升级springboot2.7，Spring Security 5.7.14

docs/spring-boot-2.7-upgrade-guide.md

@@ -0,0 +1,596 @@
+# Spring Boot 2.2.13 → 2.7.18 升级指南
+
+> 本文档基于 `ylrz_his_scrm_java` 项目现状编写，目标版本：**Spring Boot 2.7.18**（2.x 末代 LTS，仍支持 Java 8）。
+
+---
+
+## 一、升级概览
+
+### 1.1 当前 vs 目标
+
+| 项 | 当前 | 升级后（Boot 2.7.18 BOM 默认） |
+|---|---|---|
+| Spring Boot | 2.2.13.RELEASE | **2.7.18** |
+| Spring Framework | 5.2.x | **5.3.31** |
+| Spring Security | 5.2.15（手动覆盖） | **5.7.11**（随 BOM，可不再 pin） |
+| Java | 1.8 | 1.8（不变） |
+| Servlet API | javax.* | javax.*（**不涉及 Jakarta 迁移**） |
+
+### 1.2 项目规模（影响工作量）
+
+| 维度 | 数量 |
+|---|---|
+| Java 源文件 | ~8500 |
+| Maven 模块 | 36+ |
+| 可运行 Spring Boot 应用 | **28** |
+| `SecurityConfig`（需迁移） | **26** |
+| `SwaggerConfig`（Springfox） | **23** |
+| `HandlerInterceptorAdapter`（已废弃） | **37** |
+| 共享配置文件 | `fs-service/src/main/resources/application-common.yml` |
+
+### 1.3 预估工期
+
+| 阶段 | 内容 | 预估 |
+|---|---|---|
+| 阶段 0 | 准备与分支 | 0.5 天 |
+| 阶段 1 | POM / 依赖 | 1–2 天 |
+| 阶段 2 | 全局运行时配置 | 0.5 天 |
+| 阶段 3 | Spring Security 迁移 | 3–5 天 |
+| 阶段 4 | Swagger 兼容 | 1–3 天 |
+| 阶段 5 | 编译修复 & 启动 | 2–3 天 |
+| 阶段 6 | 回归测试 | 1–2 周 |
+
+**合计：约 2–4 周**（1 人全职，视测试深度而定）。
+
+---
+
+## 二、升级前准备（阶段 0）
+
+### 2.1 创建升级分支
+
+```bash
+git checkout -b feature/spring-boot-2.7.18
+```
+
+### 2.2 建立基线
+
+- 记录当前各核心模块能否正常 `mvn package`、能否启动。
+- 导出当前依赖树备查：
+
+```bash
+mvn dependency:tree -pl fs-admin -Dverbose > docs/upgrade-baseline-admin-deps.txt
+mvn dependency:tree -pl fs-user-app -Dverbose > docs/upgrade-baseline-user-app-deps.txt
+```
+
+### 2.3 确定升级范围
+
+建议**一次性升 BOM**，不要停留在 2.3/2.5 中间版本——你们从 2.2 直接到 2.7，中间破坏性变更（路径匹配、循环依赖、Security API）集中处理更高效。
+
+### 2.4 升级顺序建议
+
+```
+fs-common / fs-framework（基础）
+    ↓
+fs-service（业务核心）
+    ↓
+fs-admin / fs-user-app / fs-company（主入口）
+    ↓
+其余 API / 任务 / MQ 模块
+```
+
+---
+
+## 三、依赖与 POM 升级（阶段 1）
+
+### 3.1 修改根 `pom.xml`
+
+#### 3.1.1 升级 Spring Boot BOM
+
+```xml
+<dependency>
+    <groupId>org.springframework.boot</groupId>
+    <artifactId>spring-boot-dependencies</artifactId>
+    <version>2.7.18</version>
+    <type>pom</type>
+    <scope>import</scope>
+</dependency>
+```
+
+#### 3.1.2 新增/调整 properties（建议值）
+
+```xml
+<properties>
+    <!-- 核心 -->
+    <spring-boot.version>2.7.18</spring-boot.version>
+
+    <!-- 第三方 starter（与 Boot 2.7 对齐） -->
+    <mybatis-spring-boot.version>2.3.2</mybatis-spring-boot.version>
+    <druid.version>1.2.23</druid.version>
+
+    <!-- Redisson：Boot 2.7 对应 spring-data-27 -->
+    <redisson.version>3.27.2</redisson.version>
+
+    <!-- MyBatis-Plus：当前 3.1.0 过旧，建议升级 -->
+    <mybatis-plus.version>3.5.5</mybatis-plus.version>
+</properties>
+```
+
+#### 3.1.3 移除或下调的手动覆盖
+
+升级到 2.7.18 后，以下覆盖**可先删除**，改由 BOM 管理；删除后跑 `dependency:tree` 确认无 CVE 回退：
+
+| 属性 / 依赖 | 当前 | 建议 |
+|---|---|---|
+| `spring-security.version` 及 core/web/config 三件套 | 5.2.15 手动 pin | **删除**，使用 BOM 5.7.x |
+| `jackson.version` / `jackson-bom` | 2.12.7 手动 pin | **删除或改为仅覆盖个别 artifact** |
+| `logback.version` | 1.2.13 | Boot 2.7 自带 1.2.12+，可删除 |
+| `snakeyaml.version` | 1.33 | Boot 2.7 自带 1.30+，可删除 |
+
+**保留**（仍可能有传递依赖冲突）：
+
+- `netty.version`、`hutool.version`、`okhttp.version`、`fastjson.version` 等安全相关 pin
+- `pagehelper`（你们有 SQL 注入 CVE 注释，需验证 BOM 版本是否 ≥ 5.3.1）
+
+#### 3.1.4 Redisson 适配（必改）
+
+根 `pom.xml` 与 `fs-service/pom.xml` 中：
+
+```xml
+<!-- 改前 -->
+<artifactId>redisson-spring-data-22</artifactId>
+
+<!-- 改后 -->
+<artifactId>redisson-spring-data-27</artifactId>
+```
+
+`fs-service/pom.xml` 中排除 `redisson-spring-data-32` 的注释也需同步更新。
+
+#### 3.1.5 统一 spring-boot-maven-plugin
+
+当前各可运行模块 pin 了 **2.1.1.RELEASE**（如 `fs-admin/pom.xml`），建议：
+
+**方案 A（推荐）**：在根 `pom.xml` 的 `pluginManagement` 中统一管理：
+
+```xml
+<pluginManagement>
+    <plugins>
+        <plugin>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-maven-plugin</artifactId>
+            <version>${spring-boot.version}</version>
+        </plugin>
+    </plugins>
+</pluginManagement>
+```
+
+子模块删除 `<version>2.1.1.RELEASE</version>`。
+
+**涉及模块（27 个）**：fs-admin、fs-user-app、fs-company、fs-company-app、fs-doctor-app、fs-store、fs-qw-*、fs-live-*、fs-ad-*、fs-wx-api、fs-watch、fs-redis、fs-websocket、fs-ai-chat、fs-common-api、fs-repeat-api、fs-ipad-task、fs-qwhook* 等。
+
+### 3.2 修改 `fs-common/pom.xml`
+
+#### 3.2.1 MyBatis-Plus
+
+```xml
+<!-- 改前 -->
+<artifactId>mybatis-plus-boot-starter</artifactId>
+<version>3.1.0</version>
+
+<!-- 改后 -->
+<artifactId>mybatis-plus-boot-starter</artifactId>
+<version>${mybatis-plus.version}</version>  <!-- 3.5.5 -->
+```
+
+#### 3.2.2 spring-expression 版本冲突（重要）
+
+当前 `fs-common/pom.xml` 显式依赖了 **spring-expression 6.2.0**（Spring 6），与 Boot 2.7 的 Spring 5.3 **不兼容**。
+
+```xml
+<!-- 建议：删除该依赖，或改为不指定 version，由 BOM 管理 -->
+<dependency>
+    <groupId>org.springframework</groupId>
+    <artifactId>spring-expression</artifactId>
+    <!-- 删除 <version>6.2.0</version> -->
+</dependency>
+```
+
+### 3.3 MySQL 驱动（可选）
+
+Boot 2.7 仍支持 `mysql-connector-java`，但官方已迁移到 `com.mysql:mysql-connector-j`。短期可不改；长期建议替换：
+
+```xml
+<dependency>
+    <groupId>com.mysql</groupId>
+    <artifactId>mysql-connector-j</artifactId>
+</dependency>
+```
+
+### 3.4 验证命令
+
+```bash
+# 全量编译（先不要求启动）
+mvn clean compile -DskipTests
+
+# 检查冲突
+mvn dependency:tree -pl fs-admin | findstr /i "spring-security spring-framework spring-expression"
+```
+
+---
+
+## 四、全局运行时配置（阶段 2）
+
+在 `fs-service/src/main/resources/application-common.yml` 的 `spring:` 节点下增加：
+
+```yaml
+spring:
+  # Boot 2.6+ 默认禁止循环依赖，老项目常见此问题
+  main:
+    allow-circular-references: true   # 临时方案；启动稳定后逐步改为 false 并重构
+
+  # Boot 2.6+ 默认 PathPatternParser，与 Springfox 2.9.2 / 部分 antMatchers 不兼容
+  mvc:
+    pathmatch:
+      matching-strategy: ant_path_matcher   # 短期保留 Springfox 时使用
+```
+
+> **说明**：`ant_path_matcher` 在 2.7 仍可用但已标记为过渡方案。若后续迁移到 springdoc-openapi，可移除此配置。
+
+### 4.1 Tomcat 配置项更名（如遇警告）
+
+Boot 2.4+ 部分 `server.tomcat.*` 属性已更名，你们当前使用：
+
+```yaml
+server:
+  tomcat:
+    max-threads: 800        # 建议改为 max-threads 或 threads.max
+    min-spare-threads: 30   # 建议改为 threads.min-spare
+```
+
+启动时若出现 deprecated 警告，按 Boot 2.7 文档调整即可，不影响功能。
+
+---
+
+## 五、Spring Security 迁移（阶段 3，工作量最大）
+
+### 5.1 背景
+
+- Boot 2.7 自带 **Spring Security 5.7.x**
+- `WebSecurityConfigurerAdapter` 已在 5.7 **移除**
+- 项目共 **26 个** `SecurityConfig` 需迁移
+
+### 5.2 配置文件分类
+
+#### A 类：全放行 + StrictHttpFirewall（17 个，改动模式相同）
+
+适用模块：fs-user-app、fs-doctor-app、fs-live-app、fs-live-mq、fs-watch、fs-redis、fs-wx-api、fs-ad-api、fs-ad-new-api、fs-common-api、fs-repeat-api、fs-qwhook、fs-qwhook-msg、fs-qwhook-sop、fs-qw-mq、fs-qw-voice、fs-user-app-ai-chat、fs-company-app
+
+参考现有代码：`fs-user-app/.../SecurityConfig.java`
+
+#### B 类：JWT 完整鉴权（7 个，规则较多）
+
+| 模块 | 文件 | 特殊点 |
+|---|---|---|
+| fs-framework | `fs-framework/.../SecurityConfig.java` | **fs-admin 依赖此模块**，规则最全 |
+| fs-company | `fs-company/.../SecurityConfig.java` | 使用 `MD5PasswordEncoder` |
+| fs-store | `fs-store/.../SecurityConfig.java` | 使用 `MD5PasswordEncoder` |
+| fs-qw-api | `fs-qw-api/.../SecurityConfig.java` | JWT + 白名单 |
+| fs-qw-api-msg | `fs-qw-api-msg/.../SecurityConfig.java` | JWT + 白名单 |
+| fs-qw-company-api | `fs-qw-company-api/.../SecurityConfig.java` | JWT + 白名单 |
+| fs-qw-task | `fs-qw-task/.../SecurityConfig.java` | JWT + 白名单 |
+| fs-ipad-task | `fs-ipad-task/.../SecurityConfig.java` | JWT + 白名单 |
+
+> **fs-admin** 无独立 SecurityConfig，通过 `fs-framework` 生效。
+
+### 5.3 推荐重构策略（减少重复劳动）
+
+**不要 26 个文件各改一遍。** 建议：
+
+1. 在 `fs-framework` 新增 2 个基类/工具：
+   - `PermitAllSecurityConfiguration`（A 类）
+   - `JwtSecurityConfigurationSupport`（B 类，抽取 filter 链构建）
+2. 各模块 `SecurityConfig` 改为 `@Import` 或 `@Configuration` + `@Bean SecurityFilterChain`
+3. 模块级差异（白名单 URL）通过 `@ConfigurationProperties` 或子类 override 注入
+
+### 5.4 迁移模板
+
+#### A 类：全放行（替代 `fs-user-app` 现有写法）
+
+```java
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http
+            .csrf(csrf -> csrf.disable())
+            .authorizeHttpRequests(auth -> auth
+                .anyRequest().permitAll()
+            );
+        return http.build();
+    }
+
+    @Bean
+    public AuthenticationManager authenticationManager(
+            AuthenticationConfiguration configuration) throws Exception {
+        return configuration.getAuthenticationManager();
+    }
+
+    @Bean
+    public StrictHttpFirewall httpFirewall() {
+        StrictHttpFirewall firewall = new StrictHttpFirewall();
+        firewall.setAllowUrlEncodedDoubleSlash(true);
+        return firewall;
+    }
+}
+```
+
+#### B 类：JWT 鉴权（替代 `fs-framework` 现有写法）
+
+```java
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig {
+
+    @Autowired private UserDetailsService userDetailsService;
+    @Autowired private AuthenticationEntryPointImpl unauthorizedHandler;
+    @Autowired private LogoutSuccessHandlerImpl logoutSuccessHandler;
+    @Autowired private JwtAuthenticationTokenFilter authenticationTokenFilter;
+    @Autowired private CorsFilter corsFilter;
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http
+            .csrf(csrf -> csrf.disable())
+            .exceptionHandling(ex -> ex.authenticationEntryPoint(unauthorizedHandler))
+            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+            .authorizeHttpRequests(auth -> auth
+                .requestMatchers("/login", "/register", "/captchaImage").anonymous()
+                .requestMatchers(HttpMethod.GET, "/", "/*.html", "/**/*.html", "/**/*.css", "/**/*.js").permitAll()
+                // ... 保留原有全部 antMatchers 路径 ...
+                .anyRequest().authenticated()
+            )
+            .headers(headers -> headers.frameOptions(frame -> frame.disable()))
+            .logout(logout -> logout
+                .logoutUrl("/logout")
+                .logoutSuccessHandler(logoutSuccessHandler)
+            );
+
+        http.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
+        http.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
+        http.addFilterBefore(corsFilter, LogoutFilter.class);
+
+        return http.build();
+    }
+
+    @Bean
+    public AuthenticationManager authenticationManager(
+            AuthenticationConfiguration configuration) throws Exception {
+        return configuration.getAuthenticationManager();
+    }
+
+    @Bean
+    public BCryptPasswordEncoder bCryptPasswordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+
+    @Autowired
+    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
+        auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
+    }
+}
+```
+
+#### API 对照表
+
+| 旧 API（5.2 / WebSecurityConfigurerAdapter） | 新 API（5.7 / SecurityFilterChain） |
+|---|---|
+| `extends WebSecurityConfigurerAdapter` | `@Bean SecurityFilterChain` |
+| `@EnableGlobalMethodSecurity` | `@EnableMethodSecurity` |
+| `configure(HttpSecurity http)` | `securityFilterChain(HttpSecurity http)` |
+| `authorizeRequests()` | `authorizeHttpRequests()` |
+| `antMatchers(...)` | `requestMatchers(...)` |
+| `authenticationManagerBean()` | `AuthenticationConfiguration.getAuthenticationManager()` |
+| `.csrf().disable()` | `.csrf(csrf -> csrf.disable())` |
+
+### 5.5 处理 fs-common 中的 Security 补丁
+
+升级后 Spring Security 升至 5.7.x，需重新评估以下类：
+
+| 文件 | 用途 | 建议 |
+|---|---|---|
+| `EagerSecurityHeadersBeanPostProcessor` | CVE-2026-22732 缓解 | 5.7 有官方修复，**验证后可删除** |
+| `TimingSafeAuthenticationManagerBeanPostProcessor` | CVE-2026-22746 缓解 | 5.7.23+ 有修复；先保留，官方版本覆盖后删除 |
+| `TimingSafeDaoAuthenticationProvider` | 同上 | 同上 |
+| `org.springframework.security.*` 包下自研类 | 覆盖框架类 | 升级后重点回归登录接口 |
+
+**注意**：不要同时保留自研 `TimingSafeDaoAuthenticationProvider` 与官方修复版行为，避免双重逻辑。
+
+### 5.6 Security 迁移检查清单
+
+- [ ] 26 个 `SecurityConfig` 编译通过
+- [ ] fs-admin 登录 / 登出 / JWT 刷新
+- [ ] fs-user-app 接口鉴权（当前全 permitAll，确认是否符合预期）
+- [ ] fs-company / fs-store 的 MD5 密码编码仍生效
+- [ ] 各模块 Swagger 白名单路径仍可匿名访问
+- [ ] `@PreAuthorize` / `@Secured` 注解权限仍生效
+
+---
+
+## 六、Swagger / Springfox 兼容（阶段 4）
+
+### 6.1 现状
+
+- 使用 **Springfox 2.9.2**（`swagger.version`）
+- **23 个** `SwaggerConfig` + 多个 `ResourcesConfig` 注册 Swagger 静态资源
+- 共享配置 `application-common.yml` 中 `swagger.enabled: false`（生产默认关闭）
+
+### 6.2 短期方案（推荐先做，保证升级后能启动）
+
+1. 阶段 2 已配置 `spring.mvc.pathmatch.matching-strategy: ant_path_matcher`
+2. 保持 Springfox 2.9.2 不变
+3. 启动后访问 `/swagger-ui.html` 验证
+
+**已知风险**：Springfox 已停止维护，与 Boot 2.7 是「勉强兼容」，不是长期方案。
+
+### 6.3 长期方案（可选，单独排期）
+
+迁移到 **springdoc-openapi 1.7.x**（支持 Boot 2.7 + Java 8）：
+
+```xml
+<dependency>
+    <groupId>org.springdoc</groupId>
+    <artifactId>springdoc-openapi-ui</artifactId>
+    <version>1.7.0</version>
+</dependency>
+```
+
+- 删除 Springfox 依赖
+- 23 个 `SwaggerConfig` 合并为 1 个公共配置或删除（springdoc 自动扫描）
+- Controller 上 `@Api` → `@Tag`，`@ApiOperation` → `@Operation`（可渐进）
+
+### 6.4 SwaggerConfig 文件清单
+
+```
+fs-admin/src/main/java/com/fs/web/core/config/SwaggerConfig.java
+fs-user-app/.../SwaggerConfig.java
+fs-company-app/.../core/config/SwaggerConfig.java
+fs-doctor-app、fs-live-app、fs-live-mq、fs-watch、fs-redis、
+fs-wx-api、fs-ad-api、fs-common-api、fs-repeat-api、
+fs-qw-api、fs-qw-api-msg、fs-qw-company-api、fs-qw-task、
+fs-qw-mq、fs-qw-voice、fs-ipad-task、
+fs-qwhook、fs-qwhook-msg、fs-qwhook-sop、
+fs-user-app-ai-chat
+```
+
+---
+
+## 七、其他代码调整（阶段 5）
+
+### 7.1 HandlerInterceptorAdapter（37 处，低优先级）
+
+多个模块的 `RepeatSubmitInterceptor`、`AuthorizationInterceptor` 继承了 `HandlerInterceptorAdapter`。
+
+- Boot 2.7 下**仍可编译运行**（deprecated）
+- 建议后续改为直接实现 `HandlerInterceptor` 接口，删除 `extends HandlerInterceptorAdapter`
+
+### 7.2 MyBatis / MyBatis-Plus
+
+- 升级 MyBatis-Plus 3.1.0 → 3.5.5 后，关注：
+  - `fieldStrategy: NOT_EMPTY` 等全局配置是否仍兼容（3.5 部分枚举有变更）
+  - 分页插件、乐观锁、多租户等自定义配置
+- 23 个 `MyBatisConfig.java` 若仅做别名扫描，一般无需改动
+
+### 7.3 业务代码
+
+- **无需 Jakarta 包名替换**（`javax.servlet` 等保持不变）
+- `fs-service` 等业务 Service / Controller **预计改动极少**
+- 重点回归：支付、订单、企微回调、直播、课程观看、Redis 锁
+
+---
+
+## 八、分模块启动验证（阶段 5–6）
+
+### 8.1 启动顺序
+
+| 优先级 | 模块 | 验证重点 |
+|---|---|---|
+| P0 | fs-admin | 后台登录、菜单权限、Swagger |
+| P0 | fs-user-app | C 端 API、微信支付、订单 |
+| P0 | fs-company | 企业端 JWT、CRM |
+| P1 | fs-qw-api / fs-qw-task | 企微回调、定时任务 |
+| P1 | fs-live-app / fs-live-mq | 直播、MQ 消费 |
+| P2 | fs-qwhook* / fs-wx-api / fs-ad-* | 回调、广告 |
+| P2 | 其余模块 | 能启动、核心接口 200 |
+
+### 8.2 单模块启动示例
+
+```bash
+cd fs-admin
+mvn spring-boot:run -Dspring-boot.run.profiles=dev
+```
+
+### 8.3 常见问题排查
+
+| 现象 | 可能原因 | 处理 |
+|---|---|---|
+| 启动报循环依赖 | Boot 2.6+ 默认禁止 | `allow-circular-references: true` |
+| Swagger 404 / 空文档 | PathPattern 不兼容 | `ant_path_matcher` |
+| 403 增多 | Security 规则迁移遗漏 | 对比旧 `antMatchers` 列表 |
+| Redisson 启动失败 | spring-data 版本不匹配 | 改用 `redisson-spring-data-27` |
+| `NoClassDefFoundError: spring-expression` | fs-common pin 了 Spring 6 | 删除 version 6.2.0 |
+| 静态资源 404 | ResourcesConfig 路径匹配变化 | 检查 `ResourcesConfig` |
+
+---
+
+## 九、回归测试清单（阶段 6）
+
+### 9.1 基础设施
+
+- [ ] 多数据源 / Druid 连接池正常
+- [ ] Redis / Redisson 分布式锁
+- [ ] MyBatis / MyBatis-Plus CRUD、分页
+- [ ] 定时任务（fs-quartz）
+- [ ] WebSocket（fs-websocket）
+
+### 9.2 安全
+
+- [ ] 各端登录（admin / user / company / doctor）
+- [ ] JWT 过期与刷新
+- [ ] 权限注解 `@PreAuthorize`
+- [ ] 匿名白名单（支付回调、企微回调、物流回调）
+
+### 9.3 业务链路
+
+- [ ] 下单 → 支付 → 回调
+- [ ] 售后 / 退款
+- [ ] 课程观看 / 完播任务（fs-qw-task）
+- [ ] 企微 SOP / 消息推送
+- [ ] 直播下单 / 购物车
+- [ ] 文件上传 OSS
+
+---
+
+## 十、推荐执行步骤汇总
+
+```
+阶段 0  建分支、打基线、确认回滚方案
+   ↓
+阶段 1  升 BOM 2.7.18 → Redisson 27 → MyBatis-Plus → 删 spring-expression 6.2.0
+   ↓        统一 spring-boot-maven-plugin
+   ↓
+阶段 2  application-common.yml 加 circular-ref + ant_path_matcher
+   ↓
+阶段 3  重构 SecurityConfig（先 fs-framework，再各模块）
+   ↓        评估删除 fs-common Security 补丁
+   ↓
+阶段 4  验证 Springfox（或排期 springdoc）
+   ↓
+阶段 5  mvn compile → 按 P0→P2 逐个启动修错
+   ↓
+阶段 6  全链路回归 → 预发验证 → 生产灰度
+```
+
+---
+
+## 十一、不在本次范围内
+
+以下内容属于 **Spring Boot 3.x** 范畴，本次 **2.7.18 不需要做**：
+
+- Java 17+ 升级
+- `javax.*` → `jakarta.*` 包名替换
+- Spring Security 6.x API
+- Redisson `spring-data-32`
+
+---
+
+## 十二、参考链接
+
+- [Spring Boot 2.7 Release Notes](https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-2.7-Release-Notes)
+- [Spring Boot 2.7 Migration Guide](https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-2.7-Migration-Guide)
+- [Spring Security 5.7 Migration](https://docs.spring.io/spring-security/reference/5.8/migration/servlet/config.html)
+- [Spring Boot 2.6 PathPattern 变更说明](https://spring.io/blog/2020/06/30/url-matching-with-pathpattern-in-spring-mvc)
+
+---
+
+*文档生成日期：2026-06-08*

