spring-security 找不到预期的CSRF标记

vfh0ocws  于 2022-11-11  发布在  Spring
关注(0)|答案(1)|浏览(633)

我正在尝试使用此配置禁用最新Spring Cloud中的Spring安全性:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
@Order(SecurityProperties.DEFAULT_FILTER_ORDER)
public class WebSecurityConfigSec extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().cors().disable()
                .authorizeRequests().anyRequest().permitAll();
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring()
                .antMatchers("/**");
    }
}

application.yml

spring:
    main:
        allow-bean-definition-overriding: true
security:
    ignored=/**:
    enable-csrf: false

我还试图补充一句:

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends
   WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
      .csrf().disable();
  }
}

但它不起作用。
我收到错误:An expected CSRF token cannot be found

18:16:24.537 [boundedElastic-2] DEBUG DefaultWebSessionManager[lambda$createWebSession$3:94] - Created new WebSession.
18:16:24.540 [boundedElastic-2] DEBUG HttpWebHandlerAdapter[traceDebug:91] - [1ffd0a30] Completed 403 FORBIDDEN

你知道我该怎么解决这个问题吗?

bn31dyow

bn31dyow1#

从pom.xml中排除MVC依赖项
并补充一句:

spring:
 main:
  web-application-type: reactive

这对我很有效;我得到了CSRF错误,因为在Spring MVC中使用的Spring安全性被启用。

相关问题