|
@@ -102,6 +102,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter |
|
@@ -102,6 +102,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter |
|
102
|
httpSecurity
|
102
|
httpSecurity
|
|
103
|
// CSRF禁用,因为不使用session
|
103
|
// CSRF禁用,因为不使用session
|
|
104
|
.csrf().disable()
|
104
|
.csrf().disable()
|
|
|
|
105
|
+ // 禁用HTTP响应标头
|
|
|
|
106
|
+ .headers().cacheControl().disable().and()
|
|
105
|
// 认证失败处理类
|
107
|
// 认证失败处理类
|
|
106
|
.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
|
108
|
.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
|
|
107
|
// 基于token,所以不需要session
|
109
|
// 基于token,所以不需要session
|
|
@@ -109,7 +111,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter |
|
@@ -109,7 +111,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter |
|
109
|
// 过滤请求
|
111
|
// 过滤请求
|
|
110
|
.authorizeRequests()
|
112
|
.authorizeRequests()
|
|
111
|
// 对于登录login 注册register 验证码captchaImage 允许匿名访问
|
113
|
// 对于登录login 注册register 验证码captchaImage 允许匿名访问
|
|
112
|
- .antMatchers("/login", "/register", "/captchaImage").anonymous()
|
114
|
+ .antMatchers("/login", "/register", "/captchaImage").permitAll()
|
|
113
|
// 静态资源,可匿名访问
|
115
|
// 静态资源,可匿名访问
|
|
114
|
.antMatchers(HttpMethod.GET, "/", "/*.html", "/**/*.html", "/**/*.css", "/**/*.js", "/profile/**").permitAll()
|
116
|
.antMatchers(HttpMethod.GET, "/", "/*.html", "/**/*.html", "/**/*.css", "/**/*.js", "/profile/**").permitAll()
|
|
115
|
.antMatchers("/swagger-ui.html", "/swagger-resources/**", "/webjars/**", "/*/api-docs", "/druid/**").permitAll()
|
117
|
.antMatchers("/swagger-ui.html", "/swagger-resources/**", "/webjars/**", "/*/api-docs", "/druid/**").permitAll()
|
|
@@ -124,8 +126,6 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter |
|
@@ -124,8 +126,6 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter |
|
124
|
// 添加CORS filter
|
126
|
// 添加CORS filter
|
|
125
|
httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
|
127
|
httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
|
|
126
|
httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class);
|
128
|
httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class);
|
|
127
|
- // 禁用缓存
|
|
|
|
128
|
- httpSecurity.headers().cacheControl().disable();
|
|
|
|
129
|
}
|
129
|
}
|
|
130
|
|
130
|
|
|
131
|
/**
|
131
|
/**
|