@Configuration

public class WebMvcConfig implements WebMvcConfigurer {

    @Override

    public void addCorsMappings(CorsRegistry registry) {

        registry.addMapping("/**")

                .allowedHeaders("*")

                .allowedMethods("*")

                .allowedOrigins("*")

                .allowCredentials(true);

    }

}

@Configuration

@EnableWebSecurity

@EnableGlobalMethodSecurity(prePostEnabled = true)

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired

    JwtAuthenticationEntryPoint unauthorizedHandler;

    @Autowired

    RestAuthenticationAccessDeniedHandler accessDeniedHandler;

    @Autowired

    CustomUserDetailsServiceImpl CustomUserDetailsService;

    @Autowired

    JwtAuthenticationTokenFilter authenticationTokenFilter;

    @Autowired

    private MyPermissionEvaluator myPermissionEvaluator;

    @Autowired

    public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {

        authenticationManagerBuilder

                // 设置UserDetailsService

                .userDetailsService(CustomUserDetailsService)

                // 使用BCrypt进行密码的hash

                .passwordEncoder(passwordEncoder());

    }

    /**

     * 装载BCrypt密码编码器

     * @return

     */

    @Bean

    public PasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();

    }

    @Override

    protected void configure(HttpSecurity httpSecurity) throws Exception {

        httpSecurity

                .exceptionHandling().accessDeniedHandler(accessDeniedHandler).and()

                .cors().and()//乌龙在这行，一开始没有配置这个 
//如果您使用的是Spring Security，请确保在Spring Security级别启用CORS，以允许它利用Spring MVC级别定义的配置。

                                  //乌龙在这行，一开始没有配置这个

                                 //乌龙在这行，一开始没有配置这个

                // 由于使用的是JWT，我们这里不需要csrf

                .csrf().disable()

                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()

                // 基于token，所以不需要session

                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()

                .authorizeRequests()

                // 对于获取token的rest api要允许匿名访问

                .antMatchers("/admin/login",

                        "/admin/register","/error/**").permitAll()

                // 除上面外的所有请求全部需要鉴权认证

                .anyRequest().authenticated();

        // 禁用缓存

        httpSecurity.headers().cacheControl();

        // 添加JWT filter

        httpSecurity

                .addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);

    }

    @Override

    public void configure(WebSecurity web) {

        web

                .ignoring().antMatchers(HttpMethod.OPTIONS, "/**").and()

                .ignoring()

                .antMatchers(

                        "/favicon.ico",

                        "/**/*.css",

                        "/**/*.js",

                        "/**/*.png",

                        "/**/*.gif",

                        "/**/*.ttf"

                );

    }

    @Bean

    @Override

    public AuthenticationManager authenticationManagerBean() throws Exception {

        return super.authenticationManagerBean();

    }

    /**

     * 注入自定义PermissionEvaluator

     */

    @Bean

    public DefaultWebSecurityExpressionHandler webSecurityExpressionHandler(){

        DefaultWebSecurityExpressionHandler handler = new DefaultWebSecurityExpressionHandler();

        handler.setPermissionEvaluator(myPermissionEvaluator);

        return handler;

    }

}