From d3b39ff00050dd41386d4c79a8bce8a46082f34e Mon Sep 17 00:00:00 2001
From: haoxr <1490493387@qq.com>
Date: Tue, 27 Jul 2021 21:01:05 +0800
Subject: [PATCH] =?UTF-8?q?fix(ResourceServerManager.java):=20=E7=AE=A1?=
 =?UTF-8?q?=E7=90=86=E7=AB=AF=E6=8E=A5=E5=8F=A3=E6=B7=BB=E5=8A=A0=E8=AE=A4?=
 =?UTF-8?q?=E8=AF=81=E5=88=A4=E6=96=AD=EF=BC=8C=E8=AE=A4=E8=AF=81=E4=B9=8B?=
 =?UTF-8?q?=E5=90=8E=E5=86=8D=E9=89=B4=E6=9D=83?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../gateway/security/ResourceServerManager.java  | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/youlai-gateway/src/main/java/com/youlai/gateway/security/ResourceServerManager.java b/youlai-gateway/src/main/java/com/youlai/gateway/security/ResourceServerManager.java
index 166baaa1..81211af0 100644
--- a/youlai-gateway/src/main/java/com/youlai/gateway/security/ResourceServerManager.java
+++ b/youlai-gateway/src/main/java/com/youlai/gateway/security/ResourceServerManager.java
@@ -52,24 +52,24 @@ public class ResourceServerManager implements ReactiveAuthorizationManager<Autho
         if (request.getMethod() == HttpMethod.OPTIONS) {
             return Mono.just(new AuthorizationDecision(true));
         }
-        PathMatcher pathMatcher = new AntPathMatcher(); // Ant匹配器
+        PathMatcher pathMatcher = new AntPathMatcher();
         String method = request.getMethodValue();
         String path = request.getURI().getPath();
         String restfulPath = method + ":" + path; // Restful接口权限设计 @link https://www.cnblogs.com/haoxianrui/p/14961707.html
 
 
-        // 移动端请求需认证但无需鉴权判断
         String token = request.getHeaders().getFirst(AuthConstants.AUTHORIZATION_KEY);
-        if (pathMatcher.match(GlobalConstants.APP_API_PATTERN, path)) {
-            // 如果token以"bearer "为前缀，到这里说明JWT有效即已认证
-            if (StrUtil.isNotBlank(token)
-                    && token.startsWith(AuthConstants.AUTHORIZATION_PREFIX)) {
+        // 如果token以"bearer "为前缀，到这里说明JWT有效即已认证
+        if (StrUtil.isNotBlank(token) && token.startsWith(AuthConstants.AUTHORIZATION_PREFIX)) {
+            // 移动端请求认证即可，不需后续鉴权
+            if (pathMatcher.match(GlobalConstants.APP_API_PATTERN, path)) {
                 return Mono.just(new AuthorizationDecision(true));
-            } else {
-                return Mono.just(new AuthorizationDecision(false));
             }
+        } else {
+            return Mono.just(new AuthorizationDecision(false));
         }
 
+
         // 缓存取 URL权限-角色集合 规则数据
         // urlPermRolesRules = [{'key':'GET:/api/v1/users/*','value':['ADMIN','TEST']},...]
         Map<String, Object> urlPermRolesRules;
-- 
GitLab