diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java index 84018f9a..af943903 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java @@ -25,12 +25,13 @@ public class CorsFilter implements Filter { throws IOException, ServletException { HttpServletResponse res = (HttpServletResponse) response; res.addHeader("Access-Control-Allow-Credentials", "true"); - res.addHeader("Access-Control-Allow-Origin", "http://10.132.108.3"); + res.addHeader("Access-Control-Allow-Origin", ((HttpServletRequest) request).getHeader("origin")); +// res.addHeader("Access-Control-Allow-Origin", "http://10.132.108.3"); res.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT"); res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN,token"); res.addHeader("X-Frame-Options", "SAMEORIGIN"); - res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN"); - User user = ShiroUtils.getSysUser(); +// res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN"); +// User user = ShiroUtils.getSysUser(); // Map payload = new HashMap<>(); // payload.put("id", user.getUserId()); // payload.put("name", user.getPassword()); diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java index c9b24cde..1ad2a9eb 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java @@ -1,81 +1,81 @@ -package com.zdxt.auth.framework.config; - -import java.util.Map; -import javax.servlet.DispatcherType; - -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.beans.factory.annotation.Value; -import org.springframework.boot.web.servlet.FilterRegistrationBean; -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; -import com.google.common.collect.Maps; -import com.zdxt.auth.common.utils.StringUtils; -import com.zdxt.auth.common.xss.XssFilter; -import org.springframework.web.cors.CorsConfiguration; -import org.springframework.web.cors.UrlBasedCorsConfigurationSource; -import org.springframework.web.filter.CorsFilter; - -/** - * Filter配置 - * - * @author ruoyi - */ -@Configuration -public class FilterConfig -{ - @Value("${xss.enabled}") - private String enabled; - - @Value("${xss.excludes}") - private String excludes; - - @Value("${xss.urlPatterns}") - private String urlPatterns; - - //http host头攻击漏洞处理过滤器 - @Autowired - HostFilter hostFilter; - - @SuppressWarnings({ "rawtypes", "unchecked" }) - @Bean - public FilterRegistrationBean xssFilterRegistration() - { - FilterRegistrationBean registration = new FilterRegistrationBean(); - registration.setDispatcherTypes(DispatcherType.REQUEST); - registration.setFilter(new XssAndSqlFilter()); - registration.addUrlPatterns(StringUtils.split(urlPatterns, ",")); - registration.setName("xssFilter"); - registration.setOrder(Integer.MAX_VALUE); - Map initParameters = Maps.newHashMap(); - initParameters.put("excludes", excludes); - initParameters.put("enabled", enabled); - registration.setInitParameters(initParameters); - return registration; - } - @Bean - public FilterRegistrationBean hostfilter() { - FilterRegistrationBean registration = new FilterRegistrationBean(); - registration.setFilter(hostFilter); - registration.addUrlPatterns("/*"); - registration.setName("hostFilter"); - registration.setOrder(1); // 值越小，Filter越靠前。 - return registration; - } - @Bean - public FilterRegistrationBean corsNewFilter() { - UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); - CorsConfiguration config = new CorsConfiguration(); - config.setAllowCredentials(true); - config.addAllowedOrigin("http://10.132.108.3:85"); - config.addAllowedOrigin("http://10.132.108.3:80"); - config.addAllowedOrigin("http://10.132.108.3:81"); - config.addAllowedHeader("*"); - config.addAllowedMethod("*"); - source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效 - FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source)); - bean.setOrder(0); - return bean; - } - - -} +//package com.zdxt.auth.framework.config; +// +//import java.util.Map; +//import javax.servlet.DispatcherType; +// +//import org.springframework.beans.factory.annotation.Autowired; +//import org.springframework.beans.factory.annotation.Value; +//import org.springframework.boot.web.servlet.FilterRegistrationBean; +//import org.springframework.context.annotation.Bean; +//import org.springframework.context.annotation.Configuration; +//import com.google.common.collect.Maps; +//import com.zdxt.auth.common.utils.StringUtils; +//import com.zdxt.auth.common.xss.XssFilter; +//import org.springframework.web.cors.CorsConfiguration; +//import org.springframework.web.cors.UrlBasedCorsConfigurationSource; +//import org.springframework.web.filter.CorsFilter; +// +///** +// * Filter配置 +// * +// * @author ruoyi +// */ +//@Configuration +//public class