背景

項(xiàng)目中前后端通信時(shí)，有需求權(quán)限認(rèn)證的步驟，這里使用SpringSecurtiy + Jwt 采用token驗(yàn)證的方式完成登錄功能。

步驟

1. 添加配置類

/**
 * Created by Justin on 2017/6/2.
 */

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    // 指定加密方式
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public JwtAuthenticationTokenFilter authenticationTokenFilter() throws Exception {
        return new JwtAuthenticationTokenFilter();
    }

    @Autowired
    public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder
                // 設(shè)置UserDetailsService
                .userDetailsService(this.userDetailsService)
                // 設(shè)置passwordEncoder
                .passwordEncoder(passwordEncoder());
    }

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
                // 由于使用的是JWT，我們這里不需要csrf
                .csrf().disable()

                // 基于token，所以不需要session
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()

                .authorizeRequests()
                .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
//                .antMatchers("/**").permitAll()       // FOR TEST

                // 允許對(duì)于網(wǎng)站靜態(tài)資源的無授權(quán)訪問
                .antMatchers(
                        HttpMethod.GET,
                        "/",
                        "/*.html",
                        "/favicon.ico",
                        "/**/*.html",
                        "/**/*.css",
                        "/**/*.js",
                        "/bower_components/**",
                        "/file/**",
                        "/styles/**"
                ).permitAll()

                // 對(duì)于獲取token的rest api要允許匿名訪問
                .antMatchers("/auth/**").permitAll()

                // 除上面外的所有請(qǐng)求全部需要鑒權(quán)認(rèn)證
                .anyRequest().authenticated();

        // 禁止緩存
        httpSecurity.headers().cacheControl();

        // 添加JWT filter
        httpSecurity
                .addFilterBefore(authenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}

2. 添加配置(build.gradle)

# Token
token.tokenHeader=Authorization
token.tokenHead=Bearer 
token.secret=mySecret
token.initRole=user