fs-ad-api/pom.xml

@@ -18,7 +18,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -33,7 +33,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -45,7 +45,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -57,7 +57,7 @@
             <artifactId>druid-spring-boot-starter</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -110,8 +110,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-ad-api/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-ad-api/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,50 +1,53 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
- * spring security配置
- * 
+ * spring security??
+ *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
-     * anyRequest          |   匹配所有请求路径
-     * access              |   SpringEl表达式结果为true时可以访问
-     * anonymous           |   匿名可以访问
-     * denyAll             |   用户不能访问
-     * fullyAuthenticated  |   用户完全认证可以访问（非remember-me下自动登录）
-     * hasAnyAuthority     |   如果有参数，参数表示权限，则其中任何一个权限可以访问
-     * hasAnyRole          |   如果有参数，参数表示角色，则其中任何一个角色可以访问
-     * hasAuthority        |   如果有参数，参数表示权限，则其权限可以访问
-     * hasIpAddress        |   如果有参数，参数表示IP地址，如果用户IP和参数匹配，则可以访问
-     * hasRole             |   如果有参数，参数表示角色，则其角色可以访问
-     * permitAll           |   用户可以任意访问
-     * rememberMe          |   允许通过remember-me登录的用户访问
-     * authenticated       |   用户登录后可访问
+     * anyRequest          |   ????????
+     * access              |   SpringEl??????true?????
+     * anonymous           |   ??????
+     * denyAll             |   ??????
+     * fullyAuthenticated  |   ????????????remember-me??????
+     * hasAnyAuthority     |   ??????????????????????????
+     * hasAnyRole          |   ??????????????????????????
+     * hasAuthority        |   ?????????????????????
+     * hasIpAddress        |   ??????????IP???????IP???????????
+     * hasRole             |   ?????????????????????
+     * permitAll           |   ????????
+     * rememberMe          |   ????remember-me???????
+     * authenticated       |   ????????
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-ad-new-api/pom.xml