FilterConfig +//{ +// @Value("${xss.enabled}") +// private String enabled; +// +// @Value("${xss.excludes}") +// private String excludes; +// +// @Value("${xss.urlPatterns}") +// private String urlPatterns; +// +// //http host头攻击漏洞处理过滤器 +// @Autowired +// HostFilter hostFilter; +// +// @SuppressWarnings({ "rawtypes", "unchecked" }) +// @Bean +// public FilterRegistrationBean xssFilterRegistration() +// { +// FilterRegistrationBean registration = new FilterRegistrationBean(); +// registration.setDispatcherTypes(DispatcherType.REQUEST); +// registration.setFilter(new XssAndSqlFilter()); +// registration.addUrlPatterns(StringUtils.split(urlPatterns, ",")); +// registration.setName("xssFilter"); +// registration.setOrder(Integer.MAX_VALUE); +// Map initParameters = Maps.newHashMap(); +// initParameters.put("excludes", excludes); +// initParameters.put("enabled", enabled); +// registration.setInitParameters(initParameters); +// return registration; +// } +// @Bean +// public FilterRegistrationBean hostfilter() { +// FilterRegistrationBean registration = new FilterRegistrationBean(); +// registration.setFilter(hostFilter); +// registration.addUrlPatterns("/*"); +// registration.setName("hostFilter"); +// registration.setOrder(1); // 值越小，Filter越靠前。 +// return registration; +// } +// @Bean +// public FilterRegistrationBean corsNewFilter() { +// UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); +// CorsConfiguration config = new CorsConfiguration(); +// config.setAllowCredentials(true); +// config.addAllowedOrigin("http://10.132.108.3:85"); +// config.addAllowedOrigin("http://10.132.108.3:80"); +// config.addAllowedOrigin("http://10.132.108.3:81"); +// config.addAllowedHeader("*"); +// config.addAllowedMethod("*"); +// source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效 +// FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source)); +// bean.setOrder(0); +// return bean; +// } +// +// +//} diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java index 7adbdc32..ccf43f24 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java @@ -1,37 +1,37 @@ -package com.zdxt.auth.framework.config; - -import org.springframework.boot.web.servlet.FilterRegistrationBean; -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; -import org.springframework.web.cors.CorsConfiguration; -import org.springframework.web.cors.UrlBasedCorsConfigurationSource; - -import java.util.Arrays; - -@Configuration -public class GlobalCorsConfig { - @Bean - public FilterRegistrationBean corsfilter() { - FilterRegistrationBean corsFilterFilterRegistrationBean = new FilterRegistrationBean<>(); - //添加CORS配置信息 - CorsConfiguration corsConfiguration = new CorsConfiguration(); - //允许的域，不要写*，否则cookie就无法使用了 - corsConfiguration.addAllowedOrigin("http://10.132.108.3"); - //允许的头信息 - corsConfiguration.addAllowedHeader("*"); - //允许的请求方式 - corsConfiguration.setAllowedMethods(Arrays.asList("POST", "PUT", "GET", "DELETE")); - //是否发送cookie信息 - corsConfiguration.setAllowCredentials(true); - //预检请求的有效期，单位为秒 - corsConfiguration.setMaxAge(3600L); - - //添加映射路径，标识待拦截的请求 - UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); - source.registerCorsConfiguration("/**", corsConfiguration); - - corsFilterFilterRegistrationBean.setFilter(new org.springframework.web.filter.CorsFilter(source)); - corsFilterFilterRegistrationBean.setOrder(-1); - return corsFilterFilterRegistrationBean; - } -} +//package com.zdxt.auth.framework.config; +// +//import org.springframework.boot.web.servlet.FilterRegistrationBean; +//import org.springframework.context.annotation.Bean; +//import org.springframework.context.annotation.Configuration; +//import org.springframework.web.cors.CorsConfiguration; +//import org.springframework.web.cors.UrlBasedCorsConfigurationSource; +// +//import java.util.Arrays; +// +//@Configuration +//public class GlobalCorsConfig { +// @Bean +// public FilterRegistrationBean corsfilter() { +// FilterRegistrationBean corsFilterFilterRegistrationBean = new FilterRegistrationBean<>(); +// //添加CORS配置信息 +// CorsConfiguration corsConfiguration = new CorsConfiguration(); +// //允许的域，不要写*，否则cookie就无法使用了 +// corsConfiguration.addAllowedOrigin("http://10.132.108.3"); +// //允许的头信息 +// corsConfiguration.addAllowedHeader("*"); +// //允许的请求方式 +// corsConfiguration.setAllowedMethods(Arrays.asList("POST", "PUT", "GET", "DELETE")); +// //是否发送cookie信息 +// corsConfiguration.setAllowCredentials(true); +// //预检请求的有效期，单位为秒 +// corsConfiguration.setMaxAge(3600L); +// +// //添加映射路径，标识待拦截的请求 +// UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); +// source.registerCorsConfiguration("/**", corsConfiguration); +// +// corsFilterFilterRegistrationBean.setFilter(new