若依 3.6.8

RuoYi

2026-03-30 63a556bd3a215c7dd081ca59756bc560576c2acc

 ruoyi-visual/ruoyi-monitor/src/main/java/com/ruoyi/modules/monitor/config/WebSecurityConfigurer.java

@@ -2,8 +2,12 @@


import de.codecentric.boot.admin.server.config.AdminServerProperties;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.Customizer;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;

import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;

import org.springframework.security.web.SecurityFilterChain;

import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;



@@ -13,6 +17,7 @@
 * @author ruoyi

 */

@EnableWebSecurity

@Configuration

public class WebSecurityConfigurer

{

    private final String adminContextPath;

@@ -29,23 +34,20 @@
        successHandler.setTargetUrlParameter("redirectTo");

        successHandler.setDefaultTargetUrl(adminContextPath + "/");



        return httpSecurity

                .headers().frameOptions().disable()

                .and().authorizeRequests()

                .antMatchers(adminContextPath + "/assets/**"

                        , adminContextPath + "/login"

                        , adminContextPath + "/actuator/**"

                        , adminContextPath + "/instances/**"

                ).permitAll()

                .anyRequest().authenticated()

                .and()

                .formLogin().loginPage(adminContextPath + "/login")

                .successHandler(successHandler).and()

                .logout().logoutUrl(adminContextPath + "/logout")

                .and()

                .httpBasic().and()

                .csrf()

                .disable()

                .build();

        return httpSecurity.headers((header) -> header.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable))

            .authorizeHttpRequests(

                (authorize) -> authorize

                    .requestMatchers(adminContextPath + "/assets/**",

                        adminContextPath + "/login",

                        adminContextPath + "/actuator/**",

                        adminContextPath + "/instances/**")

                    .permitAll()

                    .anyRequest()

                    .authenticated())

            .formLogin((formLogin) -> formLogin.loginPage(adminContextPath + "/login").successHandler(successHandler))

            .logout((logout) -> logout.logoutUrl(adminContextPath + "/logout"))

            .httpBasic(Customizer.withDefaults())

            .csrf(AbstractHttpConfigurer::disable)

            .build();

    }

}