老唐手把手教你配置security，并增加JWT校验（copy就用）。

1.首先配置security

1.1导入security的jar包

  <!--security 框架-->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

1.2配置security配置文件(直接上代码)

/**
 * Spring Security配置类
 *
 * @author zhuhuix
 * @date 2020-03-25
 */

/**
 * SpringSecurity的关键配置
 */
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
   

    private final JwtAccessDeniedHandler jwtAccessDeniedHandler;
    private final JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
    private final JwtTokenUtils jwtTokenUtils;
    @Autowired
    private YxsPubOrderMaintenanceService yxsPubOrderMaintenanceService;

    public WebSecurityConfig(JwtAccessDeniedHandler jwtAccessDeniedHandler, JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint, JwtTokenUtils jwtTokenUtils,YxsPubOrderMaintenanceService yxsPubOrderMaintenanceService) {
   

        this.jwtAccessDeniedHandler = jwtAccessDeniedHandler;
        this.jwtAuthenticationEntryPoint = jwtAuthenticationEntryPoint;
        this.jwtTokenUtils = jwtTokenUtils;
        this. yxsPubOrderMaintenanceService=yxsPubOrderMaintenanceService;
    }

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
   

        httpSecurity
                // 禁用 CSRF
                .csrf().disable()

                // 授权异常
                .exceptionHandling()
                .authenticationEntryPoint(jwtAuthenticationEntryPoint)
                .accessDeniedHandler(jwtAccessDeniedHandler)

                // 防止iframe 造成跨域
                .and()
                .headers()
                .frameOptions()
                .disable()

                // 不创建会话
                .and()
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)

                .and()
                .authorizeRequests()

                // 放行静态资源
                .antMatchers(
                        HttpMethod.GET,
                        "/*.html",
                        "/**/*.html",
                        "/**/*.css",
                        "/**/*.js",
                        "/**/*.jpeg",
                        "/**/*.png",
                        "/**/*.svg",
                        "/**/*.jpg",
                        "/webSocket/**",
                        "/yxs/**"
                ).permitAll()

                // 放行swagger
                .antMatchers("/swagger-ui.html").permitAll()
                .antMatchers("/swagger-resources/**").permitAll()
                .antMatchers("/webjars/**").permitAll()
                .antMatchers("/*/api-docs").permitAll()
                // 放行文件访问
                .antMatchers("/file/**").permitAll()
                //对外 API
                .antMatchers("/pub/**").permitAll()
                .antMatchers("/gft/**").permitAll()

                // 放行druid
                .antMatchers("/druid/**").permitAll()

                // 放行OPTIONS请求
                .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                //允许匿名及登录用户访问
                .antMatchers("/api/auth/**", "/error/**").permitAll()
                //手机登录放行
                .antMatchers("/**").permitAll()
                // 所有请求都需要认证
                .anyRequest().authenticated();

        // 禁用缓存
        httpSecurity.headers().cacheControl();

        // 添加JWT filter
        httpSecurity
                .apply(new TokenConfigurer(jwtTokenUtils));

    }


    public class TokenConfigurer extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> {
   

        private final JwtTokenUtils jwtTokenUtils;

        public TokenConfigurer(JwtTokenUtils jwtTokenUtils) {
   

            this.jwtTokenUtils = jwtTokenUtils;
        }

        @Override
        public void configure(HttpSecurity http) throws Exception {
   
            JwtAuthenticationTokenFilter customFilter = new JwtAuthenticationTokenFilter(jwtTokenUtils,yxsPubOrderMaintenanceService);
            http.addFilterBefore(customFilter, UsernamePasswordAuthenticationFilter.class);
        }

    }

}

2.JWT配置

2.1导入JWT包

        <!-- jwt -->
        <dependency>
            <groupId>io.jsonwebtoken</groupId