在后端过滤api
Change-Id: I299da1bcceab6c171a2ec32a912eab5f92cbd530
diff --git a/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java b/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java
index 123807e..52d2d92 100644
--- a/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java
+++ b/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java
@@ -1,5 +1,12 @@
package com.ruoyi.framework.config;
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequestWrapper;
+import jakarta.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@@ -20,6 +27,9 @@
import com.ruoyi.framework.security.filter.JwtAuthenticationTokenFilter;
import com.ruoyi.framework.security.handle.AuthenticationEntryPointImpl;
import com.ruoyi.framework.security.handle.LogoutSuccessHandlerImpl;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
/**
* spring security配置
@@ -94,38 +104,32 @@
* authenticated | 用户登录后可访问
*/
@Bean
- protected SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception
- {
+ protected SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
return httpSecurity
- // CSRF禁用，因为不使用session
- .csrf(csrf -> csrf.disable())
- // 禁用HTTP响应标头
- .headers((headersCustomizer) -> {
- headersCustomizer.cacheControl(cache -> cache.disable()).frameOptions(options -> options.sameOrigin());
- })
- // 认证失败处理类
- .exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler))
- // 基于token，所以不需要session
- .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
- // 注解标记允许匿名访问的url
- .authorizeHttpRequests((requests) -> {
- permitAllUrl.getUrls().forEach(url -> requests.requestMatchers(url).permitAll());
- // 对于登录login 注册register 验证码captchaImage 允许匿名访问
- requests.requestMatchers("/login", "/register", "/captchaImage","testDownloadTorrent","/tracker/announce").permitAll()
- // 静态资源，可匿名访问
- .requestMatchers(HttpMethod.GET, "/", "/*.html", "/**.html", "/**.css", "/**.js", "/profile/**").permitAll()
- .requestMatchers("/swagger-ui.html", "/v3/api-docs/**", "/swagger-ui/**", "/druid/**").permitAll()
- // 除上面外的所有请求全部需要鉴权认证
- .anyRequest().authenticated();
- })
- // 添加Logout filter
- .logout(logout -> logout.logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler))
- // 添加JWT filter
- .addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
- // 添加CORS filter
- .addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class)
- .addFilterBefore(corsFilter, LogoutFilter.class)
- .build();
+ .csrf(csrf -> csrf.disable())
+ .headers((headersCustomizer) -> {
+ headersCustomizer.cacheControl(cache -> cache.disable())
+ .frameOptions(options -> options.sameOrigin());
+ })
+ .exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler))
+ .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+ // 添加路径重写过滤器
+ .addFilterBefore(pathRewriteFilter(), UsernamePasswordAuthenticationFilter.class)
+ .authorizeHttpRequests((requests) -> {
+ permitAllUrl.getUrls().forEach(url -> requests.requestMatchers(url).permitAll());
+ requests.requestMatchers("/login", "/register", "/captchaImage", "testDownloadTorrent", "/tracker/announce")
+ .permitAll()
+ .requestMatchers(HttpMethod.GET, "/", "/*.html", "/**.html", "/**.css", "/**.js", "/profile/**")
+ .permitAll()
+ .requestMatchers("/swagger-ui.html", "/v3/api-docs/**", "/swagger-ui/**", "/druid/**")
+ .permitAll()
+ .anyRequest().authenticated();
+ })
+ .logout(logout -> logout.logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler))
+ .addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
+ .addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class)
+ .addFilterBefore(corsFilter, LogoutFilter.class)
+ .build();
}
/**
@@ -136,4 +140,37 @@
{
return new BCryptPasswordEncoder();
}
+
+ @Bean
+ public Filter pathRewriteFilter() {
+ return new OncePerRequestFilter() {
+
+ @Override
+ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
+ String requestURI = request.getRequestURI();
+
+ // 重写所有 /api/ 开头的请求路径
+ if (requestURI.startsWith("/api/")) {
+ String newURI = requestURI.substring(4); // 移除 "/api"
+
+ filterChain.doFilter(new HttpServletRequestWrapper(request) {
+ @Override
+ public String getRequestURI() {
+ return newURI;
+ }
+
+ @Override
+ public String getServletPath() {
+ return newURI;
+ }
+ }, response);
+ return;
+ }
+
+ filterChain.doFilter(request, response);
+ }
+
+ };
+ }
+
}
diff --git a/torrent/2002464810.torrent b/torrent/2002464810.torrent
new file mode 100644
index 0000000..afee80d
--- /dev/null
+++ b/torrent/2002464810.torrent
Binary files differ