spring security 实现匿名访问

实现思路：step1: 标注需要匿名访问的接口

　　　　    step2: 配置匿名访问

自定义注解 @AnonymousAccess，写在需要匿名访问的接口上：

    /**
     * 功能描述: 登录
     * @param loginVO 用户登录时的账号和密码
     * @Description TODO
     * @return com.rman.iflash.model.R
     * @Author Caesar
     * @Date 10:57 2020/5/3
     **/
    @AnonymousAccess
    @PostMapping("/login")
    public R login(@RequestBody @Validated LoginVO loginVO){
        log.info("用户登录信息{}", loginVO);
        LoginVO authUserDTO = new LoginVO();
        authUserDTO.setUsername(loginVO.getUsername());
        authUserDTO.setPassword(loginVO.getPassword());
        authUserDTO.setCaptchaId(loginVO.getCaptchaId());
        authUserDTO.setCaptchaCode(loginVO.getCaptchaCode());
        Object data = loginService.login(authUserDTO);
        return R.success(data);
    }

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface AnonymousAccess {
}

在security的配置类的 configure(HttpSecurity http)方法中配置匿名访问：

//查找匿名标记URL
        Map<RequestMappingInfo, HandlerMethod> handlerMethods =
                applicationContext.getBean(RequestMappingHandlerMapping.class).getHandlerMethods();
        Set<String> anonymousUrls = new HashSet<>();
        for (Map.Entry<RequestMappingInfo, HandlerMethod> infoEntry : handlerMethods.entrySet()) {
            HandlerMethod handlerMethod = infoEntry.getValue();
            AnonymousAccess anonymousAccess = handlerMethod.getMethodAnnotation(AnonymousAccess.class);
            if (anonymousAccess != null) {
                anonymousUrls.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
            }
        }
        anonymousUrls.forEach(s -> log.warn("可以匿名访问的url：{}", s));

http.antMatchers(anonymousUrls.toArray(new String[0])).anonymous()