WebSecurityConfigurerAdapter是默認情況下spring security的http配置
ResourceServerConfigurerAdapter是默認情況下spring security oauth2的http配置
WebSecurityConfigurerAdapter部分源碼如下:
@Order(100)
public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigurer<WebSecurity> {
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
...
}
public void configure(WebSecurity web) throws Exception {
}
protected void configure(HttpSecurity http) throws Exception {
...
}
...
}
ResourceServerConfigurerAdapter部分源碼如下:
public class ResourceServerConfigurerAdapter implements ResourceServerConfigurer {
@Override
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
}
@Override
public void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().anyRequest().authenticated();
}
}
在ResourceServerProperties中，定義了它的order默認值為SecurityProperties.ACCESS_OVERRIDE_ORDER - 1;夷陋，是大于100的,即WebSecurityConfigurerAdapter的配置的攔截要優(yōu)先于ResourceServerConfigurerAdapter彪腔，優(yōu)先級高的http配置是可以覆蓋優(yōu)先級低的配置的砰琢。
某些情況下如果需要ResourceServerConfigurerAdapter的攔截優(yōu)先于WebSecurityConfigurerAdapter需要在配置文件中添加
security.oauth2.resource.filter-order=99
或者重寫WebSecurityConfigurerAdapter的Order配置吼句，如下：
@Configuration
@EnableWebSecurity
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
...
}
