@Configuration
@EnableWebSecurity
//@EnableGlobalMethodSecurity(prePostEnabled=true)//开启@PreAuthorize注解
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
/**
* 自定义HeaderWriter,用以覆盖security默认的Header,
* 使默认的"X-Frame-Options:DENY"禁止一切iframe调用
* 转化为"X-Frame-Options:SAMEORIGIN"允许同域下的iframe调用
*/
HeaderWriter headerWriter = new HeaderWriter() {
@Override
public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
response.setHeader("X-Frame-Options","SAMEORIGIN");
}
};
List<HeaderWriter> headerWriters = new ArrayList<>();
headerWriters.add(headerWriter);
HeaderWriterFilter headerWriterFilter = new HeaderWriterFilter(headerWriters);
http.addFilter(headerWriterFilter);
}
}