前后端分离的Web应用程序中使用Spring Security+Mybatis+JWT非对称加密+动态权限管理（三）：跨域配置、安全配置

package com.security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.ApplicationContext;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.ObjectPostProcessor;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.configurers.UrlAuthorizationConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import com.handler.AjaxAccessDeniedHandler;
import com.handler.AjaxAuthenticationEntryPoint;
import com.handler.AjaxAuthenticationSuccessHandler;
import com.handler.AjaxLogoutSuccessHandler;
import com.service.MyUserDetailsService;

@Configuration
public class MySecurityConfig extends WebSecurityConfigurerAdapter{
    @Autowired 
    private MyUserDetailsService myUserDetailsService;
    @Autowired
    private AjaxAuthenticationEntryPoint authenticationEntryPoint;
    @Autowired
    private JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter;
    @Autowired
    private AjaxLogoutSuccessHandler logoutSuccessHandler;
    @Autowired
    private AjaxAccessDeniedHandler accessDeniedHandler;
    @Autowired
    private AjaxAuthenticationSuccessHandler authenticationSuccessHandler;
    @Autowired
    private CustomSecurityMetadataSource customSecurityMetadataSource;
    
    //身份验证的Filter
    @Bean
    LoginFilter loginFilter() throws Exception{
        LoginFilter loginFilter=new LoginFilter();
        loginFilter.setAuthenticationManager(authenticationManagerBean());
        loginFilter.setAuthenticationSuccessHandler(authenticationSuccessHandler);
        return loginFilter;
    }
    
    //选择加密方法Bcrypt方法
    @Bean
    PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {        
        ApplicationContext applicationContext=http.getSharedObject(ApplicationContext.class);
        
        //动态权限资源配置，customSecurityMetadataSource作为配置来源
        http.apply(new UrlAuthorizationConfigurer<>(applicationContext))
        .withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() {
            @Override
            public <O extends FilterSecurityInterceptor> O postProcess(O object) {
                object.setSecurityMetadataSource(customSecurityMetadataSource);
                //object.setRejectPublicInvocations(true); //所要请求路径都要在资源里配置才可访问（包括匿名访问）
                return object;
            }                      
        });
                    
        //无状态登录，取消session
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .httpBasic().authenticationEntryPoint(authenticationEntryPoint) //未登录处理
            .and()
            .authorizeRequests()
            .antMatchers("/login2").permitAll()
            //.anyRequest()
            //使用rbac 角色静态方式绑定资源
            //.access("@rbacauthorityservice.hasPermission(request,authentication)")
            //.and()
            //使用表单登录
            //.formLogin().successHandler(authenticationSuccessHandler).failureHandler(authenticationFailureHandler).permitAll()
            .and()
            .logout().logoutSuccessHandler(logoutSuccessHandler).permitAll()
            .and()
            .csrf().disable();
        
        //勾选“记住我”时
        http.rememberMe().rememberMeParameter("remember-me")
            .userDetailsService(myUserDetailsService).tokenValiditySeconds(300);
        
        //身份验证异常处理
        http.exceptionHandling().accessDeniedHandler(accessDeniedHandler);
        
        //请求资源时，如果带了token令牌，则使用jwt的Authentication进行认证
        http.addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
        
        // 禁用headers缓存
        http.headers().cacheControl();
    }
}