|
@@ -3,6 +3,7 @@ package edu.math.diagnosis.config;
|
|
|
import edu.math.diagnosis.entity.UserInfo;
|
|
|
import edu.math.diagnosis.model.AuthUser;
|
|
|
import edu.math.diagnosis.service.UserService;
|
|
|
+import edu.math.diagnosis.util.MD5Util;
|
|
|
import org.springframework.beans.factory.annotation.Value;
|
|
|
import org.springframework.context.annotation.Bean;
|
|
|
import org.springframework.context.annotation.Configuration;
|
|
@@ -15,11 +16,14 @@ import org.springframework.security.config.annotation.web.configuration.WebSecur
|
|
|
import org.springframework.security.core.userdetails.UserDetailsService;
|
|
|
import org.springframework.security.core.userdetails.UsernameNotFoundException;
|
|
|
import org.springframework.security.crypto.password.PasswordEncoder;
|
|
|
+import org.springframework.security.web.AuthenticationEntryPoint;
|
|
|
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
|
|
|
+import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
|
|
|
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
|
|
|
+import org.springframework.security.web.util.matcher.RequestMatcher;
|
|
|
|
|
|
import javax.annotation.Resource;
|
|
|
-import java.util.Arrays;
|
|
|
+import javax.servlet.http.HttpServletResponse;
|
|
|
|
|
|
|
|
|
* @AUTHOR: DaiFengWen
|
|
@@ -67,18 +71,38 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
|
|
|
|
|
|
|
|
|
@Bean
|
|
|
- LogoutHandler logoutHandler() {
|
|
|
- return new LogoutHandler();
|
|
|
+ LogoutSuccessHandler logoutSuccessHandler() {
|
|
|
+ return (req, rep, authentication) -> {
|
|
|
+ rep.setCharacterEncoding("UTF-8");
|
|
|
+ rep.setContentType("application/json");
|
|
|
+ rep.getWriter().println("{\"ok\":\"1\",\"msg\":\"注销成功\"}");
|
|
|
+ };
|
|
|
+ }
|
|
|
+
|
|
|
+ @Bean
|
|
|
+ AuthenticationEntryPoint authenticationEntryPoint() {
|
|
|
+ return (request, response, e) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
|
|
|
}
|
|
|
|
|
|
@Bean
|
|
|
- AjaxAuthenticationEntryPoint ajaxAuthenticationEntryPoint() {
|
|
|
- return new AjaxAuthenticationEntryPoint();
|
|
|
+ RequestMatcher requestMatcher() {
|
|
|
+ return request -> "XMLHttpRequest".equals(request.getHeader("X-Requested-With")) ||
|
|
|
+ request.getHeader("Accept") != null && request.getHeader("Accept").contains("application/json");
|
|
|
}
|
|
|
|
|
|
@Bean
|
|
|
PasswordEncoder passwordEncoder() {
|
|
|
- return new Md5PasswordEncoder();
|
|
|
+ return new PasswordEncoder() {
|
|
|
+ @Override
|
|
|
+ public String encode(CharSequence rawPassword) {
|
|
|
+ return MD5Util.INSTANCE.md5((String) rawPassword);
|
|
|
+ }
|
|
|
+
|
|
|
+ @Override
|
|
|
+ public boolean matches(CharSequence rawPassword, String encodedPassword) {
|
|
|
+ return encodedPassword.equals(MD5Util.INSTANCE.md5((String) rawPassword));
|
|
|
+ }
|
|
|
+ };
|
|
|
}
|
|
|
|
|
|
|
|
@@ -92,12 +116,6 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
|
|
|
}
|
|
|
|
|
|
|
|
|
-
|
|
|
- * If subclassed this will potentially override subclass configure(HttpSecurity)
|
|
|
- *
|
|
|
- * @param http
|
|
|
- * @throws Exception
|
|
|
- */
|
|
|
@Override
|
|
|
protected void configure(HttpSecurity http) throws Exception {
|
|
|
http.csrf().disable();
|
|
@@ -115,22 +133,23 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
|
|
|
http.logout()
|
|
|
|
|
|
.logoutUrl(logoutUrl).logoutRequestMatcher(new AntPathRequestMatcher(logoutUrl)).deleteCookies("JSESSIONID")
|
|
|
- .logoutSuccessHandler(logoutHandler());
|
|
|
+ .logoutSuccessHandler(logoutSuccessHandler());
|
|
|
http.sessionManagement().invalidSessionUrl(loginPage);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- http.exceptionHandling().defaultAuthenticationEntryPointFor(ajaxAuthenticationEntryPoint(), new AjaxRequestMatcher());
|
|
|
+ http.exceptionHandling().defaultAuthenticationEntryPointFor(authenticationEntryPoint(), requestMatcher());
|
|
|
super.configure(http);
|
|
|
}
|
|
|
|
|
|
@Override
|
|
|
- public void configure(WebSecurity web) throws Exception {
|
|
|
+ public void configure(WebSecurity web) {
|
|
|
web.ignoring().antMatchers("/resources/**", "/static/**", "/**.js");
|
|
|
web.ignoring().antMatchers(uploadProperties.getUploadPattern());
|
|
|
- web.ignoring().antMatchers("/**/*.js", "/lang/*.json", "/**/*.css", "/**/*.map", "/**/*.png", "/**/*.jpg","/**/*.woff","/**/*.ttf","/*.ico");
|
|
|
+ web.ignoring().antMatchers("/**/*.js", "/lang/*.json", "/**/*.css", "/**/*.map", "/**/*.png",
|
|
|
+ "/**/*.jpg", "/**/*.woff", "/**/*.ttf", "/*.ico");
|
|
|
web.ignoring().antMatchers(permitUrls);
|
|
|
web.ignoring().antMatchers("/open/**");
|
|
|
web.ignoring().antMatchers("/v2/api-docs",
|