfigurer::disable);
return http.build();
}

12
pig-auth/src/main/java/com/pig4cloud/pig/auth/support/core/FormIdentityLoginConfigurer.java
View File

@ -8,7 +8,7 @@ import org.springframework.security.config.annotation.web.configurers.AbstractHt
/**
* @author lengleng
* @data 2022-06-04
*
* <p>
* 基于授权码模式 统一认证登录 spring security & sas 都可以使用 所以抽取成 HttpConfigurer
*/
public final class FormIdentityLoginConfigurer
@ -21,9 +21,13 @@ public final class FormIdentityLoginConfigurer
formLogin.loginProcessingUrl("/token/form");
formLogin.failureHandler(new FormAuthenticationFailureHandler());
}).logout() // SSO登出成功处理
.logoutSuccessHandler(new SsoLogoutSuccessHandler()).deleteCookies("JSESSIONID")
.invalidateHttpSession(true).and().csrf().disable();
}).logout(httpSecurityLogoutConfigurer -> {
// SSO登出成功处理
httpSecurityLogoutConfigurer.logoutSuccessHandler(new SsoLogoutSuccessHandler()).deleteCookies("JSESSIONID")
.invalidateHttpSession(true);
}
).csrf(AbstractHttpConfigurer::disable);
}
}

8
pig-common/pig-common-security/src/main/java/com/pig4cloud/pig/common/security/component/PigResourceServerConfiguration.java
View File

@ -24,13 +24,15 @@ import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
import org.springframework.security.web.SecurityFilterChain;
/**
* @author lengleng
* @date 2022-06-04
*
* <p>
* 资源服务器认证授权配置
*/
@Slf4j
@ -57,7 +59,9 @@ public class PigResourceServerConfiguration {
oauth2 -> oauth2.opaqueToken(token -> token.introspector(customOpaqueTokenIntrospector))
.authenticationEntryPoint(resourceAuthExceptionEntryPoint)
.bearerTokenResolver(pigBearerTokenExtractor))
.headers().frameOptions().disable().and().csrf().disable();
.headers(httpSecurityHeadersConfigurer -> httpSecurityHeadersConfigurer
.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable))
.csrf(AbstractHttpConfigurer::disable);
return http.build();
}

19
pig-visual/pig-monitor/src/main/java/com/pig4cloud/pig/monitor/config/WebSecurityConfigurer.java
View File

@ -20,6 +20,8 @@ import de.codecentric.boot.admin.server.config.AdminServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
@ -49,12 +51,21 @@ public class WebSecurityConfigurer {
SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
successHandler.setTargetUrlParameter("redirectTo");
successHandler.setDefaultTargetUrl(adminContextPath + "/");
http.headers().frameOptions().disable().and().authorizeHttpRequests()
http.headers(httpSecurityHeadersConfigurer -> {
httpSecurityHeadersConfigurer.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable);
}).authorizeHttpRequests(authorizationManagerRequestMatcherRegistry -> {
authorizationManagerRequestMatcherRegistry
.requestMatchers(adminContextPath + "/assets/**", adminContextPath + "/login",
adminContextPath + "/instances/**", adminContextPath + "/actuator/**")
.permitAll().anyRequest().authenticated().and().formLogin().loginPage(adminContextPath + "/login")
.successHandler(successHandler).and().logout().logoutUrl(adminContextPath + "/logout").and().httpBasic()
.and().csrf().disable();
.permitAll().anyRequest().authenticated();
}).formLogin(httpSecurityFormLoginConfigurer -> {
httpSecurityFormLoginConfigurer.loginPage(adminContextPath + "/login");
httpSecurityFormLoginConfigurer.successHandler(successHandler);
}).logout(httpSecurityLogoutConfigurer -> {
httpSecurityLogoutConfigurer.logoutUrl(adminContextPath + "/logout");
}).httpBasic(httpSecurityHttpBasicConfigurer -> {
}).csrf(AbstractHttpConfigurer::disable);
return http.build();
}