.antMatchers(xx).permitAll()不生效原因

最新推荐文章于 2024-05-26 14:42:28 发布

原创最新推荐文章于 2024-05-26 14:42:28 发布 · 3.5k 阅读

4 ·

CC 4.0 BY-SA版权

文章标签：

#java #servlet #开发语言

文章描述了一个在使用SpringGateway时遇到的问题，即由于在header中添加了token，导致某些请求出现问题。解决方案是通过实现GlobalFilter，在过滤器链中检查请求路径，如果路径匹配到忽略权限验证的URL，则移除header中的authorizationtoken，从而允许这些请求通过而不进行权限验证。

原因是header中加了token，把token移除就可以了

@Component
@Slf4j
public class RequestUrlGlobalFilter implements GlobalFilter {

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {

        ServerHttpRequest request = exchange.getRequest();
        String path = request.getURI().getPath();

        //ResourceConstant.IGNORING_URLS为忽略权限验证的数组
        for(String url : ResourceConstant.IGNORING_URLS){
            if(Pattern.matches(url, path)){
                HttpHeaders headers = new HttpHeaders();
                headers.putAll(exchange.getRequest().getHeaders());
                ServerHttpRequest decorator = decorate(exchange, headers);
                return chain.filter(exchange.mutate().request(decorator).build());
            }
        }

        return chain.filter(exchange);
    }

private ServerHttpRequestDecorator decorate(ServerWebExchange exchange, HttpHeaders headers) {
        return new ServerHttpRequestDecorator(exchange.getRequest()) {
            @Override
            public HttpHeaders getHeaders() {
                HttpHeaders httpHeaders = new HttpHeaders();
                httpHeaders.putAll(super.getHeaders());
                httpHeaders.remove("authorization");
                return httpHeaders;
            }
        };
    }
}