Java SessionCreationPolicy类代码示例

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity http) throws Exception {

  // Disable CSRF (cross site request forgery)
  http.csrf().disable();

  // No session will be created or used by spring security
  http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

  // Entry points
  http.authorizeRequests()//
      .antMatchers("/users/signin").permitAll()//
      .antMatchers("/users/signup").permitAll()//
      // Disallow everything else..
      .anyRequest().authenticated();

  // If a user try to access a resource without having enough permissions
  http.exceptionHandling().accessDeniedPage("/login");

  // Apply JWT
  http.apply(new JwtTokenFilterConfigurer(jwtTokenProvider));

  // Optional, if you want to test the API from a browser
  // http.httpBasic();
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
public void configure(HttpSecurity http) throws Exception {
    http
        .csrf()
        .disable()
        .headers()
        .frameOptions()
        .disable()
    .and()
        .sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
    .and()
        .authorizeRequests()
        .antMatchers("/api/profile-info").permitAll()
        .antMatchers("/api/xm-entities/registration").permitAll()
        .antMatchers("/api/xm-entities/registration/activate/*").permitAll()
        .antMatchers("/api/xm-functions/call/ACCOUNT.VERIFY-CONTACT-DATA").permitAll()
        .antMatchers("/api/**").authenticated()
        .antMatchers("/management/health").permitAll()
        .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
        .antMatchers("/swagger-resources/configuration/ui").permitAll();
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .csrf()
        .disable()
        .headers()
        .frameOptions()
        .disable()
    .and()
        .sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
    .and()
        .authorizeRequests()
        .antMatchers("/api/**").authenticated()
        .antMatchers("/management/health").permitAll()
        .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
        .antMatchers("/swagger-resources/configuration/ui").permitAll()
    .and()
        .apply(securityConfigurerAdapter());
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity http) throws Exception {
    http
      .authorizeRequests()
      .antMatchers("/react/login**", "/react/after**").permitAll()
      .anyRequest().authenticated()
      .and()
      .formLogin()
      .loginPage("/react/login.html")
      .defaultSuccessUrl("/react/menu.html")
      .failureUrl("/react/login.html?error=true")
      .and().logout().logoutUrl("/react/logout.html")
      .logoutSuccessUrl("/react/after_logout.html")
      .and().sessionManagement()
      .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
      
     http.csrf().disable();    
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
protected void configure(final HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .antMatchers("/auth/login").permitAll()
            .antMatchers("/image/**").permitAll()
            .antMatchers(HttpMethod.GET, "/store/**").permitAll()
            .antMatchers(HttpMethod.POST, "/user/").permitAll()
            .antMatchers(HttpMethod.POST, "/product/**").hasAuthority(ROLE_ADMIN.name())
            .antMatchers(HttpMethod.PUT, "/product/**").hasAuthority(ROLE_ADMIN.name())
            .antMatchers(HttpMethod.DELETE, "/product/**").hasAuthority(ROLE_ADMIN.name())
            .antMatchers(HttpMethod.POST, "/stock/**").hasAnyAuthority(ROLE_ADMIN.name(), ROLE_STOCK_MANAGER.name())
            .antMatchers(HttpMethod.PUT, "/stock/**").hasAnyAuthority(ROLE_ADMIN.name(), ROLE_STOCK_MANAGER.name())
            .antMatchers(HttpMethod.DELETE, "/stock/**").hasAnyAuthority(ROLE_ADMIN.name(), ROLE_STOCK_MANAGER.name())
            .antMatchers(HttpMethod.POST, "/store/").hasAnyAuthority(ROLE_ADMIN.name(), ROLE_STORE_MANAGER.name())
            .antMatchers(HttpMethod.PUT, "/store/").hasAnyAuthority(ROLE_ADMIN.name(), ROLE_STORE_MANAGER.name())
            .antMatchers(HttpMethod.DELETE, "/store/**").hasAnyAuthority(ROLE_ADMIN.name(), ROLE_STORE_MANAGER.name())
            .anyRequest().authenticated()
            .and()
            .addFilterBefore(filter(), UsernamePasswordAuthenticationFilter.class)
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .csrf().disable();
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
public void configure(HttpSecurity http) throws Exception {
    http
        .csrf()
        .disable()
        .headers()
        .frameOptions()
        .disable()
    .and()
        .sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
    .and()
        .authorizeRequests()
        .antMatchers("/api/profile-info").permitAll()
        .antMatchers("/api/**").authenticated()
        .antMatchers("/management/health").permitAll()
        .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
        .antMatchers("/swagger-resources/configuration/ui").permitAll();
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity http) throws Exception {
	http
		.csrf()
		.disable()
		.authorizeRequests()
			.antMatchers("/home/**").permitAll()
	.and()
		.authorizeRequests()
			.antMatchers(HttpMethod.GET, "/app/**").permitAll()
			.antMatchers(HttpMethod.POST, "/app/**").hasRole("SEAT")

