若依 3.6.8

RuoYi

2026-03-30 63a556bd3a215c7dd081ca59756bc560576c2acc

 ruoyi-visual/ruoyi-monitor/src/main/java/com/ruoyi/modules/monitor/config/WebSecurityConfigurer.java

@@ -1,9 +1,14 @@
package com.ruoyi.modules.monitor.config;



import de.codecentric.boot.admin.server.config.AdminServerProperties;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.Customizer;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;

import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;

import org.springframework.security.web.SecurityFilterChain;

import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;



/**

@@ -11,8 +16,9 @@
 * 

 * @author ruoyi

 */

@EnableWebSecurity

@Configuration

public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter

public class WebSecurityConfigurer

{

    private final String adminContextPath;



@@ -21,29 +27,27 @@
        this.adminContextPath = adminServerProperties.getContextPath();

    }



    @Override

    protected void configure(HttpSecurity http) throws Exception

    @Bean

    public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception

    {

        SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();

        successHandler.setTargetUrlParameter("redirectTo");

        successHandler.setDefaultTargetUrl(adminContextPath + "/");



        http

            .headers().frameOptions().disable()

            .and().authorizeRequests()

            .antMatchers(adminContextPath + "/assets/**"

                , adminContextPath + "/login"

                , adminContextPath + "/actuator/**"

                , adminContextPath + "/instances/**"

            ).permitAll()

            .anyRequest().authenticated()

            .and()

            .formLogin().loginPage(adminContextPath + "/login")

            .successHandler(successHandler).and()

            .logout().logoutUrl(adminContextPath + "/logout")

            .and()

            .httpBasic().and()

            .csrf()

            .disable();

        return httpSecurity.headers((header) -> header.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable))

            .authorizeHttpRequests(

                (authorize) -> authorize

                    .requestMatchers(adminContextPath + "/assets/**",

                        adminContextPath + "/login",

                        adminContextPath + "/actuator/**",

                        adminContextPath + "/instances/**")

                    .permitAll()

                    .anyRequest()

                    .authenticated())

            .formLogin((formLogin) -> formLogin.loginPage(adminContextPath + "/login").successHandler(successHandler))

            .logout((logout) -> logout.logoutUrl(adminContextPath + "/logout"))

            .httpBasic(Customizer.withDefaults())

            .csrf(AbstractHttpConfigurer::disable)

            .build();

    }

}