招摇后返回403禁止Spring引导Spring安全

ou6hu8tu  于 2021-07-06  发布在  Java
关注(0)|答案(1)|浏览(444)

我得到403状态禁止在招摇只为后方法的要求。我尝试了所有的springsecuritycfg来解决这个问题,但是只对get方法有效。我用Spring Boot,Spring安全和招摇。¿ 有人能帮我吗?这里是斯威格cfg:

@Configuration
@EnableSwagger2
public class SwaggerConfig {

    @Bean
    public Docket api() {
        return new Docket(DocumentationType.SWAGGER_2)  
                .select()                                  
                .apis(RequestHandlerSelectors.any())              
                .paths(PathSelectors.any())                          
                .build();
    }
}

以下是 Spring 安全措施:

@Configuration
@EnableWebSecurity
public class SecurityCFG extends WebSecurityConfigurerAdapter{

    @Bean
    public PasswordEncoder encoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        PasswordEncoder encoder = encoder();
        auth
          .inMemoryAuthentication()
          .withUser("carlos")
          .password(encoder.encode("admin123"))
          .roles("USER")
          .and()
          .withUser("carlos2")
          .password(encoder.encode("admin123"))
          .roles("USER", "ADMIN");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
          .authorizeRequests()
          .antMatchers(
                  "/v2/api-docs", 
                  "/swagger-resources/**",  
                  "/swagger-ui.html", 
                  "/webjars/**" ,
                   /*Probably not needed*/ "/swagger.json")
          .permitAll()
          .anyRequest()
          .authenticated()
          .and()
          .httpBasic();
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/v2/api-docs/**");
        web.ignoring().antMatchers("/swagger.json");
        web.ignoring().antMatchers("/swagger-ui.html");
        web.ignoring().antMatchers("/swagger-resources/**");
        web.ignoring().antMatchers("/webjars/**");
    }
}

感谢阅读!

thigvfpy

thigvfpy1#

我有一个类似的问题,前几周,这是我如何让我的工作,我需要添加一堆比我想象的更多的匹配器,并在csrf禁用添加,但似乎工作正常。

@Bean(name="configure")
@Conditional(DevConditional.class)
public SecurityWebFilterChain configureDev(ServerHttpSecurity http) throws Exception {
    return http
            .csrf().disable()
            .authorizeExchange()
            .pathMatchers("/v2/api-docs").permitAll()
            .pathMatchers("/configuration/ui").permitAll()
            .pathMatchers("/swagger-resources/**").permitAll()
            .pathMatchers("/configuration/security").permitAll()
            .pathMatchers("/swagger-ui.html").permitAll()
            .pathMatchers("/swagger-ui/*").permitAll()
            .pathMatchers("/webjars/**").permitAll()
            .pathMatchers("/v2/**").permitAll()
            .and().cors()
            .and().oauth2ResourceServer()
            .jwt().and().and().build();
}

我得到了这个“.csrf().disable()”的答案:带有webflux的spring boot在测试中总是抛出403状态

相关问题