org.springframework.web.filter.CorsFilter(source)); +// corsFilterFilterRegistrationBean.setOrder(-1); +// return corsFilterFilterRegistrationBean; +// } +//} diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java index 4249eb2d..edb40adc 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java @@ -52,7 +52,7 @@ public class ResourcesConfig implements WebMvcConfigurer .allowedHeaders("*") //允许的请求头 .allowedMethods("GET", "POST", "PUT", "DELETE") //允许的请求方法 .maxAge(1800) //探测请求的有效期 - .allowedOrigins("http://10.132.108.3:85","http://10.76.108.1:85"); //支持的域 + .allowedOrigins("http://10.132.108.3:85","http://10.76.108.1:85","http://192.168.31.71:85"); //支持的域 } /** diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java index 6be52b5a..1b539cb5 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java @@ -1,58 +1,58 @@ -package com.zdxt.auth.framework.config; - -import org.apache.catalina.Context; -import org.apache.tomcat.util.descriptor.web.SecurityCollection; -import org.apache.tomcat.util.descriptor.web.SecurityConstraint; -import org.apache.tomcat.util.http.Rfc6265CookieProcessor; -import org.apache.tomcat.util.http.SameSiteCookies; -import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer; -import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory; -import org.springframework.boot.web.servlet.server.ServletWebServerFactory; -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; - -@Configuration -public class TomcatConfig { - - @Bean - public ServletWebServerFactory servletContainer() { - - TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory(); - - tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){ - - @Override - public void customize(Context context) { - SecurityConstraint constraint = new SecurityConstraint(); - SecurityCollection collection = new SecurityCollection(); - //http方法 - collection.addMethod("PUT"); - collection.addMethod("DELETE"); - collection.addMethod("HEAD"); -// collection.addMethod("OPTIONS"); - collection.addMethod("TRACE"); - //url匹配表达式 所有路径 - collection.addPattern("/*"); - constraint.addCollection(collection); - //设置以上HTTP方法在指定路径下需要身份验证约束 - constraint.setAuthConstraint(true); - context.addConstraint(constraint); - - //设置使用httpOnly - context.setUseHttpOnly(true); - } - }); - return tomcatServletContainerFactory; - } - //tomcat配置 - @Bean - public TomcatContextCustomizer sameSiteCookiesConfig() { - return context -> { - final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor(); - // 设置Cookie的SameSite - cookieProcessor.setSameSiteCookies(SameSiteCookies.STRICT.getValue()); - context.setCookieProcessor(cookieProcessor); - }; - } -} - +//package com.zdxt.auth.framework.config; +// +//import org.apache.catalina.Context; +//import org.apache.tomcat.util.descriptor.web.SecurityCollection; +//import org.apache.tomcat.util.descriptor.web.SecurityConstraint; +//import org.apache.tomcat.util.http.Rfc6265CookieProcessor; +//import org.apache.tomcat.util.http.SameSiteCookies; +//import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer; +//import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory; +//import org.springframework.boot.web.servlet.server.ServletWebServerFactory; +//import org.springframework.context.annotation.Bean; +//import org.springframework.context.annotation.Configuration; +// +//@Configuration +//public class TomcatConfig { +// +// @Bean +// public ServletWebServerFactory servletContainer() { +// +// TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory(); +// +// tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){ +// +// @Override +// public void customize(Context context) { +// SecurityConstraint constraint = new SecurityConstraint(); +// SecurityCollection collection = new SecurityCollection(); +// //http方法 +// collection.addMethod("PUT"); +// collection.addMethod("DELETE"); +// collection.addMethod("HEAD"); +//// collection.addMethod("OPTIONS"); +// collection.addMethod("TRACE"); +// //url匹配表达式 所有路径 +// collection.addPattern("/*"); +// constraint.addCollection(collection); +// //设置以上HTTP方法在指定路径下需要身份验证约束 +// constraint.setAuthConstraint(true); +// context.addConstraint(constraint); +// +// //设置使用httpOnly +// context.setUseHttpOnly(true); +// } +// }); +// return tomcatServletContainerFactory; +// } +// //tomcat配置 +// @Bean +// public TomcatContextCustomizer sameSiteCookiesConfig() { +// return context -> { +// final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor(); +// // 设置Cookie的SameSite +// cookieProcessor.setSameSiteCookies(SameSiteCookies.STRICT.getValue()); +// context.setCookieProcessor(cookieProcessor); +// }; +// } +//} +//