@@ -10,11 +10,11 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>fs-ad-new-api</artifactId>
     <description>
-       新投�接�
+       新投�接�
     </description>
     <dependencies>
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -26,7 +26,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -59,8 +59,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-ad-new-api/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,50 +1,53 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
- * spring security配置
+ * spring security??
  * 
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
-     * anyRequest          |   匹配所有请求路径
-     * access              |   SpringEl表达式结果为true时可以访问
-     * anonymous           |   匿名可以访问
-     * denyAll             |   用户不能访问
-     * fullyAuthenticated  |   用户完全认证可以访问（非remember-me下自动登录）
-     * hasAnyAuthority     |   如果有参数，参数表示权限，则其中任何一个权限可以访问
-     * hasAnyRole          |   如果有参数，参数表示角色，则其中任何一个角色可以访问
-     * hasAuthority        |   如果有参数，参数表示权限，则其权限可以访问
-     * hasIpAddress        |   如果有参数，参数表示IP地址，如果用户IP和参数匹配，则可以访问
-     * hasRole             |   如果有参数，参数表示角色，则其角色可以访问
-     * permitAll           |   用户可以任意访问
-     * rememberMe          |   允许通过remember-me登录的用户访问
-     * authenticated       |   用户登录后可访问
+     * anyRequest          |   ???????�?
+     * access              |   SpringEl??????true????�?
+     * anonymous           |   ??????
+     * denyAll             |   ??????
+     * fullyAuthenticated  |   ????????????remember-me??????
+     * hasAnyAuthority     |   ?????????????????????????�?
+     * hasAnyRole          |   ?????????????????????????�?
+     * hasAuthority        |   ????????????????????�?
+     * hasIpAddress        |   ??????????IP???????IP??????????�?
+     * hasRole             |   ????????????????????�?
+     * permitAll           |   ????????
+     * rememberMe          |   ????remember-me??????�?
+     * authenticated       |   ????????
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-admin/pom.xml

@@ -30,9 +30,9 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示依赖不会传递 -->
+            <optional>true</optional> <!-- 表示依赖不会传�?-->
         </dependency>
-         <!-- Mysql驱动包 -->
+         <!-- Mysql驱动�?-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -105,8 +105,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该配置，devtools不会生效 -->
                 </configuration>
                 <executions>

fs-admin/src/main/java/com/fs/hisStore/controller/FsStoreOrderStatisticsScrmController.java

@@ -1,6 +1,6 @@
 package com.fs.hisStore.controller;
 
-import com.baomidou.mybatisplus.extension.api.R;
+import com.fs.common.core.domain.R;
 import com.fs.hisStore.param.FsStoreOrderStatisticsParam;
 import com.fs.hisStore.service.IFsStoreOrderScrmService;
 import com.fs.hisStore.vo.StoreOrderStatisticsVo;
@@ -49,6 +49,6 @@ public class FsStoreOrderStatisticsScrmController {
         storeOrderStatisticsVo.setTotalAmount(totalAmount);
         storeOrderStatisticsVo.setSuccessRate(successRate);
         storeOrderStatisticsVo.setReturnRate(returnRate);
-        return R.ok(storeOrderStatisticsVo);
+        return R.ok().put("data", storeOrderStatisticsVo);
     }
 }

fs-ai-chat/pom.xml

@@ -104,8 +104,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该配置，devtools不会生效 -->
                 </configuration>
                 <executions>

fs-common-api/pom.xml

@@ -21,7 +21,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -41,7 +41,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -53,7 +53,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -65,7 +65,7 @@
             <artifactId>druid-spring-boot-starter</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -97,8 +97,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-common-api/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-common-api/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,19 +1,21 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
  * spring security配置
  * 
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
@@ -31,21 +33,21 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
      * rememberMe          |   允许通过remember-me登录的用户访问
      * authenticated       |   用户登录后可访问
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .antMatchers("/app/crmCustomer/**").anonymous()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-common/pom.xml

@@ -129,13 +129,10 @@
         <dependency>
             <groupId>com.baomidou</groupId>
             <artifactId>mybatis-plus-boot-starter</artifactId>
-            <version>3.1.0</version>
         </dependency>
-        <!-- https://mvnrepository.com/artifact/org.springframework/spring-expression -->
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-expression</artifactId>
-            <version>6.2.0</version>
         </dependency>
         <!-- https://mvnrepository.com/artifact/com.baidu.dev2/baiduads-sdk -->
         <dependency>

fs-common/src/main/java/com/fs/common/config/EagerSecurityHeadersBeanPostProcessor.java

@@ -1,18 +1,22 @@
 package com.fs.common.config;
 
 import org.springframework.beans.factory.config.BeanPostProcessor;
+import org.springframework.boot.autoconfigure.AutoConfigureBefore;
+import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.web.header.HeaderWriterFilter;
-import org.springframework.stereotype.Component;
 
 /**
  * 缓解 CVE-2026-22732：在特定条件下 Spring Security 可能未写入 HTTP 安全响应头。
  * <p>
- * Spring Security 5.2.x（本项目）无开源补丁，官方建议将 {@link HeaderWriterFilter}
- * 的 shouldWriteHeadersEagerly 设为 true。
+ * Spring Security 5.7.x 无开源补丁（修复版 5.7.22 仅企业版），官方建议将
+ * {@link HeaderWriterFilter#shouldWriteHeadersEagerly} 设为 true。
+ * 通过 {@code META-INF/spring.factories} 自动注册，所有依赖 fs-common 的应用均生效。
  *
  * @see <a href="https://spring.io/security/cve-2026-22732">CVE-2026-22732</a>
  */
-@Component
+@Configuration
+@AutoConfigureBefore(SecurityAutoConfiguration.class)
 public class EagerSecurityHeadersBeanPostProcessor implements BeanPostProcessor {
 
     @Override

fs-common/src/main/java/com/fs/common/security/SecurityPathMatchers.java

@@ -0,0 +1,24 @@
+package com.fs.common.security;
+
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
+import org.springframework.security.web.util.matcher.RequestMatcher;
+
+/**
+ * Spring Security 5.7 authorizeHttpRequests 仅支持 RequestMatcher，提供 ant 路径便捷构造。
+ */
+public final class SecurityPathMatchers
+{
+    private SecurityPathMatchers()
+    {
+    }
+
+    public static RequestMatcher[] antMatchers(String... patterns)
+    {
+        RequestMatcher[] matchers = new RequestMatcher[patterns.length];
+        for (int i = 0; i < patterns.length; i++)
+        {
+            matchers[i] = new AntPathRequestMatcher(patterns[i]);
+        }
+        return matchers;
+    }
+}

fs-common/src/main/java/com/fs/common/utils/redis/RedisActiveKeyIndexRepairService.java

@@ -134,7 +134,7 @@ public class RedisActiveKeyIndexRepairService {
                         keys.add(key);
                     }
                 }
-            } catch (IOException e) {
+            } catch (Exception e) {
                 throw new RuntimeException("Redis SCAN failed, pattern=" + pattern, e);
             }
             return null;

fs-common/src/main/resources/META-INF/spring.factories

@@ -0,0 +1,2 @@
+org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
+com.fs.common.config.EagerSecurityHeadersBeanPostProcessor

fs-company-app/pom.xml

@@ -20,7 +20,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -40,7 +40,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -52,7 +52,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -64,7 +64,7 @@
             <artifactId>druid-spring-boot-starter</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -104,8 +104,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-company-app/src/main/java/com/fs/core/config/ResourcesConfig.java

@@ -36,7 +36,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 自定义拦截规则
+     * 自定义拦截规�?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 设置访问源地址
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 设置访问源请求头
         config.addAllowedHeader("*");
-        // 设置访问源请求方法
+        // 设置访问源请求方�?
         config.addAllowedMethod("*");
-        // 对接口配置跨域设置
+        // 对接口配置跨域设�?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }
@@ -66,8 +66,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     @Override
     public void addCorsMappings(CorsRegistry registry) {
         registry.addMapping("/**")
-                .allowedOrigins("*")
-                //.allowedOriginPatterns("*")
+                .allowedOriginPatterns("*")
                 .allowedMethods("GET", "HEAD", "POST", "PUT", "DELETE", "OPTIONS")
                 .allowCredentials(true)
                 .maxAge(3600)

fs-company-app/src/main/java/com/fs/core/config/SecurityConfig.java

@@ -1,40 +1,45 @@
 package com.fs.core.config;
 
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
- * spring security配置
+ * spring security??
  *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
-     * anyRequest          |   匹配所有请求路径
-     * access              |   SpringEl表达式结果为true时可以访问
-     * anonymous           |   匿名可以访问
-     * denyAll             |   用户不能访问
-     * fullyAuthenticated  |   用户完全认证可以访问（非remember-me下自动登录）
-     * hasAnyAuthority     |   如果有参数，参数表示权限，则其中任何一个权限可以访问
-     * hasAnyRole          |   如果有参数，参数表示角色，则其中任何一个角色可以访问
-     * hasAuthority        |   如果有参数，参数表示权限，则其权限可以访问
-     * hasIpAddress        |   如果有参数，参数表示IP地址，如果用户IP和参数匹配，则可以访问
-     * hasRole             |   如果有参数，参数表示角色，则其角色可以访问
-     * permitAll           |   用户可以任意访问
-     * rememberMe          |   允许通过remember-me登录的用户访问
-     * authenticated       |   用户登录后可访问
+     * anyRequest          |   ???????�?
+     * access              |   SpringEl??????true????�?
+     * anonymous           |   ??????
+     * denyAll             |   ??????
+     * fullyAuthenticated  |   ????????????remember-me??????
+     * hasAnyAuthority     |   ?????????????????????????�?
+     * hasAnyRole          |   ?????????????????????????�?
+     * hasAuthority        |   ????????????????????�?
+     * hasIpAddress        |   ??????????IP???????IP??????????�?
+     * hasRole             |   ????????????????????�?
+     * permitAll           |   ????????
+     * rememberMe          |   ????remember-me??????�?
+     * authenticated       |   ????????
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
+    {
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
 }

fs-company/pom.xml

@@ -20,7 +20,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -44,7 +44,7 @@
             <artifactId>IJPay-All</artifactId>
             <version>2.7.8</version>
         </dependency>
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -56,7 +56,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -85,7 +85,7 @@
 <!--            <version>0.3.2</version>-->
 <!--        </dependency>-->
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -125,8 +125,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-company/src/main/java/com/fs/framework/config/MyBatisConfig.java

@@ -1,6 +1,8 @@
 package com.fs.framework.config;
 
-import com.baomidou.mybatisplus.extension.plugins.PaginationInterceptor;
+import com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor;
+import com.baomidou.mybatisplus.extension.plugins.inner.PaginationInnerInterceptor;
+import org.apache.ibatis.plugin.Interceptor;
 import com.baomidou.mybatisplus.extension.spring.MybatisSqlSessionFactoryBean;
 import com.fs.common.utils.StringUtils;
 import org.apache.ibatis.io.VFS;
@@ -147,8 +149,9 @@ public class MyBatisConfig
         sessionFactory.setMapperLocations(new PathMatchingResourcePatternResolver().getResources(mapperLocations));
         sessionFactory.setConfigLocation(new DefaultResourceLoader().getResource(configLocation));
         // 添加MyBatis-Plus分页插件
-        PaginationInterceptor paginationInterceptor = new PaginationInterceptor();
-        sessionFactory.setPlugins(new PaginationInterceptor[]{paginationInterceptor});
+        MybatisPlusInterceptor paginationInterceptor = new MybatisPlusInterceptor();
+        paginationInterceptor.addInnerInterceptor(new PaginationInnerInterceptor());
+        sessionFactory.setPlugins(new Interceptor[]{paginationInterceptor});
         return sessionFactory.getObject();
     }
 }

fs-company/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-company/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,22 +1,22 @@
 package com.fs.framework.config;
 
-
 import com.fs.framework.security.filter.JwtAuthenticationTokenFilter;
 import com.fs.framework.security.handle.AuthenticationEntryPointImpl;
 import com.fs.framework.security.handle.LogoutSuccessHandlerImpl;
-import com.fs.company.utils.MD5PasswordEncoder;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import com.fs.common.security.SecurityPathMatchers;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
-import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.authentication.logout.LogoutFilter;
 import org.springframework.web.filter.CorsFilter;
@@ -26,8 +26,9 @@ import org.springframework.web.filter.CorsFilter;
  *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
     /**
      * 自定义用户认证逻辑
@@ -59,19 +60,6 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     @Autowired
     private CorsFilter corsFilter;
 
