✨ Introducing new features. #1214 【优化】 接口对外暴露，不校验 Authentication Header 头

pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxBearerTokenExtractor.java

@@ -0,0 +1,50 @@
+/*
+ *
+ *  *  Copyright (c) 2019-2020, 冷冷 (wangiegie@gmail.com).
+ *  *  <p>
+ *  *  Licensed under the GNU Lesser General Public License 3.0 (the "License");
+ *  *  you may not use this file except in compliance with the License.
+ *  *  You may obtain a copy of the License at
+ *  *  <p>
+ *  * https://www.gnu.org/licenses/lgpl.html
+ *  *  <p>
+ *  * Unless required by applicable law or agreed to in writing, software
+ *  * distributed under the License is distributed on an "AS IS" BASIS,
+ *  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  * See the License for the specific language governing permissions and
+ *  * limitations under the License.
+ *
+ */
+
+
+package com.pig4cloud.pigx.common.security.component;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.oauth2.provider.authentication.BearerTokenExtractor;
+import org.springframework.stereotype.Component;
+import org.springframework.util.AntPathMatcher;
+import org.springframework.util.PathMatcher;
+
+import javax.servlet.http.HttpServletRequest;
+
+/**
+ * 改造 {@link BearerTokenExtractor} 对公开权限的请求不进行校验
+ *
+ * @author caiqy
+ * @date 2020.05.15
+ */
+@Component
+@RequiredArgsConstructor
+public class PigxBearerTokenExtractor extends BearerTokenExtractor {
+	private final PathMatcher pathMatcher = new AntPathMatcher();
+	private final PermitAllUrlProperties urlProperties;
+
+	@Override
+	public Authentication extract(HttpServletRequest request) {
+		boolean match = urlProperties.getIgnoreUrls().stream()
+			.anyMatch(url -> pathMatcher.match(url, request.getRequestURI()));
+
+		return match ? null : super.extract(request);
+	}
+}

pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxResourceServerConfigurerAdapter.java

@@ -24,6 +24,7 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
 import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
 import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
+import org.springframework.security.oauth2.provider.authentication.TokenExtractor;
 import org.springframework.security.oauth2.provider.token.DefaultAccessTokenConverter;
 import org.springframework.security.oauth2.provider.token.RemoteTokenServices;
 import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter;
@@ -45,6 +46,8 @@ public class PigxResourceServerConfigurerAdapter extends ResourceServerConfigure
 	@Autowired
 	private PermitAllUrlProperties permitAllUrlProperties;
 	@Autowired
+	private TokenExtractor tokenExtractor;
+	@Autowired
 	private RestTemplate lbRestTemplate;
 
 	/**
@@ -58,12 +61,12 @@ public class PigxResourceServerConfigurerAdapter extends ResourceServerConfigure
 		//允许使用iframe 嵌套，避免swagger-ui 不被加载的问题
 		httpSecurity.headers().frameOptions().disable();
 		ExpressionUrlAuthorizationConfigurer<HttpSecurity>
-			.ExpressionInterceptUrlRegistry registry = httpSecurity
-			.authorizeRequests();
+				.ExpressionInterceptUrlRegistry registry = httpSecurity
+				.authorizeRequests();
 		permitAllUrlProperties.getIgnoreUrls()
-			.forEach(url -> registry.antMatchers(url).permitAll());
+				.forEach(url -> registry.antMatchers(url).permitAll());
 		registry.anyRequest().authenticated()
-			.and().csrf().disable();
+				.and().csrf().disable();
 	}
 
 	@Override
@@ -75,6 +78,7 @@ public class PigxResourceServerConfigurerAdapter extends ResourceServerConfigure
 		remoteTokenServices.setRestTemplate(lbRestTemplate);
 		remoteTokenServices.setAccessTokenConverter(accessTokenConverter);
 		resources.authenticationEntryPoint(resourceAuthExceptionEntryPoint)
+				.tokenExtractor(tokenExtractor)
 				.tokenServices(remoteTokenServices);
 	}
 }