diff --git a/devttl-common/src/main/java/com/devttl/common/constant/Constants.java b/devttl-common/src/main/java/com/devttl/common/constant/Constants.java index 6bc78da..1d74eac 100644 --- a/devttl-common/src/main/java/com/devttl/common/constant/Constants.java +++ b/devttl-common/src/main/java/com/devttl/common/constant/Constants.java @@ -1,8 +1,9 @@ package com.devttl.common.constant; -import java.util.Locale; import io.jsonwebtoken.Claims; +import java.util.Locale; + /** * 通用常量信息 * @@ -158,7 +159,7 @@ public class Constants /** * 自动识别json对象白名单配置（仅允许解析的包名，范围越小越安全） */ - public static final String[] JSON_WHITELIST_STR = { "org.springframework", "com.devttl" }; + public static final String[] JSON_WHITELIST_STR = { "com.devttl" }; /** * 定时任务白名单配置（仅允许访问的包名，如其他需要可以自行添加） diff --git a/devttl-common/src/main/java/com/devttl/common/utils/DateUtils.java b/devttl-common/src/main/java/com/devttl/common/utils/DateUtils.java index 8e58541..e9bd8c0 100644 --- a/devttl-common/src/main/java/com/devttl/common/utils/DateUtils.java +++ b/devttl-common/src/main/java/com/devttl/common/utils/DateUtils.java @@ -16,6 +16,7 @@ import org.apache.commons.lang3.time.DateFormatUtils; * * @author devttl */ +@SuppressWarnings("deprecation") public class DateUtils extends org.apache.commons.lang3.time.DateUtils { public static String YYYY = "yyyy"; diff --git a/devttl-common/src/main/java/com/devttl/common/utils/StringUtils.java b/devttl-common/src/main/java/com/devttl/common/utils/StringUtils.java index e85cb87..a9bf7b1 100644 --- a/devttl-common/src/main/java/com/devttl/common/utils/StringUtils.java +++ b/devttl-common/src/main/java/com/devttl/common/utils/StringUtils.java @@ -15,6 +15,7 @@ import com.devttl.common.core.text.StrFormatter; * * @author devttl */ +@SuppressWarnings("deprecation") public class StringUtils extends org.apache.commons.lang3.StringUtils { /** 空字符串 */ diff --git a/devttl-framework/src/main/java/com/devttl/framework/config/SecurityConfig.java b/devttl-framework/src/main/java/com/devttl/framework/config/SecurityConfig.java index 27534c5..b961613 100644 --- a/devttl-framework/src/main/java/com/devttl/framework/config/SecurityConfig.java +++ b/devttl-framework/src/main/java/com/devttl/framework/config/SecurityConfig.java @@ -1,41 +1,33 @@ package com.devttl.framework.config; +import com.devttl.framework.config.properties.PermitAllUrlProperties; +import com.devttl.framework.security.filter.JwtAuthenticationTokenFilter; +import com.devttl.framework.security.handle.AuthenticationEntryPointImpl; +import com.devttl.framework.security.handle.LogoutSuccessHandlerImpl; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpMethod; import org.springframework.security.authentication.AuthenticationManager; -import org.springframework.security.authentication.ProviderManager; -import org.springframework.security.authentication.dao.DaoAuthenticationProvider; +import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration; import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.http.SessionCreationPolicy; -import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import org.springframework.security.web.authentication.logout.LogoutFilter; import org.springframework.web.filter.CorsFilter; -import com.devttl.framework.config.properties.PermitAllUrlProperties; -import com.devttl.framework.security.filter.JwtAuthenticationTokenFilter; -import com.devttl.framework.security.handle.AuthenticationEntryPointImpl; -import com.devttl.framework.security.handle.LogoutSuccessHandlerImpl; /** * spring security配置 - * + * * @author devttl */ @EnableMethodSecurity(prePostEnabled = true, securedEnabled = true) @Configuration -public class SecurityConfig -{ - /** - * 自定义用户认证逻辑 - */ - @Autowired - private UserDetailsService userDetailsService; - +public class SecurityConfig { + /** * 认证失败处理类 */ @@ -53,7 +45,7 @@ public class SecurityConfig */ @Autowired private JwtAuthenticationTokenFilter authenticationTokenFilter; - + /** * 