-    /**
-     * 解决 无法直接注入 AuthenticationManager
-     *
-     * @return
-     * @throws Exception
-     */
-    @Bean
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception
-    {
-        return super.authenticationManagerBean();
-    }
-
     /**
      * anyRequest          |   匹配所有请求路径
      * access              |   SpringEl表达式结果为true时可以访问
@@ -87,62 +75,58 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
      * rememberMe          |   允许通过remember-me登录的用户访问
      * authenticated       |   用户登录后可访问
      */
-    @Override
-    protected void configure(HttpSecurity httpSecurity) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception
     {
         httpSecurity
-                // CSRF禁用，因为不使用session
-                .csrf().disable()
-                // 认证失败处理类
-                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
-                // 基于token，所以不需要session
-                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
-                // 过滤请求
-                .authorizeRequests()
-                // 对于登录login 注册register 验证码captchaImage 允许匿名访问
-                .antMatchers("/chat/upload/**","/login", "/register", "/captchaImage","/checkIsNeedCheck","/getWechatQrCode","/checkWechatScan","/callback").anonymous()
-                .antMatchers(
-                        HttpMethod.GET,
-                        "/",
-                        "/*.html",
-                        "/**/*.html",
-                        "/**/*.css",
-                        "/**/*.js",
-                        "/profile/**"
-                ).permitAll()
-                .antMatchers("/test").anonymous()
-                .antMatchers("**/callerResult").anonymous()
-                .antMatchers("/qw/getJsapiTicket/**").anonymous()
-                .antMatchers("/msg/**").anonymous()
-                .antMatchers("/baiduBack/**").anonymous()
-                .antMatchers("/msg/**/**").anonymous()
-                .antMatchers("/msg").anonymous()
-                .antMatchers("/common/getId**").anonymous()
-                .antMatchers("/common/uploadOSS**").anonymous()
-                .antMatchers("/company/user/common/uploadOSS").anonymous()
-                .antMatchers("/pay/wxPay/payNotify**").anonymous()
-                .antMatchers("/common/uploadWang**").anonymous()
-                .antMatchers("/common/download**").anonymous()
-                .antMatchers("/common/test").anonymous()
-                .antMatchers("/common/download/resource**").anonymous()
-                .antMatchers("/swagger-ui.html").anonymous()
-                .antMatchers("/swagger-resources/**").anonymous()
-                .antMatchers("/webjars/**").anonymous()
-                .antMatchers("/*/api-docs").anonymous()
-                .antMatchers("/druid/**").anonymous()
-                .antMatchers("/qw/data/**").anonymous()
-                .antMatchers("/qw/user/selectCloudByCompany").anonymous()
-                .antMatchers("/live/LiveMixLiuTestOpen/**").anonymous()
-                // 除上面外的所有请求全部需要鉴权认证
-                .anyRequest().authenticated()
-                .and()
-                .headers().frameOptions().disable();
-        httpSecurity.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler);
-        // 添加JWT filter
+                .csrf(csrf -> csrf.disable())
+                .exceptionHandling(ex -> ex.authenticationEntryPoint(unauthorizedHandler))
+                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .authorizeHttpRequests(auth -> {
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/chat/upload/**", "/login", "/register", "/captchaImage", "/checkIsNeedCheck", "/getWechatQrCode", "/checkWechatScan", "/callback")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/", "/*.html", "/**/*.html", "/**/*.css", "/**/*.js", "/profile/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/test")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("**/callerResult")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/qw/getJsapiTicket/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/msg/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/baiduBack/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/msg/**/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/msg")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/common/getId**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/common/uploadOSS**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/company/user/common/uploadOSS")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/pay/wxPay/payNotify**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/common/uploadWang**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/common/download**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/common/test")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/common/download/resource**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/swagger-ui.html")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/swagger-resources/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/webjars/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/*/api-docs")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/druid/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/qw/data/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/qw/user/selectCloudByCompany")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/live/LiveMixLiuTestOpen/**")).permitAll();
+                    auth.anyRequest().authenticated();
+                })
+                .headers(headers -> headers.frameOptions(frame -> frame.disable()))
+                .logout(logout -> logout
+                        .logoutUrl("/logout")
+                        .logoutSuccessHandler(logoutSuccessHandler)
+                );
+
         httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
-        // 添加CORS filter
         httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
         httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class);
+
+        return httpSecurity.build();
+    }
+
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
     /**
@@ -157,8 +141,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     /**
      * 身份认证接口
      */
-    @Override
-    protected void configure(AuthenticationManagerBuilder auth) throws Exception
+    @Autowired
+    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
     {
         auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
     }

fs-company/src/main/resources/application.yml

@@ -3,7 +3,7 @@ server:
 # Spring配置
 spring:
   profiles:
-    active: druid-bjczwh-test
+#    active: druid-bjczwh-test
 #    active: druid-jnlzjk
 #    active: druid-jnmy-test
 #    active: druid-jzzx-test
@@ -13,4 +13,4 @@ spring:
 #    active: druid-myhk
 #    active: druid-sft
 #    active: dev-jnlzjk
-#    active: druid-jshz
+    active: druid-jshz

fs-doctor-app/pom.xml

@@ -10,7 +10,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>fs-doctor-app</artifactId>
     <description>
-        用户�程�接�
+        用户�程�接�
     </description>
 
     <dependencies>
@@ -19,7 +19,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -39,7 +39,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -51,7 +51,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -63,7 +63,7 @@
             <artifactId>druid-spring-boot-starter</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -98,8 +98,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-doctor-app/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-doctor-app/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,50 +1,53 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
- * spring security配置
+ * spring security??
  * 
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
-     * anyRequest          |   匹配所有请求路径
-     * access              |   SpringEl表达式结果为true时可以访问
-     * anonymous           |   匿名可以访问
-     * denyAll             |   用户不能访问
-     * fullyAuthenticated  |   用户完全认证可以访问（非remember-me下自动登录）
-     * hasAnyAuthority     |   如果有参数，参数表示权限，则其中任何一个权限可以访问
-     * hasAnyRole          |   如果有参数，参数表示角色，则其中任何一个角色可以访问
-     * hasAuthority        |   如果有参数，参数表示权限，则其权限可以访问
-     * hasIpAddress        |   如果有参数，参数表示IP地址，如果用户IP和参数匹配，则可以访问
-     * hasRole             |   如果有参数，参数表示角色，则其角色可以访问
-     * permitAll           |   用户可以任意访问
-     * rememberMe          |   允许通过remember-me登录的用户访问
-     * authenticated       |   用户登录后可访问
+     * anyRequest          |   ???????�?
+     * access              |   SpringEl??????true????�?
+     * anonymous           |   ??????
+     * denyAll             |   ??????
+     * fullyAuthenticated  |   ????????????remember-me??????
+     * hasAnyAuthority     |   ?????????????????????????�?
+     * hasAnyRole          |   ?????????????????????????�?
+     * hasAuthority        |   ????????????????????�?
+     * hasIpAddress        |   ??????????IP???????IP??????????�?
+     * hasRole             |   ????????????????????�?
+     * permitAll           |   ????????
+     * rememberMe          |   ????remember-me??????�?
+     * authenticated       |   ????????
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-framework/pom.xml

@@ -29,6 +29,12 @@
             <artifactId>spring-boot-starter-aop</artifactId>
         </dependency>
 
+        <!-- Spring Security（SecurityConfig 直接依赖，避免传递依赖解析异常） -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+
         <!-- 阿里数据库连接池 -->
         <dependency>
             <groupId>com.alibaba</groupId>

fs-framework/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -41,7 +41,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -62,12 +62,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-framework/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -2,15 +2,17 @@ package com.fs.framework.config;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
-import org.springframework.http.HttpMethod;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import com.fs.common.security.SecurityPathMatchers;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.authentication.logout.LogoutFilter;
 import org.springframework.web.filter.CorsFilter;
@@ -23,8 +25,9 @@ import com.fs.framework.security.handle.LogoutSuccessHandlerImpl;
  *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
     /**
      * 自定义用户认证逻辑
@@ -56,19 +59,6 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     @Autowired
     private CorsFilter corsFilter;
 
-    /**
-     * 解决 无法直接注入 AuthenticationManager
-     *
-     * @return
-     * @throws Exception
-     */
-    @Bean
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception
-    {
-        return super.authenticationManagerBean();
-    }
-
     /**
      * anyRequest          |   匹配所有请求路径
      * access              |   SpringEl表达式结果为true时可以访问
@@ -84,77 +74,73 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
      * rememberMe          |   允许通过remember-me登录的用户访问
      * authenticated       |   用户登录后可访问
      */
-    @Override
-    protected void configure(HttpSecurity httpSecurity) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception
     {
         httpSecurity
-                // CSRF禁用，因为不使用session
-                .csrf().disable()
-                // 认证失败处理类
-                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
-                // 基于token，所以不需要session
-                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
-                // 过滤请求
-                .authorizeRequests()
-                // 对于登录login 注册register 验证码captchaImage 允许匿名访问
-                .antMatchers("/login", "/register", "/captchaImage","/getWechatQrCode","/checkWechatScan","/callback","/checkIsNeedCheck").anonymous()
-                .antMatchers("/app/common/test").anonymous()
-                .antMatchers("/ad/adDyApi/authorized").anonymous()
-                .antMatchers(
-                        HttpMethod.GET,
-                        "/",
-                        "/*.html",
-                        "/**/*.html",
-                        "/**/*.css",
-                        "/**/*.js",
-                        "/profile/**"
-                ).permitAll()
-                .antMatchers("/baidu/**").anonymous()
-                .antMatchers("/baiduBack/**").anonymous()
-                .antMatchers("/test/gtp/*").anonymous()
-                .antMatchers("common/getTask/*").anonymous()
-                .antMatchers("//his/data/endFollow/*").anonymous()
-                .antMatchers("//his/data/end/*").anonymous()
-                .antMatchers("//his/data/addCF/*").anonymous()
-                .antMatchers("//his/data/addCom/*").anonymous()
-                .antMatchers("//his/data/testSendSub/*").anonymous()
-                .antMatchers("//his/data/test/*").anonymous()
-                .antMatchers("//his/data/Follow/*").anonymous()
-                .antMatchers("/company/companyVoiceRobotic/callerResult").anonymous()
-                .antMatchers("/qw/data/*").anonymous()
-                .antMatchers("/app/common/expressNotify").anonymous()
-                .antMatchers("/app/common/integral").anonymous()
-                .antMatchers("/his/sms/deliver").anonymous()
-                .antMatchers("/his/sms/templateState").anonymous()
-                .antMatchers("/his/sms/report").anonymous()
-                .antMatchers("/his/sms/notify").anonymous()
-                .antMatchers("/huFu/*").anonymous()
-                .antMatchers("/tzPay/*").anonymous()
-                .antMatchers("//his/pay/*").anonymous()
-                .antMatchers("/common/getId**").anonymous()
-                .antMatchers("/common/uploadOSS**").anonymous()
-                .antMatchers("/chat/upload/uploadFile**").anonymous()
-                .antMatchers("/common/uploadWang**").anonymous()
-                .antMatchers("/common/download**").anonymous()
-                .antMatchers("/common/download/resource**").anonymous()
-                .antMatchers("/common/unbindQwUserByServerIds").anonymous()
-                .antMatchers("/swagger-ui.html").anonymous()
-                .antMatchers("/swagger-resources/**").anonymous()
-                .antMatchers("/webjars/**").anonymous()
-                .antMatchers("/*/api-docs").anonymous()
-                .antMatchers("/druid/**").anonymous()
-                .antMatchers("/course/userVideo/videoTranscode").anonymous()
-                .antMatchers("/erp/call/**").anonymous()
-                // 除上面外的所有请求全部需要鉴权认证
-                .anyRequest().authenticated()
-                .and()
-                .headers().frameOptions().disable();
-        httpSecurity.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler);
-        // 添加JWT filter
+                .csrf(csrf -> csrf.disable())
+                .exceptionHandling(ex -> ex.authenticationEntryPoint(unauthorizedHandler))
+                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .authorizeHttpRequests(auth -> {
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/login", "/register", "/captchaImage", "/getWechatQrCode", "/checkWechatScan", "/callback", "/checkIsNeedCheck")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/app/common/test")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/ad/adDyApi/authorized")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/", "/*.html", "/**/*.html", "/**/*.css", "/**/*.js", "/profile/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/baidu/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/baiduBack/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/test/gtp/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("common/getTask/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("//his/data/endFollow/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("//his/data/end/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("//his/data/addCF/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("//his/data/addCom/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("//his/data/testSendSub/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("//his/data/test/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("//his/data/Follow/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/company/companyVoiceRobotic/callerResult")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/qw/data/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/app/common/expressNotify")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/app/common/integral")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/his/sms/deliver")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/his/sms/templateState")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/his/sms/report")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/his/sms/notify")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/huFu/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/tzPay/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("//his/pay/*")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/common/getId**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/common/uploadOSS**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/chat/upload/uploadFile**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/common/uploadWang**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/common/download**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/common/download/resource**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/common/unbindQwUserByServerIds")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/swagger-ui.html")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/swagger-resources/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/webjars/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/*/api-docs")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/druid/**")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/course/userVideo/videoTranscode")).permitAll();
+                    auth.requestMatchers(SecurityPathMatchers.antMatchers("/erp/call/**")).permitAll();
+                    auth.anyRequest().authenticated();
+                })
+                .headers(headers -> headers.frameOptions(frame -> frame.disable()))
+                .logout(logout -> logout
+                        .logoutUrl("/logout")
+                        .logoutSuccessHandler(logoutSuccessHandler)
+                );
+
         httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
-        // 添加CORS filter
         httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
         httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class);
+
+        return httpSecurity.build();
+    }
+
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
     /**
@@ -169,8 +155,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     /**
      * 身份认证接口
      */
-    @Override
-    protected void configure(AuthenticationManagerBuilder auth) throws Exception
+    @Autowired
+    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
     {
         auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
     }

fs-ipad-task/pom.xml

@@ -21,7 +21,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -41,7 +41,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -53,7 +53,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -84,7 +84,7 @@
 <!--            <version>0.3.2</version>-->
 <!--        </dependency>-->
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -117,8 +117,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-ipad-task/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -39,7 +39,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -57,12 +57,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-ipad-task/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,20 +1,21 @@
 package com.fs.framework.config;
 