	.and()
		.httpBasic()
		.realmName(REALM)
		.authenticationEntryPoint(getBasicAuthEntryPoint())
	.and()
		.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity http) throws Exception {	
	http.httpBasic();
	http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.ALWAYS);
	http.authorizeRequests().anyRequest().permitAll().anyRequest().anonymous();
	http.antMatcher("/**/orderbook").authorizeRequests().anyRequest().authenticated(); 
	http.csrf().disable();
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity http) throws Exception {

    http = http.addFilter(new WebAsyncManagerIntegrationFilter());
    http = http.addFilterBefore(jwtAuthFilter(), UsernamePasswordAuthenticationFilter.class);

    http
            .antMatcher("/ext/**")
            .csrf().requireCsrfProtectionMatcher(csrfSecurityRequestMatcher).and()
            .headers().frameOptions().sameOrigin().and()
            .authorizeRequests()
            .antMatchers("/ext/stream/**", "/ext/coverArt*", "/ext/share/**", "/ext/hls/**")
            .hasAnyRole("TEMP", "USER").and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
            .exceptionHandling().and()
            .securityContext().and()
            .requestCache().and()
            .anonymous().and()
            .servletApi();
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
@SuppressWarnings("PMD.SignatureDeclareThrowsException")
protected void configure(HttpSecurity http) throws Exception {
    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        .and()
        .addFilter(requestHeaderAuthenticationFilter())
        .addFilter(new AnonymousAuthenticationFilter("anonymous"))
        .authorizeRequests()
        .antMatchers(HttpMethod.OPTIONS).permitAll()
        .antMatchers("/api/v1/swagger.*").permitAll()
        .antMatchers("/api/v1/index.html").permitAll()
        .antMatchers("/api/v1/version").permitAll()
        .antMatchers(HttpMethod.GET, "/api/v1/credentials/callback").permitAll()
        .antMatchers("/api/v1/**").hasRole("AUTHENTICATED")
        .anyRequest().permitAll();

    http.csrf().disable();
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
    httpSecurity
            // we don't need CSRF because our token is invulnerable
            .csrf().disable()
            .authorizeRequests()
            // All urls must be authenticated (filter for token always fires (/**)
            .antMatchers(HttpMethod.OPTIONS, "/login").permitAll()
            .requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
            .anyRequest().authenticated()
            .and()
            // Call our errorHandler if authentication/authorisation fails
            .exceptionHandling()
            .authenticationEntryPoint((httpServletRequest, httpServletResponse, e) -> httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"))
            .and()
            // don't create session
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            // 添加一个过滤器 所有访问 /login 的请求交给 JWTLoginFilter 来处理 这个类处理所有的JWT相关内容
            .and().addFilterBefore(new JwtAuthenticationTokenFilter("/login", authenticationManager()),
                    UsernamePasswordAuthenticationFilter.class)
            // 添加一个过滤器验证其他请求的Token是否合法
            .addFilterBefore(new JWTAuthenticationFilter(),
                    UsernamePasswordAuthenticationFilter.class);
    // disable page caching
    httpSecurity.headers().cacheControl();
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
	httpSecurity
		.csrf()
	    	.disable()
	    .exceptionHandling()
	        .authenticationEntryPoint(this.unauthorizedHandler)
	        .and()
	    .sessionManagement()
	    	.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
	        .and()
	    .authorizeRequests()
	        .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
	        .antMatchers("/auth/**").permitAll()
	        .antMatchers("/anonymous/**").permitAll()
	
	        .anyRequest().authenticated();
	
	    // Custom JWT based authentication
    httpSecurity
    	.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable()
            .exceptionHandling().authenticationEntryPoint(unauthorizedHandler)
            .and()
            .authorizeRequests()
            .antMatchers(HttpMethod.POST,"/**").authenticated()
            .antMatchers(HttpMethod.POST, "/login").permitAll()
            .and()
            .formLogin()
            .and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .logout()
            .and()
            .addFilterBefore(new JwtLoginFilter(urlLogin, authenticationManager(), tokenAuthenticationService), UsernamePasswordAuthenticationFilter.class)
            .addFilterBefore(new JwtAuthenticationFilter(tokenAuthenticationService), UsernamePasswordAuthenticationFilter.class)
            .headers().cacheControl();
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
    httpSecurity
    		.cors()
    		.and()
            // we don't need CSRF because our token is invulnerable
            .csrf().disable()
            // All urls must be authenticated (filter for token always fires (/**)
            .authorizeRequests()
            	.antMatchers(HttpMethod.OPTIONS).permitAll()
            	.antMatchers("/auth/**").authenticated()
            .and()
            // don't create session
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS); //.and()
    // Custom JWT based security filter
    httpSecurity
            .addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
            

    // disable page caching
    // httpSecurity.headers().cacheControl();
}
 

import org.springframework.security.config.http.SessionCreationPolicy; //导入依赖的package包/类
@Override
  protected void configure(HttpSecurity http) throws Exception {
http.addFilterBefore(tokenProcessingFilter(), BasicAuthenticationFilter.class).csrf().disable().httpBasic()
      	.and().authorizeRequests()
              .antMatchers("/login/**", "/profile/**").hasRole("USER")
              .and().authorizeRequests().anyRequest().permitAll()
             /* .and()
          .apply(new SpringSocialConfigurer() 
      ) */
              .and().authorizeRequests().antMatchers(
              		"/user/**",
              		"/users/**",
              		"/contacts**",
              		"/contacts/**",
              		"/contacts",
              		"/game/**",
              		"/games/**"
              		).hasRole("USER")
              .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
              ;
  }