跨域过滤器 */ @@ -70,12 +62,8 @@ public class SecurityConfig * 身份验证实现 */ @Bean - public AuthenticationManager authenticationManager() - { - DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider(); - daoAuthenticationProvider.setUserDetailsService(userDetailsService); - daoAuthenticationProvider.setPasswordEncoder(bCryptPasswordEncoder()); - return new ProviderManager(daoAuthenticationProvider); + public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception { + return authenticationConfiguration.getAuthenticationManager(); } /** @@ -94,46 +82,44 @@ public class SecurityConfig * authenticated | 用户登录后可访问 */ @Bean - protected SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception - { + protected SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception { return httpSecurity - // CSRF禁用，因为不使用session - .csrf(csrf -> csrf.disable()) - // 禁用HTTP响应标头 - .headers((headersCustomizer) -> { - headersCustomizer.cacheControl(cache -> cache.disable()).frameOptions(options -> options.sameOrigin()); - }) - // 认证失败处理类 - .exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler)) - // 基于token，所以不需要session - .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) - // 注解标记允许匿名访问的url - .authorizeHttpRequests((requests) -> { - permitAllUrl.getUrls().forEach(url -> requests.requestMatchers(url).permitAll()); - // 对于登录login 注册register 验证码captchaImage 允许匿名访问 - requests.requestMatchers("/login", "/register", "/captchaImage").permitAll() - // 静态资源，可匿名访问 - .requestMatchers(HttpMethod.GET, "/", "/*.html", "/**.html", "/**.css", "/**.js", "/profile/**").permitAll() - .requestMatchers("/swagger-ui.html", "/v3/api-docs/**", "/swagger-ui/**", "/druid/**").permitAll() - // 除上面外的所有请求全部需要鉴权认证 - .anyRequest().authenticated(); - }) - // 添加Logout filter - .logout(logout -> logout.logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler)) - // 添加JWT filter - .addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class) - // 添加CORS filter - .addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class) - .addFilterBefore(corsFilter, LogoutFilter.class) - .build(); + // CSRF禁用，因为不使用session + .csrf(csrf -> csrf.disable()) + // 禁用HTTP响应标头 + .headers((headersCustomizer) -> { + headersCustomizer.cacheControl(cache -> cache.disable()).frameOptions(options -> options.sameOrigin()); + }) + // 认证失败处理类 + .exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler)) + // 基于token，所以不需要session + .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) + // 注解标记允许匿名访问的url + .authorizeHttpRequests((requests) -> { + permitAllUrl.getUrls().forEach(url -> requests.requestMatchers(url).permitAll()); + // 对于登录login 注册register 验证码captchaImage 允许匿名访问 + requests.requestMatchers("/login", "/register", "/captchaImage").permitAll() + // 静态资源，可匿名访问 + .requestMatchers(HttpMethod.GET, "/", "/*.html", "/**.html", "/**.css", "/**.js", "/profile/**").permitAll() + .requestMatchers("/swagger-ui.html", "/v3/api-docs/**", "/swagger-ui/**", "/druid/**").permitAll() + // 除上面外的所有请求全部需要鉴权认证 + .anyRequest().authenticated(); + }) + // 添加Logout filter + .logout(logout -> logout.logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler)) + // 添加JWT filter + .addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class) + // 添加CORS filter + .addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class) + .addFilterBefore(corsFilter, LogoutFilter.class) + .build(); } /** * 强散列哈希加密实现 */ @Bean - public BCryptPasswordEncoder bCryptPasswordEncoder() - { + public BCryptPasswordEncoder bCryptPasswordEncoder() { return new BCryptPasswordEncoder(); } } diff --git a/pom.xml b/pom.xml index 9ca0f03..a8b97a5 100644 --- a/pom.xml +++ b/pom.xml @@ -20,14 +20,14 @@ 3.5.16 3.5.12 3.5.12 - 3.0.3 + 3.0.4 1.2.23 1.21 3.0.0 2.3.3 - 2.1.0 + 2.1.1 2.0.57 - 6.8.1 + 6.8.2 2.19.0 4.1.2 2.3 @@ -35,7 +35,7 @@ 8.2.0 2.3.1 6.0.0 - 2.6.0 + 2.8.9 @@ -46,7 +46,7 @@ org.springframework.boot spring-boot-dependencies - 3.3.5 + 3.5.4 pom import