你好,我有一个使用Sping Boot 3.1.1开发的应用程序。我的Spring安全配置在Sping Boot 3.0.6中工作得很好,但现在不再工作了。很多东西都贬值了。“.and().build()",“csrf()",“authorizeHttpRequests()",“sessionManagement()”已被弃用并标记为删除,有哪些替代品?下面是我的代码。
@Configuration
@EnableWebSecurity
public class SecurityConfig {
private static final String ADMIN = "ADMIN";
private static final String USER = "USER";
@Autowired
private AuthenticationManager authenticationManager;
@Bean
public AuthenticationManager authManager(HttpSecurity http, BCryptPasswordEncoder bCryptPasswordEncoder,
UserDetailsService userDetailsService)
throws Exception {
return http.getSharedObject(AuthenticationManagerBuilder.class)
.userDetailsService(userDetailsService)
.passwordEncoder(bCryptPasswordEncoder)
.and()
.build();
}
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.csrf().disable()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
.cors().configurationSource(request -> {
CorsConfiguration config = new CorsConfiguration();
config.setAllowedOrigins(Collections.singletonList("http://localhost:4200"));
config.setAllowedMethods(Collections.singletonList("*"));
config.setAllowCredentials(true);
config.setAllowedHeaders(Collections.singletonList("*"));
config.setExposedHeaders(List.of("Authorization"));
config.setMaxAge(3600L);
return config;
}).and()
.authorizeHttpRequests()
.requestMatchers("/login").permitAll()
.requestMatchers(HttpMethod.GET, "/api/v1/list/**").permitAll()
.requestMatchers(HttpMethod.DELETE, "/api/v1/delete/**").hasAuthority(ADMIN)
.requestMatchers(HttpMethod.PUT, "/api/v1/update/**").hasAuthority(ADMIN)
.requestMatchers(HttpMethod.GET, "/api/v1/get/**").hasAnyAuthority(ADMIN, USER)
.anyRequest().authenticated().and()
.addFilterBefore(new JWTAuthenticationFilter(authenticationManager), UsernamePasswordAuthenticationFilter.class)
.addFilterBefore(new JWTAuthorizationFilter(),UsernamePasswordAuthenticationFilter.class);
return http.build();
}
}
字符串
1条答案
按热度按时间daupos2t1#
符合文档,您可以通过使用
DSL
来做您想做的事情您当前的impl看起来是这样的:
字符串