BJ_ZTEITS-Developers / parking-cloud-yudao

Commit 809d6aaa9426ef20dc964dd3ec6512051f2048d9

Authored by YunaiV
1 parent 6d439886

fix（security）：禁用 TokenAuthenticationFilter 的 Servlet 全局注册 

通过 FilterRegistrationBean#setEnabled(false) 避免多 SecurityFilterChain 场景下过滤器越界处理请求，并关联 Issue #1198。
Inline Side-by-side
Showing 1 changed file with 14 additions and 0 deletions
yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/config/YudaoSecurityAutoConfiguration.java
  View file @809d6aa
@@ -14,6 +14,7 @@ import org.springframework.beans.factory.config.MethodInvokingFactoryBean; @@ -14,6 +14,7 @@ import org.springframework.beans.factory.config.MethodInvokingFactoryBean;
14 import org.springframework.boot.autoconfigure.AutoConfiguration; 14 import org.springframework.boot.autoconfigure.AutoConfiguration;
15 import org.springframework.boot.autoconfigure.AutoConfigureOrder; 15 import org.springframework.boot.autoconfigure.AutoConfigureOrder;
16 import org.springframework.boot.context.properties.EnableConfigurationProperties; 16 import org.springframework.boot.context.properties.EnableConfigurationProperties;
  17 +import org.springframework.boot.web.servlet.FilterRegistrationBean;
17 import org.springframework.context.annotation.Bean; 18 import org.springframework.context.annotation.Bean;
18 import org.springframework.security.core.context.SecurityContextHolder; 19 import org.springframework.security.core.context.SecurityContextHolder;
19 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; 20 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
@@ -73,6 +74,19 @@ public class YudaoSecurityAutoConfiguration { @@ -73,6 +74,19 @@ public class YudaoSecurityAutoConfiguration {
73 return new TokenAuthenticationFilter(securityProperties, globalExceptionHandler, oauth2TokenApi); 74 return new TokenAuthenticationFilter(securityProperties, globalExceptionHandler, oauth2TokenApi);
74 } 75 }
75 76
  77 + /**
  78 + * Token 过滤器由 Spring Security FilterChain 管理，禁止 Spring Boot 再注册为 Servlet 全局 Filter
  79 + *
  80 + * @see <a href="https://github.com/YunaiV/ruoyi-vue-pro/issues/1198">Issue #1198</a>
  81 + */
  82 + @Bean
  83 + public FilterRegistrationBean<TokenAuthenticationFilter> tokenAuthenticationFilterRegistration(
  84 + TokenAuthenticationFilter filter) {
  85 + FilterRegistrationBean<TokenAuthenticationFilter> registration = new FilterRegistrationBean<>(filter);
  86 + registration.setEnabled(false);
  87 + return registration;
  88 + }
  89 +
76 @Bean("ss") // 使用 Spring Security 的缩写，方便使用 90 @Bean("ss") // 使用 Spring Security 的缩写，方便使用
77 public SecurityFrameworkService securityFrameworkService(PermissionCommonApi permissionApi) { 91 public SecurityFrameworkService securityFrameworkService(PermissionCommonApi permissionApi) {
78 return new SecurityFrameworkServiceImpl(permissionApi); 92 return new SecurityFrameworkServiceImpl(permissionApi);