93 lines
2.8 KiB
Java
93 lines
2.8 KiB
Java
package com.emotion.config;
|
|
|
|
import org.springframework.context.annotation.Bean;
|
|
import org.springframework.context.annotation.Configuration;
|
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
|
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
|
import org.springframework.security.config.http.SessionCreationPolicy;
|
|
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
|
|
import org.springframework.security.crypto.password.PasswordEncoder;
|
|
import org.springframework.security.web.SecurityFilterChain;
|
|
import org.springframework.web.cors.CorsConfiguration;
|
|
import org.springframework.web.cors.CorsConfigurationSource;
|
|
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
|
|
|
|
import java.util.Arrays;
|
|
|
|
/**
|
|
* 安全配置
|
|
*
|
|
* @author huazhongmin
|
|
* @date 2025-07-22
|
|
*/
|
|
@Configuration
|
|
@EnableWebSecurity
|
|
public class SecurityConfig {
|
|
|
|
/**
|
|
* 密码编码器
|
|
*/
|
|
@Bean
|
|
public PasswordEncoder passwordEncoder() {
|
|
return new BCryptPasswordEncoder();
|
|
}
|
|
|
|
/**
|
|
* 安全过滤器链
|
|
*/
|
|
@Bean
|
|
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
|
|
http
|
|
// 禁用CSRF
|
|
.csrf(csrf -> csrf.disable())
|
|
|
|
// 配置CORS
|
|
.cors(cors -> cors.configurationSource(corsConfigurationSource()))
|
|
|
|
// 配置会话管理
|
|
.sessionManagement(management -> management
|
|
.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
|
|
|
|
// 配置授权规则
|
|
.authorizeHttpRequests(authz -> authz
|
|
// 允许所有请求（简化配置）
|
|
.anyRequest().permitAll())
|
|
|
|
// 禁用默认登录页面
|
|
.formLogin(login -> login.disable())
|
|
|
|
// 禁用HTTP Basic认证
|
|
.httpBasic(basic -> basic.disable());
|
|
|
|
return http.build();
|
|
}
|
|
|
|
/**
|
|
* CORS配置
|
|
*/
|
|
@Bean
|
|
public CorsConfigurationSource corsConfigurationSource() {
|
|
CorsConfiguration configuration = new CorsConfiguration();
|
|
|
|
// 允许所有来源
|
|
configuration.setAllowedOriginPatterns(Arrays.asList("*"));
|
|
|
|
// 允许的HTTP方法
|
|
configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"));
|
|
|
|
// 允许的请求头
|
|
configuration.setAllowedHeaders(Arrays.asList("*"));
|
|
|
|
// 允许携带凭证
|
|
configuration.setAllowCredentials(true);
|
|
|
|
// 预检请求的缓存时间
|
|
configuration.setMaxAge(3600L);
|
|
|
|
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
|
|
source.registerCorsConfiguration("/**", configuration);
|
|
|
|
return source;
|
|
}
|
|
}
|