WebSecurityConfig.java

package org.joychou.security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
import org.springframework.security.web.util.matcher.RequestMatcher;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

import javax.servlet.http.HttpServletRequest;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.HashSet;


/**
 * Congifure csrf
 *
 */
@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${joychou.security.csrf.enabled}")
    private Boolean csrfEnabled = false;

    @Value("${joychou.security.csrf.exclude.url}")
    private String[] csrfExcludeUrl;


    @Value("${joychou.no.need.login.url}")
    private String[] noNeedLoginUrl;


    @Value("${joychou.security.csrf.method}")
    private String[] csrfMethod = {"POST"};

    private RequestMatcher csrfRequestMatcher = new RequestMatcher() {

        @Override
        public boolean matches(HttpServletRequest request) {

            // 配置需要CSRF校验的请求方式，
            HashSet<String> allowedMethods = new HashSet<>(Arrays.asList(csrfMethod));
            // return false表示不校验csrf
            if (!csrfEnabled) {
                return false;
            }
            return allowedMethods.contains(request.getMethod());
        }

    };

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 默认token存在session里，用CookieCsrfTokenRepository改为token存在cookie里。
        // 但存在后端多台服务器情况，session不能同步的问题，所以一般使用cookie模式。
        http.csrf()
                .requireCsrfProtectionMatcher(csrfRequestMatcher)
                .ignoringAntMatchers(csrfExcludeUrl)  // 不进行csrf校验的uri，多个uri使用逗号分隔
                .csrfTokenRepository(new CookieCsrfTokenRepository());
        http.exceptionHandling().accessDeniedHandler(new CsrfAccessDeniedHandler());

        // http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());

        http.cors();

        // spring security login settings
        http.authorizeRequests()
                .antMatchers(noNeedLoginUrl).permitAll() // no need to login page
                // CVE-2022-22978漏洞代码
                .regexMatchers("/black_path.*").denyAll()    // 如果正则匹配到/black_path，则forbidden
                .anyRequest().authenticated().and() // any request authenticated except above static resources
                .formLogin().loginPage("/login").permitAll() // permit all to access /login page
                .successHandler(new LoginSuccessHandler())
                .failureHandler(new LoginFailureHandler()).and()
                .logout().logoutUrl("/logout").permitAll().and()
                // tomcat默认JSESSION会话有效时间为30分钟，所以30分钟不操作会话将过期。为了解决这一问题，引入rememberMe功能。
                .rememberMe();
    }

    /**
     * Global cors configure
     */
    @Bean
    CorsConfigurationSource corsConfigurationSource()
    {
        // Set cors origin white list
        ArrayList<String> allowOrigins = new ArrayList<>();
        allowOrigins.add("joychou.org");
        allowOrigins.add("https://test.joychou.me"); // 区分http和https，并且默认不会拦截同域请求。

        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(allowOrigins);
        configuration.setAllowCredentials(true);
        configuration.setAllowedMethods(Arrays.asList("GET", "POST"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/cors/sec/httpCors", configuration); // ant style
        return source;
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .inMemoryAuthentication()
                .withUser("joychou").password("joychou123").roles("USER").and()
                .withUser("admin").password("admin123").roles("USER", "ADMIN");
    }
}