spring security 實現匿名訪問

實現思路：step1: 標注需要匿名訪問的接口

　　　　    step2: 配置匿名訪問

自定義注解 @AnonymousAccess，寫在需要匿名訪問的接口上：

    /**
     * 功能描述: 登錄
     * @param loginVO 用戶登錄時的賬號和密碼
     * @Description TODO
     * @return com.rman.iflash.model.R
     * @Author Caesar
     * @Date 10:57 2020/5/3
     **/
    @AnonymousAccess
    @PostMapping("/login")
    public R login(@RequestBody @Validated LoginVO loginVO){
        log.info("用戶登錄信息{}", loginVO);
        LoginVO authUserDTO = new LoginVO();
        authUserDTO.setUsername(loginVO.getUsername());
        authUserDTO.setPassword(loginVO.getPassword());
        authUserDTO.setCaptchaId(loginVO.getCaptchaId());
        authUserDTO.setCaptchaCode(loginVO.getCaptchaCode());
        Object data = loginService.login(authUserDTO);
        return R.success(data);
    }

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface AnonymousAccess {
}

在security的配置類的 configure(HttpSecurity http)方法中配置匿名訪問：

//查找匿名標記URL
        Map<RequestMappingInfo, HandlerMethod> handlerMethods =
                applicationContext.getBean(RequestMappingHandlerMapping.class).getHandlerMethods();
        Set<String> anonymousUrls = new HashSet<>();
        for (Map.Entry<RequestMappingInfo, HandlerMethod> infoEntry : handlerMethods.entrySet()) {
            HandlerMethod handlerMethod = infoEntry.getValue();
            AnonymousAccess anonymousAccess = handlerMethod.getMethodAnnotation(AnonymousAccess.class);
            if (anonymousAccess != null) {
                anonymousUrls.addAll(infoEntry.getKey().getPatternsCondition().getPatterns());
            }
        }
        anonymousUrls.forEach(s -> log.warn("可以匿名訪問的url：{}", s));

http.antMatchers(anonymousUrls.toArray(new String[0])).anonymous()