BJ_ZTEITS-Developers / parking-cloud-yudao

Commit 809d6aaa9426ef20dc964dd3ec6512051f2048d9

Authored by YunaiV
1 parent 6d439886

fix（security）：禁用 TokenAuthenticationFilter 的 Servlet 全局注册 

通过 FilterRegistrationBean#setEnabled(false) 避免多 SecurityFilterChain 场景下过滤器越界处理请求，并关联 Issue #1198。
Inline Side-by-side
Showing 1 changed file with 14 additions and 0 deletions
yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/config/YudaoSecurityAutoConfiguration.java
  View file @809d6aa
... ... @@ -14,6 +14,7 @@ import org.springframework.beans.factory.config.MethodInvokingFactoryBean;
14 14 import org.springframework.boot.autoconfigure.AutoConfiguration;
15 15 import org.springframework.boot.autoconfigure.AutoConfigureOrder;
16 16 import org.springframework.boot.context.properties.EnableConfigurationProperties;
  17 +import org.springframework.boot.web.servlet.FilterRegistrationBean;
17 18 import org.springframework.context.annotation.Bean;
18 19 import org.springframework.security.core.context.SecurityContextHolder;
19 20 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
... ... @@ -73,6 +74,19 @@ public class YudaoSecurityAutoConfiguration {
73 74 return new TokenAuthenticationFilter(securityProperties, globalExceptionHandler, oauth2TokenApi);
74 75 }
75 76  
  77 + /**
  78 + * Token 过滤器由 Spring Security FilterChain 管理，禁止 Spring Boot 再注册为 Servlet 全局 Filter
  79 + *
  80 + * @see <a href="https://github.com/YunaiV/ruoyi-vue-pro/issues/1198">Issue #1198</a>
  81 + */
  82 + @Bean
  83 + public FilterRegistrationBean<TokenAuthenticationFilter> tokenAuthenticationFilterRegistration(
  84 + TokenAuthenticationFilter filter) {
  85 + FilterRegistrationBean<TokenAuthenticationFilter> registration = new FilterRegistrationBean<>(filter);
  86 + registration.setEnabled(false);
  87 + return registration;
  88 + }
  89 +
76 90 @Bean("ss") // 使用 Spring Security 的缩写，方便使用
77 91 public SecurityFrameworkService securityFrameworkService(PermissionCommonApi permissionApi) {
78 92 return new SecurityFrameworkServiceImpl(permissionApi);
... ...