From a4328e3d4fe2894c0ddf378eea9b3c2a3498d62b Mon Sep 17 00:00:00 2001
From: 648540858 <648540858@qq.com>
Date: Thu, 23 Mar 2023 08:52:35 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E5=85=B3=E9=97=AD=E6=8E=A5?=
 =?UTF-8?q?=E5=8F=A3=E9=89=B4=E6=9D=83=E5=90=8E=E8=B7=A8=E5=9F=9F=E8=AE=BE?=
 =?UTF-8?q?=E7=BD=AE=E5=A4=B1=E6=95=88=E7=9A=84=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../security/JwtAuthenticationFilter.java     | 16 ++++++++--
 .../vmp/conf/security/WebSecurityConfig.java  | 32 ++++++++-----------
 2 files changed, 27 insertions(+), 21 deletions(-)

diff --git a/src/main/java/com/genersoft/iot/vmp/conf/security/JwtAuthenticationFilter.java b/src/main/java/com/genersoft/iot/vmp/conf/security/JwtAuthenticationFilter.java
index 8fdcee1c..e50a8b0e 100644
--- a/src/main/java/com/genersoft/iot/vmp/conf/security/JwtAuthenticationFilter.java
+++ b/src/main/java/com/genersoft/iot/vmp/conf/security/JwtAuthenticationFilter.java
@@ -1,7 +1,9 @@
 package com.genersoft.iot.vmp.conf.security;
 
+import com.genersoft.iot.vmp.conf.UserSetting;
 import com.genersoft.iot.vmp.conf.security.dto.JwtUser;
 import org.apache.commons.lang3.StringUtils;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Component;
@@ -22,6 +24,10 @@ import java.util.ArrayList;
 public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
 
+    @Autowired
+    private UserSetting userSetting;
+
+
     @Override
     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
 
@@ -31,6 +37,13 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
             chain.doFilter(request, response);
             return;
         }
+        if (!userSetting.isInterfaceAuthentication()) {
+            // 构建UsernamePasswordAuthenticationToken,这里密码为null，是因为提供了正确的JWT,实现自动登录
+            UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(null, null, new ArrayList<>() );
+            SecurityContextHolder.getContext().setAuthentication(token);
+            chain.doFilter(request, response);
+            return;
+        }
         String jwt = request.getHeader(JwtUtils.getHeader());
         // 这里如果没有jwt，继续往后走，因为后面还有鉴权管理器等去判断是否拥有身份凭证，所以是可以放行的
         // 没有jwt相当于匿名访问，若有一些接口是需要权限的，则不能访问这些接口
@@ -62,9 +75,6 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
             default:
         }
 
-//        String password = SecurityUtils.encryptPassword(jwtUser.getPassword());
-//        user.setPassword(password);
-
         // 构建UsernamePasswordAuthenticationToken,这里密码为null，是因为提供了正确的JWT,实现自动登录
         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, jwtUser.getPassword(), new ArrayList<>() );
         SecurityContextHolder.getContext().setAuthentication(token);
diff --git a/src/main/java/com/genersoft/iot/vmp/conf/security/WebSecurityConfig.java b/src/main/java/com/genersoft/iot/vmp/conf/security/WebSecurityConfig.java
index 0f77ab1d..c9a1233b 100644
--- a/src/main/java/com/genersoft/iot/vmp/conf/security/WebSecurityConfig.java
+++ b/src/main/java/com/genersoft/iot/vmp/conf/security/WebSecurityConfig.java
@@ -73,24 +73,20 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
     @Override
     public void configure(WebSecurity web) {
 
-        if (!userSetting.isInterfaceAuthentication()) {
-            web.ignoring().antMatchers("**");
-        }else {
-            ArrayList<String> matchers = new ArrayList<>();
-            matchers.add("/");
-            matchers.add("/#/**");
-            matchers.add("/static/**");
-            matchers.add("/index.html");
-            matchers.add("/doc.html");
-            matchers.add("/webjars/**");
-            matchers.add("/swagger-resources/**");
-            matchers.add("/v3/api-docs/**");
-            matchers.add("/js/**");
-            matchers.add("/api/device/query/snap/**");
-            matchers.addAll(userSetting.getInterfaceAuthenticationExcludes());
-            // 可以直接访问的静态数据
-            web.ignoring().antMatchers(matchers.toArray(new String[0]));
-        }
+        ArrayList<String> matchers = new ArrayList<>();
+        matchers.add("/");
+        matchers.add("/#/**");
+        matchers.add("/static/**");
+        matchers.add("/index.html");
+        matchers.add("/doc.html");
+        matchers.add("/webjars/**");
+        matchers.add("/swagger-resources/**");
+        matchers.add("/v3/api-docs/**");
+        matchers.add("/js/**");
+        matchers.add("/api/device/query/snap/**");
+        matchers.addAll(userSetting.getInterfaceAuthenticationExcludes());
+        // 可以直接访问的静态数据
+        web.ignoring().antMatchers(matchers.toArray(new String[0]));
     }
 
     /**