JAVA SSE接口开发中的Spring Security与异步线程池配置方法

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
        return httpSecurity
                // CSRF禁用，因为不使用session
                .csrf(AbstractHttpConfigurer::disable)
                // 禁用HTTP响应标头
                .headers(header -> header.cacheControl(HeadersConfigurer.CacheControlConfig::disable).frameOptions(HeadersConfigurer.FrameOptionsConfig::disable))
                // 认证失败处理类
                .exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler))
                // 基于token，所以不需要session
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                // 注解标记允许匿名访问的url
                .authorizeHttpRequests((requests) -> {
                    permitAllUrl.getUrls().forEach(url -> requests.requestMatchers(url).permitAll());
                    // 对于登录login 注册register 验证码captchaImage 允许匿名访问
                    requests.requestMatchers("/login", "/register", "/captchaImage").permitAll()
                            .dispatcherTypeMatchers(DispatcherType.ASYNC).permitAll() //新增设置*
                            // 静态资源，可匿名访问
                            .requestMatchers(HttpMethod.GET, "/", "/*.html", "/**.html", "/**.css", "/**.js", "/profile/**").permitAll()
                            .requestMatchers("/webjars/**", "/druid/**").permitAll()
                            // 除上面外的所有请求全部需要鉴权认证
                            .anyRequest().authenticated();
                })
                // 添加Logout filter
                .logout(logout -> logout.logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler))
                // 添加JWT filter
                .addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
                // 添加CORS filter
                .addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class)
                .addFilterBefore(corsFilter, LogoutFilter.class).build();
    }
}

    也可以使用`.requestMatchers("/test").permitAll()`开放SSE接口！但是该方式会放弃网关层面的权限控制，需在业务代码中手动校验身份，极易引发安全问题。

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor;
import org.springframework.web.servlet.config.annotation.AsyncSupportConfigurer;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import java.util.concurrent.Executor;
import java.util.concurrent.ThreadPoolExecutor;
@Configuration
public class AsyncWebMvcConfig implements WebMvcConfigurer {
    /**
     * 配置Spring MVC异步请求的任务执行器
     */
    @Override
    public void configureAsyncSupport(AsyncSupportConfigurer configurer) {
        configurer.setTaskExecutor(mvcAsyncTaskExecutor()); // 绑定自定义线程池
        configurer.setDefaultTimeout(60_000L); // 可选：SSE会话超时时间（毫秒），按需调整
    }
    /**
     * 定义生产级线程池Bean
     */
    @Bean(name = "mvcAsyncTaskExecutor")
    public Executor mvcAsyncTaskExecutor() {
        ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
        int cpuCores = Runtime.getRuntime().availableProcessors(); // 动态获取CPU核心数
        // 核心参数配置
        executor.setCorePoolSize(cpuCores * 2); // 核心线程数：IO密集型任务推荐CPU核心数*2
        executor.setMaxPoolSize(cpuCores * 5);  // 最大线程数：高峰期弹性扩容上限
        executor.setQueueCapacity(100);         // 任务队列：缓冲瞬时突发流量
        executor.setThreadNamePrefix("sse-async-"); // 线程名前缀：便于日志追踪和监控
        executor.setRejectedExecutionHandler(new ThreadPoolExecutor.CallerRunsPolicy()); // 拒绝策略
        executor.setKeepAliveSeconds(60); // 空闲线程存活时间：超过核心线程数的空闲线程60秒后销毁
        executor.initialize(); // 初始化执行器
        return executor;
    }
}

import org.springframework.scheduling.annotation.Async;
import org.springframework.stereotype.Service;
@Service
public class SseAsyncService {
    // 明确指定使用自定义线程池
    @Async("mvcAsyncTaskExecutor")
    public void handleSseMessage(String message) {
        // SSE相关的异步业务逻辑
        System.out.println("处理SSE消息：" + message);
    }
}