@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
        return httpSecurity
                // CSRF禁用，因?yàn)椴皇褂胹ession
                .csrf(AbstractHttpConfigurer::disable)
                // 禁用HTTP響應(yīng)標(biāo)頭
                .headers(header -> header.cacheControl(HeadersConfigurer.CacheControlConfig::disable).frameOptions(HeadersConfigurer.FrameOptionsConfig::disable))
                // 認(rèn)證失敗處理類
                .exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler))
                // 基于token，所以不需要session
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                // 注解標(biāo)記允許匿名訪問的url
                .authorizeHttpRequests((requests) -> {
                    permitAllUrl.getUrls().forEach(url -> requests.requestMatchers(url).permitAll());
                    // 對于登錄login 注冊register 驗(yàn)證碼captchaImage 允許匿名訪問
                    requests.requestMatchers("/login", "/register", "/captchaImage").permitAll()
                            .dispatcherTypeMatchers(DispatcherType.ASYNC).permitAll() //新增設(shè)置*
                            // 靜態(tài)資源，可匿名訪問
                            .requestMatchers(HttpMethod.GET, "/", "/*.html", "/**.html", "/**.css", "/**.js", "/profile/**").permitAll()
                            .requestMatchers("/webjars/**", "/druid/**").permitAll()
                            // 除上面外的所有請求全部需要鑒權(quán)認(rèn)證
                            .anyRequest().authenticated();
                })
                // 添加Logout filter
                .logout(logout -> logout.logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler))
                // 添加JWT filter
                .addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
                // 添加CORS filter
                .addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class)
                .addFilterBefore(corsFilter, LogoutFilter.class).build();
    }
}

    也可以使用`.requestMatchers("/test").permitAll()`開放SSE接口！但是該方式會放棄網(wǎng)關(guān)層面的權(quán)限控制，需在業(yè)務(wù)代碼中手動(dòng)校驗(yàn)身份，極易引發(fā)安全問題。

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor;
import org.springframework.web.servlet.config.annotation.AsyncSupportConfigurer;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import java.util.concurrent.Executor;
import java.util.concurrent.ThreadPoolExecutor;
@Configuration
public class AsyncWebMvcConfig implements WebMvcConfigurer {
    /**
     * 配置Spring MVC異步請求的任務(wù)執(zhí)行器
     */
    @Override
    public void configureAsyncSupport(AsyncSupportConfigurer configurer) {
        configurer.setTaskExecutor(mvcAsyncTaskExecutor()); // 綁定自定義線程池
        configurer.setDefaultTimeout(60_000L); // 可選：SSE會話超時(shí)時(shí)間（毫秒），按需調(diào)整
    }
    /**
     * 定義生產(chǎn)級線程池Bean
     */
    @Bean(name = "mvcAsyncTaskExecutor")
    public Executor mvcAsyncTaskExecutor() {
        ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
        int cpuCores = Runtime.getRuntime().availableProcessors(); // 動(dòng)態(tài)獲取CPU核心數(shù)
        // 核心參數(shù)配置
        executor.setCorePoolSize(cpuCores * 2); // 核心線程數(shù)：IO密集型任務(wù)推薦CPU核心數(shù)*2
        executor.setMaxPoolSize(cpuCores * 5);  // 最大線程數(shù)：高峰期彈性擴(kuò)容上限
        executor.setQueueCapacity(100);         // 任務(wù)隊(duì)列：緩沖瞬時(shí)突發(fā)流量
        executor.setThreadNamePrefix("sse-async-"); // 線程名前綴：便于日志追蹤和監(jiān)控
        executor.setRejectedExecutionHandler(new ThreadPoolExecutor.CallerRunsPolicy()); // 拒絕策略
        executor.setKeepAliveSeconds(60); // 空閑線程存活時(shí)間：超過核心線程數(shù)的空閑線程60秒后銷毀
        executor.initialize(); // 初始化執(zhí)行器
        return executor;
    }
}

import org.springframework.scheduling.annotation.Async;
import org.springframework.stereotype.Service;
@Service
public class SseAsyncService {
    // 明確指定使用自定義線程池
    @Async("mvcAsyncTaskExecutor")
    public void handleSseMessage(String message) {
        // SSE相關(guān)的異步業(yè)務(wù)邏輯
        System.out.println("處理SSE消息：" + message);
    }
}