核心代碼 ## yml 里配置白名單接口 ``` security: ignore: whites: # file - /file/viewByUrl ``` ## 讀取 yml中的list IgnoreWhiteProperties.class ``` import org.springframework.boot.context.properties.ConfigurationProperties; import org.springframework.context.annotation.Configuration; import java.util.ArrayList; import java.util.List; /** * 放行白名單配置 * */ @Configuration @ConfigurationProperties(prefix = "security.ignore") public class IgnoreWhiteProperties { /** * 放行白名單配置，網關不校驗此處的白名單 */ private List<String> whites = new ArrayList<>(); public List<String> getWhites() { return whites; } public void setWhites(List<String> whites) { this.whites = whites; } } ``` ## spring security 配置 SecurityConfig 類里增加 ``` @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true) public class SecurityConfig extends WebSecurityConfigurerAdapter { /** * YML 配置的允許匿名訪問的地址 */ @Autowired private IgnoreWhiteProperties ignoreWhiteList; configure 方法中增加 // YML 配置的白名單 List<String> whites = ignoreWhiteList.getWhites(); String[] whitesString = new String[whites.size()]; whites.toArray(whitesString); 在 .antMatchers("/login", "/register", "/captchaImage").permitAll() 后面增加 ..antMatchers(whitesString).permitAll() } ```