auth

ch-admin-api/src/main/java/com/wwdz/ch/admin/config/ShiroConfig.java

@@ -10,6 +10,8 @@ import org.apache.shiro.session.mgt.SessionManager;
 import org.apache.shiro.spring.LifecycleBeanPostProcessor;
 import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
 import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
+import org.apache.shiro.web.filter.authc.AuthenticationFilter;
+import org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter;
 import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
 import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -21,13 +23,16 @@ import org.springframework.context.annotation.DependsOn;
 import com.wwdz.ch.admin.shiro.AdminAuthorizingRealm;
 import com.wwdz.ch.admin.shiro.AdminWebSessionManager;
 import org.springframework.context.annotation.Lazy;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.filter.GenericFilterBean;
 
 import javax.servlet.*;
+import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 @Configuration
-public class ShiroConfig extends GenericFilterBean {
+public class ShiroConfig {
 
 	@Bean
 	public Realm realm() {
@@ -53,6 +58,8 @@ public class ShiroConfig extends GenericFilterBean {
 		shiroFilterFactoryBean.setSuccessUrl("/admin/auth/index");
 		shiroFilterFactoryBean.setUnauthorizedUrl("/admin/auth/403");
 		shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
+		Map<String, Filter> filters = shiroFilterFactoryBean.getFilters();
+		filters.put("authc", new ShiroCorsFilter());
 		return shiroFilterFactoryBean;
 	}
 
@@ -89,13 +96,5 @@ public class ShiroConfig extends GenericFilterBean {
 		return creator;
 	}
 
-	@Override
-	public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
-		HttpServletResponse resp = (HttpServletResponse)servletResponse;
-		resp.setHeader("Access-Control-Allow-Origin", "*");
-		resp.setHeader("Access-Control-Allow-Credentials", "true");
-		resp.setHeader("Access-Control-Allow-Methods", "POST, GET, PUT, PATCH, DELETE");
-		resp.setHeader("Access-Control-Allow-Headers", "*");
-		filterChain.doFilter(servletRequest, servletResponse);
-	}
+
 }

ch-admin-api/src/main/java/com/wwdz/ch/admin/config/ShiroCorsFilter.java

+package com.wwdz.ch.admin.config;
+
+import org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class ShiroCorsFilter extends BasicHttpAuthenticationFilter {
+
+    @Override
+    protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {
+        HttpServletResponse httpResponse = (HttpServletResponse) response;
+        HttpServletRequest httpRequest = (HttpServletRequest) request;
+        //无条件放行OPTIONS
+        if (httpRequest.getMethod().equals(RequestMethod.OPTIONS.name())) {
+            setHeader(httpRequest, httpResponse);
+            return true;
+        }
+        return super.preHandle(request, response);
+    }
+
+    /**
+     * 为response设置header，实现跨域
+     */
+    private void setHeader(HttpServletRequest request, HttpServletResponse response) {
+        response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
+        response.setHeader("Access-Control-Allow-Credentials", "true");
+        response.setHeader("Access-Control-Allow-Methods", "POST,PUT,GET,OPTIONS,DELETE");
+        response.setHeader("Access-Control-Max-Age", "3600");
+        response.setHeader("Access-Control-Allow-Headers", "content-type,x-requested-with,token,Authorization,authorization");
+        response.setHeader("Content-Type", "application/json;charset=UTF-8");
+    }
+}

ch-core/src/main/java/com/wwdz/ch/core/config/CorsFilterConfig.java

@@ -9,6 +9,7 @@ import org.springframework.web.filter.CorsFilter;
 
 import javax.servlet.*;
 import javax.servlet.annotation.WebFilter;
+import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.util.Collections;
@@ -42,10 +43,15 @@ public class CorsFilterConfig implements Filter {
     @Override
     public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
         HttpServletResponse resp = (HttpServletResponse)servletResponse;
-        resp.setHeader("Access-Control-Allow-Origin", "*");
+        HttpServletRequest request = (HttpServletRequest) servletRequest;
+        //放行所有,类似*,这里*无效
+        resp.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
         resp.setHeader("Access-Control-Allow-Credentials", "true");
-        resp.setHeader("Access-Control-Allow-Methods", "POST, GET, PUT, PATCH, DELETE");
-        resp.setHeader("Access-Control-Allow-Headers", "*");
+        //允许请求方式
+        resp.setHeader("Access-Control-Allow-Methods", "POST,PUT, GET, OPTIONS, DELETE");
+        resp.setHeader("Access-Control-Max-Age", "3600");
+        //需要放行header头部字段 如需鉴权字段，自行添加，如Authorization
+        resp.setHeader("Access-Control-Allow-Headers", "content-type,x-requested-with,token,Authorization,authorization");
         filterChain.doFilter(servletRequest,servletResponse);
     }