您正在获取"401 Unauthorized"，因为您尚未验证"/api/auth/"端点。尝试修改后的版本，

@Configuration
@EnableWebSecurity(debug = true)
public class SecurityConfiguration {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests( auth -> auth
                        .requestMatchers("/api/auth/**").authenticated() // <-- Authenticate here
                        .requestMatchers("/actuator/shutdown").permitAll()
                        .requestMatchers("/api/antifraud/transaction").authenticated()
                        .anyRequest().authenticated()
                )
                .httpBasic(Customizer.withDefaults())
                .csrf(AbstractHttpConfigurer::disable)
                .headers(headers -> headers.frameOptions(Customizer.withDefaults()));

        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

字符串
如果仍然得到相同的错误，请尝试以下方法，

@Configuration
public class SecurityConfiguration {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeRequests(authorize -> authorize
                        .antMatchers("/api/auth/user").permitAll() // Allow access to /api/auth/user without authentication
                        .antMatchers("/actuator/shutdown").permitAll()
                        .antMatchers("/api/antifraud/transaction").authenticated()
                        .anyRequest().authenticated()
                )
                .httpBasic(Customizer.withDefaults())
                .csrf(AbstractHttpConfigurer::disable)
                .headers(headers -> headers.frameOptions(Customizer.withDefaults()));

        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

型

你能试试吗
在前面再加两个星号

.requestMatchers("/**/api/auth/**/").permitAll()

字符串

• EDIT* 使用antMatchers而不是禁用csrf（）的requestMatchers

http.csrf().disable()
                .authorizeHttpRequests( auth -> auth
                        .antMatchers("/api/auth/**").permitAll()
                        .antMatchers("/actuator/shutdown").permitAll()
                        .antMatchers("/api/antifraud/transaction").authenticated()
                        .anyRequest().authenticated()

                ) .httpBasic(Customizer.withDefaults())
                .csrf(AbstractHttpConfigurer::disable)
                .headers(headers -> headers.frameOptions(Customizer.withDefaults()));

型

我只是复制/粘贴你的代码，它工作得很好，也许问题是在你的要求，你试图做什么：x1c 0d1x的数据
还有一个细节，请使用@RequestParam String name...而不是@RequestBody String name ...，或者创建一个自定义对象，如User（name，username，password），并通过@RequestBody User user将它们传递给请求