SpringBoot--配置多个HttpSecurity

╰+攻爆jí腚メ 2021-08-24 14:23 466阅读 0赞

### 配置多个HttpSecurity ###

如果业务比较复杂，开发者也可以配置多个HttpSecurity，实现对WebSecurityConfigurerAdapter的多次扩展：

@Configuration
    public class MultiHttpSecurityConfig { 
        
        @Bean
        PasswordEncoder passwordEncoder(){ 
            return NoOpPasswordEncoder.getInstance();
        }
        
        @Autowired
        protected void configure(AuthenticationManagerBuilder auth) throws Exception{ 
            auth.inMemoryAuthentication()
                    .withUser("admin").password("123").roles("ADMIN", "USER")
                    .and()
                    .withUser("sang").password("123").roles("USER");
        }
        
        @Configuration
        @Order(1)
        public static class AdminSecurityConfig extends WebSecurityConfigurerAdapter{ 
            @Override
            protected void configure(HttpSecurity http) throws Exception { 
                http.antMatcher("/admin/**").authorizeRequests()
                        .anyRequest().hasRole("ADMIN");
            }
        }
    
        @Configuration
        public static class OtherSecurityConfig extends WebSecurityConfigurerAdapter{ 
            @Override
            protected void configure(HttpSecurity http) throws Exception { 
                http.authorizeRequests()
                        .anyRequest().authenticated()
                        .and()
                        .formLogin()
                        .loginProcessingUrl("/login")
                        .permitAll()
                        .and()
                        .csrf()
                        .disable();
            }
        }
        
    }

配置多个HttpSecurity时，MultiHttpSecurityConfig不需要继承WebSecurityConfigurerAdapter，在MultiHttpSecurityConfig中创建内部类继承WebSecurityConfigurerAdapter即可，静态内部类上添加@Configuration注解和Order注解，@Order注解表示该配置的优先级，数字越小优先级越大，未加@Order注解的配置优先级最小。