-
 import com.fs.framework.security.filter.JwtAuthenticationTokenFilter;
 import com.fs.framework.security.handle.AuthenticationEntryPointImpl;
 import com.fs.framework.security.handle.LogoutSuccessHandlerImpl;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.authentication.logout.LogoutFilter;
 import org.springframework.web.filter.CorsFilter;
@@ -24,8 +25,9 @@ import org.springframework.web.filter.CorsFilter;
  *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
     /**
      * 自定义用户认证逻辑
@@ -57,19 +59,6 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     @Autowired
     private CorsFilter corsFilter;
 
-    /**
-     * 解决 无法直接注入 AuthenticationManager
-     *
-     * @return
-     * @throws Exception
-     */
-    @Bean
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception
-    {
-        return super.authenticationManagerBean();
-    }
-
     /**
      * anyRequest          |   匹配所有请求路径
      * access              |   SpringEl表达式结果为true时可以访问
@@ -85,57 +74,33 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
      * rememberMe          |   允许通过remember-me登录的用户访问
      * authenticated       |   用户登录后可访问
      */
-    @Override
-    protected void configure(HttpSecurity httpSecurity) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception
     {
         httpSecurity
-                // CSRF禁用，因为不使用session
-                .csrf().disable()
-                // 认证失败处理类
-                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
-                // 基于token，所以不需要session
-                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
-                // 过滤请求
-                .authorizeRequests()
-                // 对于登录login 注册register 验证码captchaImage 允许匿名访问
-                .antMatchers("/chat/upload/**","/login", "/register", "/captchaImage").anonymous()
-                .antMatchers(
-                        HttpMethod.GET,
-                        "/",
-                        "/*.html",
-                        "/**/*.html",
-                        "/**/*.css",
-                        "/**/*.js",
-                        "/profile/**"
-                ).permitAll()
-                .antMatchers("**/errorLogUpload").anonymous()
-                .antMatchers("**").anonymous()
-                .antMatchers("/qw/getJsapiTicket/**").anonymous()
-                .antMatchers("/msg/**").anonymous()
-                .antMatchers("/msg/**/**").anonymous()
-                .antMatchers("/msg").anonymous()
-                .antMatchers("/app/common/**").anonymous()
-                .antMatchers("/common/getId**").anonymous()
-                .antMatchers("/common/uploadOSS**").anonymous()
-                .antMatchers("/common/uploadWang**").anonymous()
-                .antMatchers("/common/download**").anonymous()
-                .antMatchers("/common/download/resource**").anonymous()
-                .antMatchers("/swagger-ui.html").anonymous()
-                .antMatchers("/swagger-resources/**").anonymous()
-                .antMatchers("/webjars/**").anonymous()
-                .antMatchers("/*/api-docs").anonymous()
-                .antMatchers("/druid/**").anonymous()
-                .antMatchers("/qw/data/**").anonymous()
-                // 除上面外的所有请求全部需要鉴权认证
-                .anyRequest().authenticated()
-                .and()
-                .headers().frameOptions().disable();
-        httpSecurity.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler);
-        // 添加JWT filter
+                .csrf(csrf -> csrf.disable())
+                .exceptionHandling(ex -> ex.authenticationEntryPoint(unauthorizedHandler))
+                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                )
+                .headers(headers -> headers.frameOptions(frame -> frame.disable()))
+                .logout(logout -> logout
+                        .logoutUrl("/logout")
+                        .logoutSuccessHandler(logoutSuccessHandler)
+                );
+
         httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
-        // 添加CORS filter
         httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
         httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class);
+
+        return httpSecurity.build();
+    }
+
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
     /**
@@ -150,8 +115,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     /**
      * 身份认证接口
      */
-    @Override
-    protected void configure(AuthenticationManagerBuilder auth) throws Exception
+    @Autowired
+    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
     {
         auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
     }

fs-live-app/pom.xml

@@ -18,7 +18,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -38,7 +38,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -50,7 +50,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -62,7 +62,7 @@
             <artifactId>druid-spring-boot-starter</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -108,8 +108,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-live-app/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-live-app/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,50 +1,53 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
- * spring security配置
+ * spring security??
  * 
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
-     * anyRequest          |   匹配所有请求路径
-     * access              |   SpringEl表达式结果为true时可以访问
-     * anonymous           |   匿名可以访问
-     * denyAll             |   用户不能访问
-     * fullyAuthenticated  |   用户完全认证可以访问（非remember-me下自动登录）
-     * hasAnyAuthority     |   如果有参数，参数表示权限，则其中任何一个权限可以访问
-     * hasAnyRole          |   如果有参数，参数表示角色，则其中任何一个角色可以访问
-     * hasAuthority        |   如果有参数，参数表示权限，则其权限可以访问
-     * hasIpAddress        |   如果有参数，参数表示IP地址，如果用户IP和参数匹配，则可以访问
-     * hasRole             |   如果有参数，参数表示角色，则其角色可以访问
-     * permitAll           |   用户可以任意访问
-     * rememberMe          |   允许通过remember-me登录的用户访问
-     * authenticated       |   用户登录后可访问
+     * anyRequest          |   ???????�?
+     * access              |   SpringEl??????true????�?
+     * anonymous           |   ??????
+     * denyAll             |   ??????
+     * fullyAuthenticated  |   ????????????remember-me??????
+     * hasAnyAuthority     |   ?????????????????????????�?
+     * hasAnyRole          |   ?????????????????????????�?
+     * hasAuthority        |   ????????????????????�?
+     * hasIpAddress        |   ??????????IP???????IP??????????�?
+     * hasRole             |   ????????????????????�?
+     * permitAll           |   ????????
+     * rememberMe          |   ????remember-me??????�?
+     * authenticated       |   ????????
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-live-mq/pom.xml

@@ -18,7 +18,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -33,7 +33,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -45,7 +45,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -57,7 +57,7 @@
             <artifactId>druid-spring-boot-starter</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -110,8 +110,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-live-mq/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-live-mq/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,50 +1,53 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
- * spring security配置
+ * spring security??
  * 
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
-     * anyRequest          |   匹配所有请求路径
-     * access              |   SpringEl表达式结果为true时可以访问
-     * anonymous           |   匿名可以访问
-     * denyAll             |   用户不能访问
-     * fullyAuthenticated  |   用户完全认证可以访问（非remember-me下自动登录）
-     * hasAnyAuthority     |   如果有参数，参数表示权限，则其中任何一个权限可以访问
-     * hasAnyRole          |   如果有参数，参数表示角色，则其中任何一个角色可以访问
-     * hasAuthority        |   如果有参数，参数表示权限，则其权限可以访问
-     * hasIpAddress        |   如果有参数，参数表示IP地址，如果用户IP和参数匹配，则可以访问
-     * hasRole             |   如果有参数，参数表示角色，则其角色可以访问
-     * permitAll           |   用户可以任意访问
-     * rememberMe          |   允许通过remember-me登录的用户访问
-     * authenticated       |   用户登录后可访问
+     * anyRequest          |   ???????�?
+     * access              |   SpringEl??????true????�?
+     * anonymous           |   ??????
+     * denyAll             |   ??????
+     * fullyAuthenticated  |   ????????????remember-me??????
+     * hasAnyAuthority     |   ?????????????????????????�?
+     * hasAnyRole          |   ?????????????????????????�?
+     * hasAuthority        |   ????????????????????�?
+     * hasIpAddress        |   ??????????IP???????IP??????????�?
+     * hasRole             |   ????????????????????�?
+     * permitAll           |   ????????
+     * rememberMe          |   ????remember-me??????�?
+     * authenticated       |   ????????
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-quartz/src/main/java/com/fs/quartz/config/ScheduleConfig.java

@@ -1,5 +1,6 @@
 package com.fs.quartz.config;
 
+import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.scheduling.quartz.SchedulerFactoryBean;
@@ -15,7 +16,7 @@ import java.util.Properties;
 public class ScheduleConfig
 {
     @Bean
-    public SchedulerFactoryBean schedulerFactoryBean(DataSource dataSource)
+    public SchedulerFactoryBean schedulerFactoryBean(@Qualifier("masterDataSource") DataSource dataSource)
     {
         SchedulerFactoryBean factory = new SchedulerFactoryBean();
         factory.setDataSource(dataSource);
@@ -28,8 +29,9 @@ public class ScheduleConfig
         prop.put("org.quartz.threadPool.class", "org.quartz.simpl.SimpleThreadPool");
         prop.put("org.quartz.threadPool.threadCount", "20");
         prop.put("org.quartz.threadPool.threadPriority", "5");
-        // JobStore配置
-        prop.put("org.quartz.jobStore.class", "org.quartz.impl.jdbcjobstore.JobStoreTX");
+        // JobStore配置（Spring 托管 DataSource，勿用 JobStoreTX）
+        prop.put("org.quartz.jobStore.class", "org.springframework.scheduling.quartz.LocalDataSourceJobStore");
+        prop.put("org.quartz.jobStore.driverDelegateClass", "org.quartz.impl.jdbcjobstore.StdJDBCDelegate");
         // 集群配置
         prop.put("org.quartz.jobStore.isClustered", "true");
         prop.put("org.quartz.jobStore.clusterCheckinInterval", "15000");

fs-qw-api-msg/pom.xml

@@ -21,7 +21,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -41,7 +41,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -53,7 +53,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -78,7 +78,7 @@
 <!--            <version>0.3.2</version>-->
 <!--        </dependency>-->
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -132,8 +132,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-qw-api-msg/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-qw-api-msg/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,20 +1,21 @@
 package com.fs.framework.config;
 
-
 import com.fs.framework.security.filter.JwtAuthenticationTokenFilter;
 import com.fs.framework.security.handle.AuthenticationEntryPointImpl;
 import com.fs.framework.security.handle.LogoutSuccessHandlerImpl;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.authentication.logout.LogoutFilter;
 import org.springframework.web.filter.CorsFilter;
@@ -24,8 +25,9 @@ import org.springframework.web.filter.CorsFilter;
  *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
     /**
      * 自定义用户认证逻辑
@@ -57,19 +59,6 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     @Autowired
     private CorsFilter corsFilter;
 
-    /**
-     * 解决 无法直接注入 AuthenticationManager
-     *
-     * @return
-     * @throws Exception
-     */
-    @Bean
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception
-    {
-        return super.authenticationManagerBean();
-    }
-
     /**
      * anyRequest          |   匹配所有请求路径
      * access              |   SpringEl表达式结果为true时可以访问
@@ -85,58 +74,33 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
      * rememberMe          |   允许通过remember-me登录的用户访问
      * authenticated       |   用户登录后可访问
      */
-    @Override
-    protected void configure(HttpSecurity httpSecurity) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception
     {
         httpSecurity
-                // CSRF禁用，因为不使用session
-                .csrf().disable()
-                // 认证失败处理类
-                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
-                // 基于token，所以不需要session
-                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
-                // 过滤请求
-                .authorizeRequests()
-                // 对于登录login 注册register 验证码captchaImage 允许匿名访问
-                .antMatchers("/chat/upload/**","/login", "/register", "/captchaImage").anonymous()
-                .antMatchers(
-                        HttpMethod.GET,
-                        "/",
-                        "/*.html",
-                        "/**/*.html",
-                        "/**/*.css",
-                        "/**/*.js",
-                        "/profile/**"
-                ).permitAll()
+                .csrf(csrf -> csrf.disable())
+                .exceptionHandling(ex -> ex.authenticationEntryPoint(unauthorizedHandler))
+                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                )
+                .headers(headers -> headers.frameOptions(frame -> frame.disable()))
+                .logout(logout -> logout
+                        .logoutUrl("/logout")
+                        .logoutSuccessHandler(logoutSuccessHandler)
+                );
 
