package jnpf.filter;
|
|
import cn.dev33.satoken.context.SaHolder;
|
import cn.dev33.satoken.context.model.SaRequest;
|
import cn.dev33.satoken.context.model.SaResponse;
|
import cn.dev33.satoken.filter.SaFilterAuthStrategy;
|
import cn.dev33.satoken.router.SaRouter;
|
import jnpf.constant.GlobalConst;
|
import jnpf.consts.AuthConsts;
|
import jnpf.properties.MvcSecurityProperties;
|
import jnpf.properties.SecurityProperties;
|
import jnpf.util.Constants;
|
import jnpf.util.ReactorUtil;
|
import jnpf.util.UserProvider;
|
import lombok.extern.slf4j.Slf4j;
|
import org.springframework.beans.factory.annotation.Autowired;
|
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
|
import org.springframework.cloud.gateway.filter.GlobalFilter;
|
import org.springframework.cloud.gateway.filter.headers.HttpHeadersFilter;
|
import org.springframework.context.annotation.Bean;
|
import org.springframework.context.annotation.Configuration;
|
import org.springframework.core.annotation.Order;
|
import org.springframework.http.HttpStatus;
|
import org.springframework.util.ObjectUtils;
|
import org.springframework.web.cors.CorsConfiguration;
|
import org.springframework.web.cors.reactive.CorsConfigurationSource;
|
import org.springframework.web.cors.reactive.CorsWebFilter;
|
import org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource;
|
|
import java.net.URI;
|
|
/**
|
* mvc配置
|
*
|
* @author JNPF开发平台组
|
* @version V5.0.0
|
* @copyright 引迈信息技术有限公司（https://www.jnpfsoft.com）
|
* @date 2025-01-21
|
*/
|
@Slf4j
|
@Configuration(proxyBeanMethods = false)
|
public class MvcSecurityConfig {
|
|
private static final String DOMAIN_FORMAT = "%s://%s";
|
|
@Autowired
|
private MvcSecurityProperties mvcSecurityProperties;
|
|
@Autowired
|
private SecurityProperties securityProperties;
|
|
/**
|
* Header过滤器， 为请求添加 Id-Token
|
* @return
|
*/
|
@Bean
|
public HttpHeadersFilter getMyHeadersFilter(){
|
return (input, exchange) -> {
|
if(securityProperties.isEnableInnerAuth() || securityProperties.isEnablePreAuth()){
|
input.add(AuthConsts.INNER_GATEWAY_TOKEN_KEY, UserProvider.getInnerAuthToken());
|
}
|
input.add(GlobalConst.HEADER_HOST, input.getHost().toString());
|
return input;
|
};
|
}
|
|
@Bean
|
public GlobalFilter getContextGatewayFilterForReactor(){
|
return new ContextGatewayFilterForReactor();
|
}
|
|
|
@Bean
|
public CorsWebFilter corsFilter() {
|
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
|
CorsConfiguration config = new CorsConfiguration();
|
// 允许发送凭据
|
config.setAllowCredentials(true);
|
//允许任意域名跨域访问接口
|
config.setAllowedOrigins(mvcSecurityProperties.getCors().getAllowedOrigins());
|
config.setAllowedOriginPatterns(mvcSecurityProperties.getCors().getAllowedOriginPatterns());
|
// 允许所有头部信息
|
config.setAllowedHeaders(mvcSecurityProperties.getCors().getAllowedHeaders());
|
// 允许所有请求方法
|
config.setAllowedMethods(mvcSecurityProperties.getCors().getAllowedMethods());
|
// 应用于所有路径
|
source.registerCorsConfiguration("/**", config);
|
return new MyCorsFilter(source);
|
}
|
|
@Bean
|
@ConditionalOnMissingBean
|
public SaFilterAuthStrategy defaultBeforeAuthStrategy() {
|
CorsConfiguration csrfConfiguration;
|
if(!mvcSecurityProperties.getCsrfOrigins().isEmpty() || !mvcSecurityProperties.getCsrfOriginsPatterns().isEmpty()) {
|
csrfConfiguration = new CorsConfiguration();
|
csrfConfiguration.setAllowedOrigins(mvcSecurityProperties.getCsrfOrigins());
|
csrfConfiguration.setAllowedOriginPatterns(mvcSecurityProperties.getCsrfOriginsPatterns());
|
} else {
|
csrfConfiguration = null;
|
}
|
return obj -> {
|
SaRequest request = SaHolder.getRequest();
|
// ---------- 设置跨域响应头 ----------
|
SaResponse response = SaHolder.getResponse();
|
if(!ObjectUtils.isEmpty(mvcSecurityProperties.getHeaders().getServerName())){
|
response.setServer(mvcSecurityProperties.getHeaders().getServerName());
|
}
|
if(!ObjectUtils.isEmpty(mvcSecurityProperties.getHeaders().getXFrameOptions()) && !MvcSecurityProperties.XFrameOptionsMode.DISABLED.equals(mvcSecurityProperties.getHeaders().getXFrameOptions())){
|
response.setHeader(MvcSecurityProperties.HEADER_XFRAME_OPTIONS, mvcSecurityProperties.getHeaders().getXFrameOptions().getMode());
|
}
|
if(!ObjectUtils.isEmpty(mvcSecurityProperties.getHeaders().getXXssProtection()) && !MvcSecurityProperties.XXssProtectionMode.DISABLED.equals(mvcSecurityProperties.getHeaders().getXXssProtection())){
|
response.setHeader(MvcSecurityProperties.HEADER_XSS_PROTECTION, mvcSecurityProperties.getHeaders().getXXssProtection().getMode());
|
}
|
if(!ObjectUtils.isEmpty(mvcSecurityProperties.getHeaders().getXContentTypeOptions()) && !MvcSecurityProperties.XContentTypeOptions.DISABLED.equals(mvcSecurityProperties.getHeaders().getXContentTypeOptions())){
|
response.setHeader(MvcSecurityProperties.HEADER_Content_Type_Options, mvcSecurityProperties.getHeaders().getXContentTypeOptions().getMode());
|
}
|
|
if(csrfConfiguration != null){
|
String referer = request.getHeader("referer");
|
if(!ObjectUtils.isEmpty(referer)) {
|
URI uri = URI.create(referer);
|
String refererDomain = String.format(DOMAIN_FORMAT, uri.getScheme(), uri.getAuthority());
|
String allowOrign = csrfConfiguration.checkOrigin(refererDomain);
|
if(ObjectUtils.isEmpty(allowOrign)){
|
log.error("Reject CSRF Request: {}, {}, {}, {}", request.getRequestPath(), referer, ReactorUtil.getIpAddr(request), request.getHeader(Constants.AUTHORIZATION));
|
response.setStatus(HttpStatus.FORBIDDEN.value());
|
SaRouter.back("Invalid CSRF Request");
|
}
|
}
|
}
|
};
|
}
|
|
|
@Order(-110)
|
public static class MyCorsFilter extends CorsWebFilter {
|
public MyCorsFilter(CorsConfigurationSource configSource) {
|
super(configSource);
|
}
|
}
|
}
|
