spring-security 如何 在 React 式 springboot 中 的 Eureka Discovery 服务 中 添加 CorsConfiguration ?

oxosxuxt  于 2022-11-11  发布在  Spring
关注(0)|答案(2)|浏览(102)

我在Springboot中部署了一个Eureka服务器。我已经使用这个maven依赖项和yaml属性为用户名/密码启用了Spring安全性:

<dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-security</artifactId> <!-- Provide basic auth for Eureka client registration -->
</dependency>

下面的代码块显示了我的springboot版本和webflux的用法:

<parent>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-parent</artifactId>
 <version>2.7.3</version>
 <relativePath/> <!-- lookup parent from repository -->
</parent>

<groupId>me.sonam</groupId>
<artifactId>discovery-service</artifactId>
<version>1.0-SNAPSHOT</version>
<name>eureka-service</name>
<description>Eureka Discovery Service</description>
<properties>
 <java.version>16</java.version>
 <spring-cloud.version>2021.0.4</spring-cloud.version>
</properties>

<dependencies>
 <dependency>
  <groupId>org.springframework.cloud</groupId>
  <artifactId>spring-cloud-starter-netflix-eureka-server</artifactId>
 </dependency>

  <dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-webflux</artifactId>
  </dependency>

这是我如何设置我的基本/验证安全与用户名/密码:

spring:
  security:
    user:
      name: ${EUREKA_USER}
      password: ${EUREKA_PASSWORD}

我已将CorsConfiguration设置如下:

import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.reactive.CorsConfigurationSource;
import org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource;

@EnableEurekaServer
@SpringBootApplication
public class EurekaServiceApplication {
    private static final Logger LOG = LoggerFactory.getLogger(EurekaServiceApplication.class);

    public static void main(String[] args) {
        SpringApplication.run(EurekaServiceApplication.class, args);
    }

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration corsConfig = new CorsConfiguration();
        corsConfig.setAllowedOrigins(List.of("*"));
        corsConfig.setMaxAge(3600L);
        corsConfig.addAllowedMethod("*");
        corsConfig.addAllowedHeader("*");

        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", corsConfig);
        return source;
    }
}

当我使用mvn clean install构建项目时,出现以下错误:

Bean named 'corsConfigurationSource' is expected to be of type 'org.springframework.web.cors.CorsConfigurationSource' but was actually of type 'org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource'
puruo6ea

puruo6ea1#

替换您的

import  org.springframework.web.cors.CorsConfigurationSource

import  org.springframework.web.cors.reactive.CorsConfigurationSource

Spring框架有两个名为CorsConfigurationSource的类,一个在React性包中,一个在外部包中。UrlBasedCorsConfigurationSource也是如此。但是您从外部(非React性)包中导入了CorsConfigurationSource,从React性包中导入了UrlBasedCorsConfigurationSource。因此,您遇到了这个问题。

djmepvbi

djmepvbi2#

在spring-cloud-netflix-eureka-server-3.1.4.jar(这是我正在使用的版本)中似乎没有针对Eureka 服务器的响应包。
所以即使我添加下面的代码:

import org.springframework.web.cors.reactive.CorsConfigurationSource;
import org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource;

import java.util.List;

@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class SecurityConfiguration {
    private static final Logger LOG = LoggerFactory.getLogger(SecurityConfiguration.class);

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
        // @formatter:off
        LOG.info("configure securityWebFilterChain");

        return http.csrf().disable().cors().disable().build();
    }

上面的没有被选中。但是,下面的SecurityConfig被选中,它没有使用禁用csrf和cors的React包,我想检查一下它们是否导致了我的注册问题::

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests().anyRequest().authenticated().and().httpBasic();
    }

}

所以现在我可以在Eureka 服务器上使用spring-security和basic-auth,我的客户可以做basic-auth并将他们的示例注册到Eureka服务器上。

相关问题