接口对接

src/main/java/com/arrokoth/standalone/authorization/config/CorsConfig.java

@@ -1,7 +1,6 @@
 package com.arrokoth.standalone.authorization.config;
 
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
@@ -20,22 +19,22 @@ public class CorsConfig {
     /**
      * 默认允许的跨域源（Origin）：所有域名都允许访问。
      */
-    private static final String DEFAULT_ALLOWED_ORIGINS = "*";
+    public static final String DEFAULT_ALLOWED_ORIGINS = "*";
 
     /**
      * 默认允许的请求头（Headers）：接受所有类型的请求头。
      */
-    private static final String DEFAULT_ALLOWED_HEADERS = "*";
+    public static final String DEFAULT_ALLOWED_HEADERS = "*";
 
     /**
      * 默认允许的 HTTP 方法：包括 OPTIONS, HEAD, GET, POST, PUT, DELETE, PATCH。
      */
-    private static final String DEFAULT_ALLOWED_METHODS = "OPTIONS,HEAD,GET,POST,PUT,DELETE,PATCH";
+    public static final String DEFAULT_ALLOWED_METHODS = "OPTIONS,HEAD,GET,POST,PUT,DELETE,PATCH";
 
     /**
      * 预检请求（preflight）的最大缓存时间（单位：秒），默认为 3600 秒（1 小时）。
      */
-    private static final String DEFAULT_MAX_AGE = "3600";
+    public static final String DEFAULT_MAX_AGE = "3600";
 
     /**
      * 构建并返回一个 CORS 配置对象。
@@ -62,7 +61,7 @@ public class CorsConfig {
      *
      * @return CorsFilter 实例
      */
-    @Bean
+//    @Bean
     public CorsFilter corsFilter() {
         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
         source.registerCorsConfiguration("/**", buildConfig()); // 对所有路径启用 CORS 配置

src/main/java/com/arrokoth/standalone/authorization/config/SecurityWebAutoConfigurer.java

@@ -20,7 +20,6 @@ import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
-import java.util.Arrays;
 import java.util.List;
 
 @Slf4j
@@ -38,7 +37,7 @@ public class SecurityWebAutoConfigurer {
         log.debug("Configuring default security filter chain");
         http
                 .csrf(AbstractHttpConfigurer::disable) // 前后端分离通常关闭CSRF
-                .cors(cors -> cors.configurationSource(corsConfigurationSource())) // 启用 CORS 并使用自定义配置
+                .cors(AbstractHttpConfigurer::disable) // 前后端分离通常关闭CSRF
                 .sessionManagement(session -> session
                         .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)) // 无状态Session
                 .authorizeHttpRequests(auth -> auth
@@ -76,10 +75,13 @@ public class SecurityWebAutoConfigurer {
     public CorsConfigurationSource corsConfigurationSource() {
         log.info("Configuring cors configuration source");
         CorsConfiguration configuration = new CorsConfiguration();
-        configuration.setExposedHeaders(List.of("Authorization")); // 允许前端访问Authorization头
+
+
+        configuration.addAllowedOrigin(CorsConfig.DEFAULT_ALLOWED_ORIGINS); // 允许任意来源
+        configuration.addAllowedHeader(CorsConfig.DEFAULT_ALLOWED_HEADERS); // 允许任意请求头
+        configuration.addAllowedMethod(CorsConfig.DEFAULT_ALLOWED_METHODS); // 允许指定的方法
+        configuration.setMaxAge(Long.parseLong(CorsConfig.DEFAULT_MAX_AGE)); // 设置预检请求缓存时间
         configuration.setAllowedOrigins(List.of("*")); // 替换为前端域名
-        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
-        configuration.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type", "X-Requested-With", "accept", "X-XSRF-TOKEN"));
         configuration.setAllowCredentials(false);
         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
         source.registerCorsConfiguration("/**", configuration);

src/main/java/com/arrokoth/standalone/authorization/filter/JwtRequestFilter.java

@@ -26,8 +26,7 @@ public class JwtRequestFilter extends OncePerRequestFilter {
     private final RedisTokenService redisTokenService;
 
     @Override
-    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
-            throws ServletException, IOException {
 
         final String authorizationHeader = request.getHeader("Authorization");
 
@@ -39,8 +38,14 @@ public class JwtRequestFilter extends OncePerRequestFilter {
             try {
                 username = JwtUtils.extractUsername(jwt);
             } catch (Exception e) {
-                logger.warn("Failed to extract username from token", e);
+                logger.warn("Failed to extract username from token");
+                response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid token");
+                return;
             }
+        } else {
+            // 没有 token，继续链（可能是登录接口等不需要认证的路径）
+            chain.doFilter(request, response);
+            return;
         }
 
         if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
@@ -55,6 +60,10 @@ public class JwtRequestFilter extends OncePerRequestFilter {
                 UsernamePasswordAuthenticationToken authentication =
                         new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                 SecurityContextHolder.getContext().setAuthentication(authentication);
+            } else {
+                // token 无效或已过期
+                response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Token is expired or invalid");
+                return;
             }
         }
 

src/main/resources/application.yml

@@ -2,6 +2,8 @@ server:
   port: 8080
 
 arrokoth:
+  logger:
+    enabled: false
   authorization:
     server:
       consent-page: /oauth2/consent
@@ -16,6 +18,7 @@ arrokoth:
         - /home/login
         - /login/oauth2/**
         - /oauth2/token
+        - /system/dict/getDictData
 
   # RestApi增强配置
   graceful-rest-response:
@@ -63,5 +66,3 @@ logging:
     com.arrokoth: DEBUG
     org.springdoc: INFO
     org.springframework: INFO
-    org.springframework.security: DEBUG
-    org.springframework.security.oauth2: DEBUG