-                .antMatchers("/**").anonymous()
-                .antMatchers("**/errorLogUpload").anonymous()
-                .antMatchers("/msg/**").anonymous()
-                .antMatchers("/msg/**/**").anonymous()
-                .antMatchers("/msg").anonymous()
-                .antMatchers("/testSop").anonymous()
-                .antMatchers("/common/getId**").anonymous()
-                .antMatchers("/common/uploadOSS**").anonymous()
-                .antMatchers("/common/uploadWang**").anonymous()
-                .antMatchers("/common/download**").anonymous()
-                .antMatchers("/common/download/resource**").anonymous()
-                .antMatchers("/swagger-ui.html").anonymous()
-                .antMatchers("/swagger-resources/**").anonymous()
-                .antMatchers("/webjars/**").anonymous()
-                .antMatchers("/*/api-docs").anonymous()
-                .antMatchers("/druid/**").anonymous()
-                .antMatchers("/qw/data/**").anonymous()
-                .antMatchers("/qw/test/**").anonymous()
-                // 除上面外的所有请求全部需要鉴权认证
-                .anyRequest().authenticated()
-                .and()
-                .headers().frameOptions().disable();
-        httpSecurity.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler);
-        // 添加JWT filter
         httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
-        // 添加CORS filter
         httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
         httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class);
+
+        return httpSecurity.build();
+    }
+
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
     /**
@@ -151,8 +115,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     /**
      * 身份认证接口
      */
-    @Override
-    protected void configure(AuthenticationManagerBuilder auth) throws Exception
+    @Autowired
+    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
     {
         auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
     }

fs-qw-api/pom.xml

@@ -21,7 +21,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -41,7 +41,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -53,7 +53,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -78,7 +78,7 @@
 <!--            <version>0.3.2</version>-->
 <!--        </dependency>-->
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -108,8 +108,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-qw-api/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-qw-api/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,20 +1,21 @@
 package com.fs.framework.config;
 
-
 import com.fs.framework.security.filter.JwtAuthenticationTokenFilter;
 import com.fs.framework.security.handle.AuthenticationEntryPointImpl;
 import com.fs.framework.security.handle.LogoutSuccessHandlerImpl;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.authentication.logout.LogoutFilter;
 import org.springframework.web.filter.CorsFilter;
@@ -24,8 +25,9 @@ import org.springframework.web.filter.CorsFilter;
  *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
     /**
      * 自定义用户认证逻辑
@@ -57,19 +59,6 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     @Autowired
     private CorsFilter corsFilter;
 
-    /**
-     * 解决 无法直接注入 AuthenticationManager
-     *
-     * @return
-     * @throws Exception
-     */
-    @Bean
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception
-    {
-        return super.authenticationManagerBean();
-    }
-
     /**
      * anyRequest          |   匹配所有请求路径
      * access              |   SpringEl表达式结果为true时可以访问
@@ -85,56 +74,33 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
      * rememberMe          |   允许通过remember-me登录的用户访问
      * authenticated       |   用户登录后可访问
      */
-    @Override
-    protected void configure(HttpSecurity httpSecurity) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception
     {
         httpSecurity
-                // CSRF禁用，因为不使用session
-                .csrf().disable()
-                // 认证失败处理类
-                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
-                // 基于token，所以不需要session
-                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
-                // 过滤请求
-                .authorizeRequests()
-                // 对于登录login 注册register 验证码captchaImage 允许匿名访问
-                .antMatchers("/chat/upload/**","/login", "/register", "/captchaImage").anonymous()
-                .antMatchers(
-                        HttpMethod.GET,
-                        "/",
-                        "/*.html",
-                        "/**/*.html",
-                        "/**/*.css",
-                        "/**/*.js",
-                        "/profile/**"
-                ).permitAll()
+                .csrf(csrf -> csrf.disable())
+                .exceptionHandling(ex -> ex.authenticationEntryPoint(unauthorizedHandler))
+                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                )
+                .headers(headers -> headers.frameOptions(frame -> frame.disable()))
+                .logout(logout -> logout
+                        .logoutUrl("/logout")
+                        .logoutSuccessHandler(logoutSuccessHandler)
+                );
 
-                .antMatchers("/**").anonymous()
-                .antMatchers("/msg/**").anonymous()
-                .antMatchers("/msg/**/**").anonymous()
-                .antMatchers("/msg").anonymous()
-                .antMatchers("/testSop").anonymous()
-                .antMatchers("/common/getId**").anonymous()
-                .antMatchers("/common/uploadOSS**").anonymous()
-                .antMatchers("/common/uploadWang**").anonymous()
-                .antMatchers("/common/download**").anonymous()
-                .antMatchers("/common/download/resource**").anonymous()
-                .antMatchers("/swagger-ui.html").anonymous()
-                .antMatchers("/swagger-resources/**").anonymous()
-                .antMatchers("/webjars/**").anonymous()
-                .antMatchers("/*/api-docs").anonymous()
-                .antMatchers("/druid/**").anonymous()
-                .antMatchers("/qw/data/**").anonymous()
-                // 除上面外的所有请求全部需要鉴权认证
-                .anyRequest().authenticated()
-                .and()
-                .headers().frameOptions().disable();
-        httpSecurity.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler);
-        // 添加JWT filter
         httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
-        // 添加CORS filter
         httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
         httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class);
+
+        return httpSecurity.build();
+    }
+
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
     /**
@@ -149,8 +115,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     /**
      * 身份认证接口
      */
-    @Override
-    protected void configure(AuthenticationManagerBuilder auth) throws Exception
+    @Autowired
+    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
     {
         auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
     }

fs-qw-company-api/pom.xml

@@ -25,7 +25,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -45,7 +45,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -57,7 +57,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -82,7 +82,7 @@
 <!--            <version>0.3.2</version>-->
 <!--        </dependency>-->
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -112,8 +112,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-qw-company-api/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-qw-company-api/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,20 +1,21 @@
 package com.fs.framework.config;
 
-
 import com.fs.framework.security.filter.JwtAuthenticationTokenFilter;
 import com.fs.framework.security.handle.AuthenticationEntryPointImpl;
 import com.fs.framework.security.handle.LogoutSuccessHandlerImpl;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.authentication.logout.LogoutFilter;
 import org.springframework.web.filter.CorsFilter;
@@ -24,8 +25,9 @@ import org.springframework.web.filter.CorsFilter;
  *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
     /**
      * 自定义用户认证逻辑
@@ -57,19 +59,6 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     @Autowired
     private CorsFilter corsFilter;
 
-    /**
-     * 解决 无法直接注入 AuthenticationManager
-     *
-     * @return
-     * @throws Exception
-     */
-    @Bean
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception
-    {
-        return super.authenticationManagerBean();
-    }
-
     /**
      * anyRequest          |   匹配所有请求路径
      * access              |   SpringEl表达式结果为true时可以访问
@@ -85,56 +74,33 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
      * rememberMe          |   允许通过remember-me登录的用户访问
      * authenticated       |   用户登录后可访问
      */
-    @Override
-    protected void configure(HttpSecurity httpSecurity) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception
     {
         httpSecurity
-                // CSRF禁用，因为不使用session
-                .csrf().disable()
-                // 认证失败处理类
-                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
-                // 基于token，所以不需要session
-                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
-                // 过滤请求
-                .authorizeRequests()
-                // 对于登录login 注册register 验证码captchaImage 允许匿名访问
-                .antMatchers("/chat/upload/**","/login", "/register", "/captchaImage").anonymous()
-                .antMatchers(
-                        HttpMethod.GET,
-                        "/",
-                        "/*.html",
-                        "/**/*.html",
-                        "/**/*.css",
-                        "/**/*.js",
-                        "/profile/**"
-                ).permitAll()
+                .csrf(csrf -> csrf.disable())
+                .exceptionHandling(ex -> ex.authenticationEntryPoint(unauthorizedHandler))
+                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                )
+                .headers(headers -> headers.frameOptions(frame -> frame.disable()))
+                .logout(logout -> logout
+                        .logoutUrl("/logout")
+                        .logoutSuccessHandler(logoutSuccessHandler)
+                );
 
-                .antMatchers("/**").anonymous()
-                .antMatchers("/msg/**").anonymous()
-                .antMatchers("/msg/**/**").anonymous()
-                .antMatchers("/msg").anonymous()
-                .antMatchers("/testSop").anonymous()
-                .antMatchers("/common/getId**").anonymous()
-                .antMatchers("/common/uploadOSS**").anonymous()
-                .antMatchers("/common/uploadWang**").anonymous()
-                .antMatchers("/common/download**").anonymous()
-                .antMatchers("/common/download/resource**").anonymous()
-                .antMatchers("/swagger-ui.html").anonymous()
-                .antMatchers("/swagger-resources/**").anonymous()
-                .antMatchers("/webjars/**").anonymous()
-                .antMatchers("/*/api-docs").anonymous()
-                .antMatchers("/druid/**").anonymous()
-                .antMatchers("/qw/data/**").anonymous()
-                // 除上面外的所有请求全部需要鉴权认证
-                .anyRequest().authenticated()
-                .and()
-                .headers().frameOptions().disable();
-        httpSecurity.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler);
-        // 添加JWT filter
         httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
-        // 添加CORS filter
         httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
         httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class);
+
+        return httpSecurity.build();
+    }
+
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
     /**
@@ -149,8 +115,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     /**
      * 身份认证接口
      */
-    @Override
-    protected void configure(AuthenticationManagerBuilder auth) throws Exception
+    @Autowired
+    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
     {
         auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
     }

fs-qw-mq/pom.xml

@@ -18,7 +18,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -38,7 +38,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -50,7 +50,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -62,7 +62,7 @@
             <artifactId>druid-spring-boot-starter</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -113,8 +113,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-qw-mq/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-qw-mq/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,50 +1,53 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
- * spring security配置
+ * spring security??
  * 
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
-     * anyRequest          |   匹配所有请求路径
-     * access              |   SpringEl表达式结果为true时可以访问
-     * anonymous           |   匿名可以访问
-     * denyAll             |   用户不能访问
-     * fullyAuthenticated  |   用户完全认证可以访问（非remember-me下自动登录）
-     * hasAnyAuthority     |   如果有参数，参数表示权限，则其中任何一个权限可以访问
-     * hasAnyRole          |   如果有参数，参数表示角色，则其中任何一个角色可以访问
-     * hasAuthority        |   如果有参数，参数表示权限，则其权限可以访问
-     * hasIpAddress        |   如果有参数，参数表示IP地址，如果用户IP和参数匹配，则可以访问
-     * hasRole             |   如果有参数，参数表示角色，则其角色可以访问
-     * permitAll           |   用户可以任意访问
-     * rememberMe          |   允许通过remember-me登录的用户访问
-     * authenticated       |   用户登录后可访问
+     * anyRequest          |   ???????�?
+     * access              |   SpringEl??????true????�?
+     * anonymous           |   ??????
+     * denyAll             |   ??????
+     * fullyAuthenticated  |   ????????????remember-me??????
+     * hasAnyAuthority     |   ?????????????????????????�?
+     * hasAnyRole          |   ?????????????????????????�?
+     * hasAuthority        |   ????????????????????�?
+     * hasIpAddress        |   ??????????IP???????IP??????????�?
+     * hasRole             |   ????????????????????�?
+     * permitAll           |   ????????
+     * rememberMe          |   ????remember-me??????�?
+     * authenticated       |   ????????
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-qw-task/pom.xml

@@ -21,7 +21,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -41,7 +41,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -53,7 +53,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -84,7 +84,7 @@
 <!--            <version>0.3.2</version>-->
 <!--        </dependency>-->
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -112,8 +112,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-qw-task/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -39,7 +39,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -57,12 +57,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-qw-task/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,20 +1,21 @@
 package com.fs.framework.config;
 
-
 import com.fs.framework.security.filter.JwtAuthenticationTokenFilter;
 import com.fs.framework.security.handle.AuthenticationEntryPointImpl;
 import com.fs.framework.security.handle.LogoutSuccessHandlerImpl;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.authentication.logout.LogoutFilter;
 import org.springframework.web.filter.CorsFilter;
@@ -24,8 +25,9 @@ import org.springframework.web.filter.CorsFilter;
  *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
     /**
      * 自定义用户认证逻辑
@@ -57,19 +59,6 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     @Autowired
     private CorsFilter corsFilter;
 
