春季安全配置未生效

huangapple
未分类评论53阅读模式
标题翻译

Spring Security Configuration is not applied

问题

我有以下配置，需要为 /api/v1/** 端点配置 HTTPBasic 认证，并且我想为 /users/ 的 URL 模式配置 form 认证。当我按照以下配置运行时，Web 请求的配置正常工作，但 API 的配置却没有生效。没有应用任何安全性。我哪里做错了？

  1. @Configuration
  2. @EnableWebSecurity
  3. public class WebSecurityConfig {
  5.     @Order(1)
  6.     @Configuration
  7.     public static class MVCSecurityConfiguration extends WebSecurityConfigurerAdapter {
  9.         @Bean
  10.         public BCryptPasswordEncoder getBCryptPasswordEncoder() {
  11.             return new BCryptPasswordEncoder();
  12.         }
  14.         @Override
  15.         protected void configure(HttpSecurity http) throws Exception {
  16.             http
  17.                 .antMatcher("/users/**")
  18.                 .csrf()
  19.                     .and()
  20.                 .authorizeRequests()
  21.                 .antMatchers(
  22.                     "/resources/**", "/users/register", "/users/signup", "/users/confirm", 
  23.                     "/users/user-action", "/users/reset-password", "/confirm", "/webjars/**"
  24.                 )
  25.                 .permitAll()
  26.                 .antMatchers("/users/**")
  27.                 .hasRole("USER")
  28.                 .anyRequest()
  29.                 .authenticated()
  30.                 .and()
  31.                 .formLogin()
  32.                     .loginPage("/login")
  33.                     .usernameParameter("username")
  34.                     .passwordParameter("password");
  36.             http
  37.                 .authorizeRequests()
  38.                 .antMatchers("/api/v1/users/**")
  39.                 .hasRole("USER")
  40.                 .anyRequest()
  41.                 .authenticated()
  42.                 .and()
  43.                 .httpBasic();
  44.         }
  45.     }
  46. }
英文翻译

I have the below configuration where i need to configure HTTPBasic authentication for /api/v1/** endpoints and i want to configure form authentication for /users/ url pattern. When i run with the below configuration, the configuration for web requests is working correctly but the configuration for API is not working. No security is being applied. Where am I going wrong?

  1. @Configuration
  2. @EnableWebSecurity
  3. public class WebSecurityConfig {
  5.     @Order(1)
  6.     @Configuration
  7.     public static class MVCSecurityConfiguration extends WebSecurityConfigurerAdapter {
  9.         @Bean
  10.         public BCryptPasswordEncoder getBCryptPasswordEncoder() {
  11.             return new BCryptPasswordEncoder();
  12.         }
  14.         @Override
  15.         protected void configure(HttpSecurity http) throws Exception {
  16.             http.
  17.                     antMatcher("/users/**")
  18.                     .csrf()
  19.                         .and()
  20.                     .authorizeRequests()
  21.                     .antMatchers(
  22.                             "/resources/**", "/users/register", "/users/signup", "/users/confirm", "/users/user-action", "/users/reset-password", "/confirm", "/webjars/**")
  23.                     .permitAll()
  24.                     .antMatchers("/users/**")
  25.                     .hasRole("USER")
  26.                     .anyRequest()
  27.                     .authenticated()
  28.                     .and()
  29.                     .formLogin().loginPage("/login").usernameParameter("username").passwordParameter("password");
  31.             http
  32.                     .authorizeRequests()
  33.                     .antMatchers("/api/v1/users/**")
  34.                     .hasRole("USER")
  35.                     .anyRequest()
  36.                     .authenticated()
  37.                     .and()
  38.                     .httpBasic();
  39.         }
  40.     }

答案1

得分: 3

我已经将您的代码与下面的配置一起使用：

  1. @EnableWebSecurity
  2. public class SecurityConfiguration {
  4.     public class ApiSecurityConfig extends WebSecurityConfigurerAdapter {
  6.         @Override
  7.         protected void configure(HttpSecurity http) throws Exception {
  8.             http.antMatcher("/api/v1/users/**")
  9.                 .authorizeRequests().anyRequest()
  10.                 .hasRole("USER").and().httpBasic();
  11.         }
  13.     }
  15.     @Configuration
  16.     @Order(2)
  17.     public class MVCSecurityConfiguration extends WebSecurityConfigurerAdapter {
  19.         @Override
  20.         protected void configure(HttpSecurity http) throws Exception {
  22.             http.csrf().and().authorizeRequests()
  23.                     .antMatchers("/resources/**", "/users/register", "/users/signup", "/users/confirm",
  24.                             "/users/user-action", "/users/reset-password", "/confirm", "/webjars/**").permitAll()
  25.             .antMatchers("/users/**").hasRole("USER")
  26.             .and()
  27.             .formLogin().usernameParameter("username").passwordParameter("password");
  28.         }
  29.     }
  31. }

查看关于Spring Security的文档以及示例代码此处。

英文翻译

I have put your code to work with this configuration bellow:

  1. @EnableWebSecurity
  2. public class SecurityConfiguration {
  4. public class ApiSecurityConfig extends WebSecurityConfigurerAdapter {
  5. 	
  6. 	@Override
  7. 	protected void configure(HttpSecurity http) throws Exception {
  8. 		http.antMatcher("/api/v1/users/**")
  9.            .authorizeRequests().anyRequest()
  10.            .hasRole("USER").and().httpBasic();
  11. 	}
  13. }
  15. @Configuration
  16. @Order(2)
  17. public class MVCSecurityConfiguration extends WebSecurityConfigurerAdapter {
  19. 	@Override
  20. 	protected void configure(HttpSecurity http) throws Exception {
  22. 		http.csrf().and().authorizeRequests()
  23. 				.antMatchers("/resources/**", "/users/register", "/users/signup", "/users/confirm",
  24. 						"/users/user-action", "/users/reset-password", "/confirm", "/webjars/**").permitAll()
  25. 		.antMatchers("/users/**").hasRole("USER")
  26.         .and()
  27.         .formLogin().usernameParameter("username").passwordParameter("password");
  28. 	}
  29. }
  31. }

View docs for Spring Security and sample code here.

huangapple
  • 本文由 发表于 2020年5月30日 20:37:11
  • 转载请务必保留本文链接：https://java.coder-hub.com/62102534.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定