|
@@ -118,16 +118,16 @@ public class YudaoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdap
|
|
|
httpSecurity
|
|
|
// ①:全局共享规则
|
|
|
.authorizeRequests()
|
|
|
- // 静态资源,可匿名访问
|
|
|
+ // 1.1 静态资源,可匿名访问
|
|
|
.antMatchers(HttpMethod.GET, "/*.html", "/**/*.html", "/**/*.css", "/**/*.js").permitAll()
|
|
|
- // 设置 @PermitAll 无需认证
|
|
|
+ // 1.2 设置 @PermitAll 无需认证
|
|
|
.antMatchers(HttpMethod.GET, permitAllUrls.get(HttpMethod.GET).toArray(new String[0])).permitAll()
|
|
|
.antMatchers(HttpMethod.POST, permitAllUrls.get(HttpMethod.POST).toArray(new String[0])).permitAll()
|
|
|
.antMatchers(HttpMethod.PUT, permitAllUrls.get(HttpMethod.PUT).toArray(new String[0])).permitAll()
|
|
|
.antMatchers(HttpMethod.DELETE, permitAllUrls.get(HttpMethod.DELETE).toArray(new String[0])).permitAll()
|
|
|
- // 基于 yudao.security.permit-all-urls 无需认证
|
|
|
+ // 1.3 基于 yudao.security.permit-all-urls 无需认证
|
|
|
.antMatchers(securityProperties.getPermitAllUrls().toArray(new String[0])).permitAll()
|
|
|
- // 设置 App API 无需认证
|
|
|
+ // 1.4 设置 App API 无需认证
|
|
|
.antMatchers(buildAppApi("/**")).permitAll()
|
|
|
// ②:每个项目的自定义规则
|
|
|
.and().authorizeRequests(registry -> // 下面,循环设置自定义规则
|
|
@@ -137,7 +137,7 @@ public class YudaoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdap
|
|
|
.anyRequest().authenticated()
|
|
|
;
|
|
|
|
|
|
- // 添加 JWT Filter
|
|
|
+ // 添加 Token Filter
|
|
|
httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
|
|
|
}
|
|
|
|