-    /**
-     * 解决 无法直接注入 AuthenticationManager
-     *
-     * @return
-     * @throws Exception
-     */
-    @Bean
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception
-    {
-        return super.authenticationManagerBean();
-    }
-
     /**
      * anyRequest          |   匹配所有请求路径
      * access              |   SpringEl表达式结果为true时可以访问
@@ -85,56 +74,33 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
      * rememberMe          |   允许通过remember-me登录的用户访问
      * authenticated       |   用户登录后可访问
      */
-    @Override
-    protected void configure(HttpSecurity httpSecurity) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception
     {
         httpSecurity
-                // CSRF禁用，因为不使用session
-                .csrf().disable()
-                // 认证失败处理类
-                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
-                // 基于token，所以不需要session
-                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
-                // 过滤请求
-                .authorizeRequests()
-                // 对于登录login 注册register 验证码captchaImage 允许匿名访问
-                .antMatchers("/chat/upload/**","/login", "/register", "/captchaImage").anonymous()
-                .antMatchers(
-                        HttpMethod.GET,
-                        "/",
-                        "/*.html",
-                        "/**/*.html",
-                        "/**/*.css",
-                        "/**/*.js",
-                        "/profile/**"
-                ).permitAll()
-                .antMatchers("**").anonymous()
-                .antMatchers("/qw/getJsapiTicket/**").anonymous()
-                .antMatchers("/msg/**").anonymous()
-                .antMatchers("/msg/**/**").anonymous()
-                .antMatchers("/msg").anonymous()
-                .antMatchers("/app/common/**").anonymous()
-                .antMatchers("/common/getId**").anonymous()
-                .antMatchers("/common/uploadOSS**").anonymous()
-                .antMatchers("/common/uploadWang**").anonymous()
-                .antMatchers("/common/download**").anonymous()
-                .antMatchers("/common/download/resource**").anonymous()
-                .antMatchers("/swagger-ui.html").anonymous()
-                .antMatchers("/swagger-resources/**").anonymous()
-                .antMatchers("/webjars/**").anonymous()
-                .antMatchers("/*/api-docs").anonymous()
-                .antMatchers("/druid/**").anonymous()
-                .antMatchers("/qw/data/**").anonymous()
-                // 除上面外的所有请求全部需要鉴权认证
-                .anyRequest().authenticated()
-                .and()
-                .headers().frameOptions().disable();
-        httpSecurity.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler);
-        // 添加JWT filter
+                .csrf(csrf -> csrf.disable())
+                .exceptionHandling(ex -> ex.authenticationEntryPoint(unauthorizedHandler))
+                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                )
+                .headers(headers -> headers.frameOptions(frame -> frame.disable()))
+                .logout(logout -> logout
+                        .logoutUrl("/logout")
+                        .logoutSuccessHandler(logoutSuccessHandler)
+                );
+
         httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
-        // 添加CORS filter
         httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
         httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class);
+
+        return httpSecurity.build();
+    }
+
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
     /**
@@ -149,8 +115,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
     /**
      * 身份认证接口
      */
-    @Override
-    protected void configure(AuthenticationManagerBuilder auth) throws Exception
+    @Autowired
+    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
     {
         auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
     }

fs-qw-voice/pom.xml

@@ -18,7 +18,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -38,7 +38,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -50,7 +50,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -62,7 +62,7 @@
             <artifactId>druid-spring-boot-starter</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -108,8 +108,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-qw-voice/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-qw-voice/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,50 +1,53 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
- * spring security配置
+ * spring security??
  *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
-     * anyRequest          |   匹配所有请求路径
-     * access              |   SpringEl表达式结果为true时可以访问
-     * anonymous           |   匿名可以访问
-     * denyAll             |   用户不能访问
-     * fullyAuthenticated  |   用户完全认证可以访问（非remember-me下自动登录）
-     * hasAnyAuthority     |   如果有参数，参数表示权限，则其中任何一个权限可以访问
-     * hasAnyRole          |   如果有参数，参数表示角色，则其中任何一个角色可以访问
-     * hasAuthority        |   如果有参数，参数表示权限，则其权限可以访问
-     * hasIpAddress        |   如果有参数，参数表示IP地址，如果用户IP和参数匹配，则可以访问
-     * hasRole             |   如果有参数，参数表示角色，则其角色可以访问
-     * permitAll           |   用户可以任意访问
-     * rememberMe          |   允许通过remember-me登录的用户访问
-     * authenticated       |   用户登录后可访问
+     * anyRequest          |   ???????�?
+     * access              |   SpringEl??????true????�?
+     * anonymous           |   ??????
+     * denyAll             |   ??????
+     * fullyAuthenticated  |   ????????????remember-me??????
+     * hasAnyAuthority     |   ?????????????????????????�?
+     * hasAnyRole          |   ?????????????????????????�?
+     * hasAuthority        |   ????????????????????�?
+     * hasIpAddress        |   ??????????IP???????IP??????????�?
+     * hasRole             |   ????????????????????�?
+     * permitAll           |   ????????
+     * rememberMe          |   ????remember-me??????�?
+     * authenticated       |   ????????
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-qwhook-msg/pom.xml

@@ -17,7 +17,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -37,7 +37,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -49,7 +49,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -61,7 +61,7 @@
             <artifactId>druid-spring-boot-starter</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -114,8 +114,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-qwhook-msg/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-qwhook-msg/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,19 +1,21 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
  * spring security配置
  *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
@@ -31,21 +33,21 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
      * rememberMe          |   允许通过remember-me登录的用户访问
      * authenticated       |   用户登录后可访问
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .antMatchers("/app/crmCustomer/**").anonymous()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-qwhook-sop/pom.xml

@@ -17,7 +17,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -37,7 +37,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -49,7 +49,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -66,7 +66,7 @@
             <artifactId>lombok</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -119,8 +119,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-qwhook-sop/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-qwhook-sop/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,19 +1,21 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
  * spring security配置
  *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
@@ -31,21 +33,21 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
      * rememberMe          |   允许通过remember-me登录的用户访问
      * authenticated       |   用户登录后可访问
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .antMatchers("/app/crmCustomer/**").anonymous()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-qwhook/pom.xml

@@ -14,7 +14,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -34,7 +34,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -46,7 +46,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -58,7 +58,7 @@
             <artifactId>druid-spring-boot-starter</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -111,8 +111,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-qwhook/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-qwhook/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,19 +1,21 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
  * spring security配置
  *
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
@@ -31,21 +33,21 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
      * rememberMe          |   允许通过remember-me登录的用户访问
      * authenticated       |   用户登录后可访问
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .antMatchers("/app/crmCustomer/**").anonymous()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-redis/pom.xml

@@ -20,7 +20,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -40,7 +40,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -52,7 +52,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -69,7 +69,7 @@
             <artifactId>spring-boot-starter-thymeleaf</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -107,8 +107,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-redis/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-redis/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,50 +1,53 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
- * spring security配置
+ * spring security??
  * 
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
-     * anyRequest          |   匹配所有请求路径
-     * access              |   SpringEl表达式结果为true时可以访问
-     * anonymous           |   匿名可以访问
-     * denyAll             |   用户不能访问
-     * fullyAuthenticated  |   用户完全认证可以访问（非remember-me下自动登录）
-     * hasAnyAuthority     |   如果有参数，参数表示权限，则其中任何一个权限可以访问
-     * hasAnyRole          |   如果有参数，参数表示角色，则其中任何一个角色可以访问
-     * hasAuthority        |   如果有参数，参数表示权限，则其权限可以访问
-     * hasIpAddress        |   如果有参数，参数表示IP地址，如果用户IP和参数匹配，则可以访问
-     * hasRole             |   如果有参数，参数表示角色，则其角色可以访问
-     * permitAll           |   用户可以任意访问
-     * rememberMe          |   允许通过remember-me登录的用户访问
-     * authenticated       |   用户登录后可访问
+     * anyRequest          |   ???????�?
+     * access              |   SpringEl??????true????�?
+     * anonymous           |   ??????
+     * denyAll             |   ??????
+     * fullyAuthenticated  |   ????????????remember-me??????
+     * hasAnyAuthority     |   ?????????????????????????�?
+     * hasAnyRole          |   ?????????????????????????�?
+     * hasAuthority        |   ????????????????????�?
+     * hasIpAddress        |   ??????????IP???????IP??????????�?
+     * hasRole             |   ????????????????????�?
+     * permitAll           |   ????????
+     * rememberMe          |   ????remember-me??????�?
+     * authenticated       |   ????????
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-repeat-api/pom.xml

@@ -18,7 +18,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
-            <optional>true</optional> <!-- 表示�赖�会传递 -->
+            <optional>true</optional> <!-- 表示�赖�会传�-->
         </dependency>
         <!-- swagger2-->
         <dependency>
@@ -38,7 +38,7 @@
         </dependency>
 
 
-        <!-- Mysql驱动包 -->
+        <!-- Mysql驱动�-->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
@@ -50,7 +50,7 @@
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
 
-        <!-- SpringBoot 拦截器 -->
+        <!-- SpringBoot 拦截�-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
@@ -62,7 +62,7 @@
             <artifactId>druid-spring-boot-starter</artifactId>
         </dependency>
 
-        <!-- 验�� -->
+        <!-- 验��-->
         <dependency>
             <groupId>com.github.penggle</groupId>
             <artifactId>kaptcha</artifactId>
@@ -113,8 +113,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.1.1.RELEASE</version>
-                <configuration>
+                                <configuration>
                     <fork>true</fork> <!-- 如果没有该�置，devtools�会生效 -->
                 </configuration>
                 <executions>

fs-repeat-api/src/main/java/com/fs/framework/config/ResourcesConfig.java

@@ -35,7 +35,7 @@ public class ResourcesConfig implements WebMvcConfigurer
     }
 
     /**
-     * 鑷�畾涔夋嫤鎴��鍒�
+     * 鑷�畾涔夋嫤鎴��鍒?
      */
     @Override
     public void addInterceptors(InterceptorRegistry registry)
@@ -53,12 +53,12 @@ public class ResourcesConfig implements WebMvcConfigurer
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
         // 璁剧疆璁块棶婧愬湴鍧€
-        config.addAllowedOrigin("*");
+        config.addAllowedOriginPattern("*");
         // 璁剧疆璁块棶婧愯�姹傚ご
         config.addAllowedHeader("*");
-        // 璁剧疆璁块棶婧愯�姹傛柟娉�
+        // 璁剧疆璁块棶婧愯�姹傛柟娉?
         config.addAllowedMethod("*");
-        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃�
+        // 瀵规帴鍙ｉ厤缃�法鍩熻�缃?
         source.registerCorsConfiguration("/**", config);
         return new CorsFilter(source);
     }

fs-repeat-api/src/main/java/com/fs/framework/config/SecurityConfig.java

@@ -1,50 +1,53 @@
 package com.fs.framework.config;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 /**
- * spring security配置
+ * spring security??
  * 
 
  */
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
-public class SecurityConfig extends WebSecurityConfigurerAdapter
+@Configuration
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
+public class SecurityConfig
 {
 
     /**
-     * anyRequest          |   匹配所有请求路径
-     * access              |   SpringEl表达式结果为true时可以访问
-     * anonymous           |   匿名可以访问
-     * denyAll             |   用户不能访问
-     * fullyAuthenticated  |   用户完全认证可以访问（非remember-me下自动登录）
-     * hasAnyAuthority     |   如果有参数，参数表示权限，则其中任何一个权限可以访问
-     * hasAnyRole          |   如果有参数，参数表示角色，则其中任何一个角色可以访问
-     * hasAuthority        |   如果有参数，参数表示权限，则其权限可以访问
-     * hasIpAddress        |   如果有参数，参数表示IP地址，如果用户IP和参数匹配，则可以访问
-     * hasRole             |   如果有参数，参数表示角色，则其角色可以访问
-     * permitAll           |   用户可以任意访问
-     * rememberMe          |   允许通过remember-me登录的用户访问
-     * authenticated       |   用户登录后可访问
+     * anyRequest          |   ???????�?
+     * access              |   SpringEl??????true????�?
+     * anonymous           |   ??????
+     * denyAll             |   ??????
+     * fullyAuthenticated  |   ????????????remember-me??????
+     * hasAnyAuthority     |   ?????????????????????????�?
+     * hasAnyRole          |   ?????????????????????????�?
+     * hasAuthority        |   ????????????????????�?
+     * hasIpAddress        |   ??????????IP???????IP??????????�?
+     * hasRole             |   ????????????????????�?
+     * permitAll           |   ????????
+     * rememberMe          |   ????remember-me??????�?
+     * authenticated       |   ????????
      */
-    @Override
-    protected void configure(HttpSecurity http) throws Exception
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception
     {
-        http.authorizeRequests()
-                .antMatchers("/**").permitAll()
-                .anyRequest().authenticated()
-                .and().csrf().disable();
+        http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
     }
 
-    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception
+    {
+        return configuration.getAuthenticationManager();
     }
 
-
 }

fs-service/pom.xml

@@ -182,7 +182,6 @@
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-test</artifactId>
-            <version>5.2.12.RELEASE</version>
         </dependency>
 
         <dependency>
@@ -231,7 +230,7 @@
             <groupId>org.redisson</groupId>
             <artifactId>redisson-spring-boot-starter</artifactId>
             <exclusions>
-                <!-- 默认 spring-data-32 面向 Spring Boot 3.x，Boot 2.2 需改用 redisson-spring-data-22 -->
+                <!-- 默认 spring-data-32 面向 Spring Boot 3.x，Boot 2.7 需改用 redisson-spring-data-27 -->
                 <exclusion>
                     <groupId>org.redisson</groupId>
                     <artifactId>redisson-spring-data-32</artifactId>
@@ -240,7 +239,7 @@
         </dependency>
         <dependency>
             <groupId>org.redisson</groupId>
-            <artifactId>redisson-spring-data-22</artifactId>
+            <artifactId>redisson-spring-data-27</artifactId>
         </dependency>
 
