Spring Security

// 传统继承WebSecurityConfigurerAdapter（已废弃）
@Configuration
@EnableWebSecurity
public class LegacyConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated();
    }
}

// 现代组件化配置（推荐）
@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .formLogin(Customizer.withDefaults())
            .build();
    }
}

@Bean
SecurityFilterChain oauth2FilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/api/**").hasAuthority("SCOPE_read")
        )
        .oauth2ResourceServer(oauth2 -> oauth2
            .jwt(jwt -> jwt.decoder(jwtDecoder()))
        );
    return http.build();
}

@PreAuthorize("@securityService.checkProjectAccess(#projectId, 'EDIT')")
public void updateProject(String projectId, Project project) {
    // 业务逻辑
}

@Component
public class SecurityAuditor implements ApplicationListener<AuthenticationSuccessEvent> {
    @Override
    public void onApplicationEvent(AuthenticationSuccessEvent event) {
        log.info("登录成功: {}", event.getAuthentication().getName());
    }
}

# application.yml
spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://kubernetes.default.svc
          jwk-set-uri: https://kubernetes.default.svc/openid/v1/jwks

@Bean
SecurityFilterChain meshFilterChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/mesh/**")
        .addFilterBefore(new IstioJwtFilter(), BearerTokenAuthenticationFilter.class);
    return http.build();
}

sequenceDiagram
    Client->>+Ingress: 携带JWT
    Ingress->>+PDP: 校验策略
    PDP->>Ingress: 允许/拒绝
    Ingress->>+Service: 转发请求
    Service->>+PIP: 获取属性
    PIP->>Service: 返回权限上下文

# 启用缓存注解
spring.security.method.security.precache=true

// 静态路径优先匹配
http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/static/**").permitAll()
    .anyRequest().authenticated()
);

@Bean
SecurityFilterChain complianceFilterChain(HttpSecurity http) throws Exception {
    return http
        .headers(headers -> headers
            .contentSecurityPolicy(csp -> csp.policyDirectives("default-src 'self'"))
            .httpStrictTransportSecurity(hsts -> hsts
                .includeSubDomains(true)
                .maxAgeInSeconds(31536000)
            )
        )
        .sessionManagement(session -> session
            .sessionFixation().migrateSession()
            .maximumSessions(1)
        )
        .build();
}

@PreAuthorize("hasPermission(#userId, 'READ_PRIVACY_DATA')")
public PrivacyData getPrivacyData(String userId) {
    // 业务逻辑
}