         <dependency>

fs-service/src/main/java/com/fs/ad/service/impl/AdHtmlClickLogServiceImpl.java

@@ -154,7 +154,7 @@ public class AdHtmlClickLogServiceImpl extends ServiceImpl<AdHtmlClickLogMapper,
             }
             if(one != null){
                 String uploadType = clickType.name();
-                Integer i = adUploadLogMapper.selectCount(new QueryWrapper<AdUploadLog>().eq("vid", one.getVid()).like("upload_type", uploadType));
+                long i = adUploadLogMapper.selectCount(new QueryWrapper<AdUploadLog>().eq("vid", one.getVid()).like("upload_type", uploadType));
                 if(i > 0){
                     log.info("vid：{}， {}已经上传次数{}", one.getVid(), uploadType, i);
                     return;

fs-service/src/main/java/com/fs/course/config/RedisKeyScanner.java

@@ -8,7 +8,6 @@ import org.springframework.data.redis.core.StringRedisTemplate;
 import org.springframework.data.redis.serializer.RedisSerializer;
 import org.springframework.stereotype.Component;
 
-import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.util.Collection;
 import java.util.HashSet;
@@ -37,8 +36,6 @@ public class RedisKeyScanner {
             try (Cursor<byte[]> cursor = connection.scan(options)) {
                 RedisSerializer<String> keySerializer = redisTemplate.getStringSerializer();
                 cursor.forEachRemaining(item -> keys.add(keySerializer.deserialize(item)));
-            } catch (IOException e) {
-                throw new RuntimeException(e);
             }
             return null;
         });
@@ -57,8 +54,6 @@ public class RedisKeyScanner {
                     String key = (String) redisTemplate.getKeySerializer().deserialize(rawKey);
                     keys.add(key);
                 }
-            } catch (IOException e) {
-                throw new RuntimeException("Error during scan", e);
             }
             return null;
         });
@@ -88,8 +83,6 @@ public class RedisKeyScanner {
                 while (cursor.hasNext()) {
                     keys.add(keySerializer.deserialize(cursor.next()));
                 }
-            } catch (IOException e) {
-                throw new RuntimeException("Error during redis SCAN", e);
             }
             return null;
         });
@@ -108,10 +101,6 @@ public class RedisKeyScanner {
                 while (cursor.hasNext()) {
                     keys.add(new String(cursor.next(), StandardCharsets.UTF_8)); // 显式指定字符集，避免依赖默认值
                 }
-            } catch (IOException e) {
-                // 在实际项目中，应该使用更合适的日志记录和异常处理方式
-                // 例如抛出自定义异常或记录错误日志
-                throw new RuntimeException("Error during SCAN operation", e);
             }
             return keys;
         });

fs-service/src/main/java/com/fs/course/service/impl/CourseRepeatByProjectServiceImpl.java

@@ -143,7 +143,6 @@ public class CourseRepeatByProjectServiceImpl implements ICourseRepeatByProjectS
             if (param.getQwExternalId() != null) {
                 w.or().eq("qw_external_contact_id", param.getQwExternalId());
             }
-            return w;
         });
         List<FsCourseWatchLog> watchLogs = courseWatchLogMapper.selectList(watchWrapper);
         if (CollectionUtils.isNotEmpty(watchLogs) && currentCompanyUserId != null) {

fs-service/src/main/java/com/fs/his/service/impl/FsPhysicalReportTemplateServiceImpl.java

@@ -3,7 +3,6 @@ package com.fs.his.service.impl;
 import java.util.List;
 
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
-import com.baomidou.mybatisplus.extension.service.additional.query.impl.LambdaQueryChainWrapper;
 import com.fs.common.exception.ServiceException;
 import com.fs.common.utils.DateUtils;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;

fs-service/src/main/java/com/fs/hisStore/domain/FsHomeArticleScrm.java

@@ -73,7 +73,7 @@ public class FsHomeArticleScrm extends BaseEntity
     /** 发布时间 */
     @JsonFormat(pattern = "yyyy-MM-dd")
     @Excel(name = "发布时间", width = 30, dateFormat = "yyyy-MM-dd")
-    @TableField(strategy= FieldStrategy.IGNORED)
+    @TableField(insertStrategy = FieldStrategy.ALWAYS, updateStrategy = FieldStrategy.ALWAYS)
     private Date publishTime;
 
     /** 发布状态：1-已发布；2-草稿 */

fs-service/src/main/java/com/fs/hisStore/domain/FsStoreProductScrm.java

@@ -30,7 +30,7 @@ public class FsStoreProductScrm extends BaseEntity
     @Excel(name = "商品图片")
     private String image;
 
-    @TableField(strategy = FieldStrategy.IGNORED)
+    @TableField(insertStrategy = FieldStrategy.ALWAYS, updateStrategy = FieldStrategy.ALWAYS)
     private String video;
 
     /** 轮播图 */

fs-service/src/main/java/com/fs/newAdv/domain/AdvChannelEntity.java

@@ -38,11 +38,11 @@ public class AdvChannelEntity extends Model<AdvChannelEntity> {
     @TableField("parent_id")
     private Long parentId;
 
-    @TableField(value = "create_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "create_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime createTime;
 
-    @TableField(value = "update_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "update_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime updateTime;
 

fs-service/src/main/java/com/fs/newAdv/domain/AdvProjectEntity.java

@@ -34,7 +34,7 @@ public class AdvProjectEntity extends Model<AdvProjectEntity> {
     @TableField("project_name")
     private String projectName;
 
-    @TableField(value = "create_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "create_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime createTime;
 

fs-service/src/main/java/com/fs/newAdv/domain/Advertiser.java

@@ -58,14 +58,14 @@ public class Advertiser implements Serializable {
     /**
      * 创建时间
      */
-    @TableField(value = "create_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "create_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime createTime;
 
     /**
      * 更新时间
      */
-    @TableField(value = "update_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "update_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime updateTime;
 

fs-service/src/main/java/com/fs/newAdv/domain/CallbackAccount.java

@@ -77,14 +77,14 @@ public class CallbackAccount implements Serializable {
     /**
      * 创建时间
      */
-    @TableField(value = "create_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "create_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime createTime;
 
     /**
      * 更新时间
      */
-    @TableField(value = "update_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "update_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime updateTime;
 

fs-service/src/main/java/com/fs/newAdv/domain/ConversionLog.java

@@ -84,14 +84,14 @@ public class ConversionLog implements Serializable {
     /**
      * 创建时间
      */
-    @TableField(value = "create_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "create_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime createTime;
 
     /**
      * 更新时间
      */
-    @TableField(value = "update_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "update_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime updateTime;
 }

fs-service/src/main/java/com/fs/newAdv/domain/ConversionTarget.java

@@ -49,14 +49,14 @@ public class ConversionTarget implements Serializable {
     /**
      * 创建时间
      */
-    @TableField(value = "create_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "create_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime createTime;
 
     /**
      * 更新时间
      */
-    @TableField(value = "update_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "update_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime updateTime;
 }

fs-service/src/main/java/com/fs/newAdv/domain/DomainUrl.java

@@ -48,14 +48,14 @@ public class DomainUrl implements Serializable {
     /**
      * 创建时间
      */
-    @TableField(value = "create_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "create_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime createTime;
 
     /**
      * 更新时间
      */
-    @TableField(value = "update_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "update_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime updateTime;
 

fs-service/src/main/java/com/fs/newAdv/domain/LandingPageTemplate.java

@@ -22,7 +22,7 @@ public class LandingPageTemplate implements Serializable {
     /**
      * 主键ID（UUID）
      */
-    @TableId(value = "id", type = IdType.UUID)
+    @TableId(value = "id", type = IdType.ASSIGN_UUID)
     private String id;
 
     /**
@@ -58,14 +58,14 @@ public class LandingPageTemplate implements Serializable {
     /**
      * 创建时间
      */
-    @TableField(value = "create_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "create_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime createTime;
 
     /**
      * 更新时间
      */
-    @TableField(value = "update_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "update_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime updateTime;
 

fs-service/src/main/java/com/fs/newAdv/domain/Lead.java

@@ -131,14 +131,14 @@ public class Lead implements Serializable {
      * /**
      * 创建时间
      */
-    @TableField(value = "create_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "create_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime createTime;
 
     /**
      * 更新时间
      */
-    @TableField(value = "update_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "update_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime updateTime;
 

fs-service/src/main/java/com/fs/newAdv/domain/PromotionAccount.java

@@ -108,14 +108,14 @@ public class PromotionAccount implements Serializable {
     /**
      * 创建时间
      */
-    @TableField(value = "create_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "create_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime createTime;
 
     /**
      * 更新时间
      */
-    @TableField(value = "update_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "update_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime updateTime;
 

fs-service/src/main/java/com/fs/newAdv/domain/Site.java

@@ -127,14 +127,14 @@ public class Site implements Serializable {
     /**
      * 创建时间
      */
-    @TableField(value = "create_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "create_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime createTime;
 
     /**
      * 更新时间
      */
-    @TableField(value = "update_time", strategy = FieldStrategy.NOT_NULL)
+    @TableField(value = "update_time", insertStrategy = FieldStrategy.NOT_NULL, updateStrategy = FieldStrategy.NOT_NULL)
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
     private LocalDateTime updateTime;
 

fs-service/src/main/java/com/fs/qw/service/impl/QwExternalContactServiceImpl.java

@@ -6075,7 +6075,6 @@ public class QwExternalContactServiceImpl extends ServiceImpl<QwExternalContactM
                     if(levelList.contains("-1")) {
                         qw.or().isNull("level");
                     }
-                    return qw;
                 });
 
         return list(queryCondition);

fs-service/src/main/java/com/fs/qw/service/impl/QwUserServiceImpl.java

@@ -130,7 +130,7 @@ public class QwUserServiceImpl implements IQwUserService
         QwUser qwUser = qwUserMapper.selectQwUserById(loginParam.getQwUserId());
         Company company = companyService.selectCompanyById(qwUser.getCompanyId());
         if(company !=null && company.getMaxPadNum() != null && company.getMaxPadNum() != -1){
-           int padCount = qwUserMapper.selectCount(new QueryWrapper<QwUser>()
+           long padCount = qwUserMapper.selectCount(new QueryWrapper<QwUser>()
                    .eq("company_id", company.getCompanyId())
                    .isNotNull("server_id"));
            if (padCount>=company.getMaxPadNum()){

fs-service/src/main/java/com/fs/sop/domain/QwSop.java

@@ -23,7 +23,7 @@ public class QwSop implements Serializable
 {
 
     /** id */
-    @TableId(type = IdType.UUID)
+    @TableId(type = IdType.ASSIGN_UUID)
     private String id;
 
     /** 规则名称 */

fs-service/src/main/resources/application-common.yml

@@ -43,6 +43,8 @@ express:
   omsCode: "SF.0235402855"
 # Spring配置
 spring:
+  main:
+    allow-circular-references: true
   cache:
     type: redis
   # 资源信息
@@ -50,6 +52,8 @@ spring:
     # 国际化资源文件路径
     basename: i18n/messages
   mvc:
+    pathmatch:
+      matching-strategy: ant_path_matcher
     async:
       request-timeout: 600000
 
@@ -86,8 +90,10 @@ mybatis-plus:
     db-config:
       # 主键类型  0:"数据库ID自增", 1:"用户输入ID",2:"全局唯一ID (数字类型唯一ID)", 3:"全局唯一ID UUID";
       idType: AUTO
-      # 字段策略 0:"忽略判断",1:"非 NULL 判断"),2:"非空判断"
-      fieldStrategy: NOT_EMPTY
+      # 字段策略（MyBatis-Plus 3.5+ 拆分 insert/update/where）
+      insert-strategy: not_empty
+      update-strategy: not_empty
+      where-strategy: not_empty
     banner: false
     # 配置
   configuration:

fs-service/src/main/resources/application-dev-czt.yml

@@ -1,7 +1,9 @@
 # 数据源配置
 spring:
-    profiles:
-        include: config-dev-czt,common
+    config:
+        import:
+            - classpath:application-config-dev-czt.yml
+            - classpath:application-common.yml
     # redis 配置
     redis:
         host: localhost

fs-service/src/main/resources/application-dev-jnlzjk.yml

@@ -1,7 +1,9 @@
 # 数据源配置
 spring:
-    profiles:
-        include: config-dev-jnlzjk,common
+    config:
+        import:
+            - classpath:application-config-dev-jnlzjk.yml
+            - classpath:application-common.yml
     # redis 配置
     redis:
         host: localhost

fs-service/src/main/resources/application-dev-test.yml

@@ -1,7 +1,9 @@
 # 数据源配置
 spring:
-    profiles:
-        include: common,config-dev
+    config:
+        import:
+            - classpath:application-common.yml
+            - classpath:application-config-dev.yml
 #    profiles:
 #        include: config-dev,common
     # redis 配置

fs-service/src/main/resources/application-dev-xcsw.yml

@@ -1,7 +1,9 @@
 # 数据源配置
 spring:
-    profiles:
-        include: config-druid-xcsw,common
+    config:
+        import:
+            - classpath:application-config-druid-xcsw.yml
+            - classpath:application-common.yml
     # redis 配置
     redis:
         host: 127.0.0.1