java Spring Security Configuration使用点(.)匹配URL

b09cbbtk  于 2023-11-15  发布在  Java
关注(0)|答案(3)|浏览(168)

我试图阻止其他网址的期望网址

http://localhost:8081/odata/v4/com.sap.di.remoteHandler.RemoteHandlerServices/Handle

字符串
但是,由于URL有点(.),我面临着下面的错误:

org.springframework.web.util.pattern.PatternParseException: No more pattern data allowed after {*...} or ** pattern element
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    try {

        http
            .authorizeHttpRequests( url ->  url
                .requestMatchers("/**/Handle").authenticated()
                .anyRequest().denyAll())
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            )
            .oauth2ResourceServer(oauth -> oauth
                .jwt(jwt -> jwt
                    .jwtAuthenticationConverter(getJwtAuthenticationConverter())
                )
            )
            .headers(httpSecurityHeadersConfigurer -> httpSecurityHeadersConfigurer
                .contentSecurityPolicy(contentSecurityPolicyConfig -> contentSecurityPolicyConfig
                    .policyDirectives(CONTENT_SECURITY_POLICY)
                )
            );
            return http.build();

    } catch (Exception e) {
        throw new RuntimeException("Authentication is failed");
    }
}

什么是正确的模式,以便我可以匹配的URL?

pkmbmrz7

pkmbmrz71#

问题不在于您的URL在其路径名中具有点(.),而是在Spring SecurityFilterChain中,在匹配URL时,**被视为一个字符串,描述“后面的任何内容”。

http
     .authorizeHttpRequests( url ->  url
     .requestMatchers("odata/v4/**").authenticated()
     .anyRequest().denyAll())

字符串
这意味着任何以odata/v4/开头的URL以及其后的任何内容都将被该匹配器匹配,并将按照上述方式进行处理。因此,如果您要手动指定**之后没有任何确切含义的任何内容。这正是您看到此错误的原因。

org.springframework.web.util.pattern.PatternParseException: No more pattern data allowed after {*...} or ** pattern element


如果你不想得到这个错误,删除代码后面的/Handle,使它看起来像这样。

public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    try{

        http
                .authorizeHttpRequests( url ->  url
                        .requestMatchers("/**").authenticated()
                        .anyRequest().denyAll())
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .oauth2ResourceServer(
                        oauth -> oauth.jwt(jwt -> jwt.jwtAuthenticationConverter(getJwtAuthenticationConverter()))
                ).headers(httpSecurityHeadersConfigurer -> httpSecurityHeadersConfigurer
                        .contentSecurityPolicy(contentSecurityPolicyConfig -> contentSecurityPolicyConfig
                                .policyDirectives(CONTENT_SECURITY_POLICY)))
        ;
        return http.build();

} catch(Exception e){
        throw new RuntimeException("Authentication is failed");
    }
}


这将工作,但这将使每个请求被发送到您的服务器匹配的匹配器,这反过来又希望请求进行身份验证,因为您匹配的是基本URL的每个请求及其后面的任何内容。如果这是您想要的,那么您就有了答案,否则您可以将您想要匹配的模式添加到requestMatcher,有特定的请求要验证。
如果只允许http://localhost:8081/odata/v4/com.sap.di.remoteHandler.RemoteHandlerServices/Handle,则需要

.requestMatchers("odata/v4/com.sap.di.remoteHandler.RemoteHandlerServices/Handle").authenticated().anyRequest().denyAll())


希望你得到答案了。

gz5pxeao

gz5pxeao2#

我们可以创建一个AntPathRequestMatcher来完成这项工作:

public SecurityFilterChain filterChain(HttpSecurity http) {
    try {
        http
            .authorizeHttpRequests(url ->  url
                 .requestMatchers(AntPathRequestMatcher.antMatcher("/**/*RemoteHandlerServices/Handle")).authenticated()
                 .anyRequest().denyAll()
             )
             .sessionManagement(session -> session
                 .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
             )
             .oauth2ResourceServer(oauth -> oauth
                 .jwt(jwt -> jwt
                     .jwtAuthenticationConverter(getJwtAuthenticationConverter())
                 )
             )
             .headers(httpSecurityHeadersConfigurer -> httpSecurityHeadersConfigurer
                 .contentSecurityPolicy(contentSecurityPolicyConfig -> contentSecurityPolicyConfig
                     .policyDirectives(CONTENT_SECURITY_POLICY)
                )
             );

            return http.build();

    } catch(Exception e){
        throw new RuntimeException("Authentication is failed");
    }
}

字符串

8zzbczxx

8zzbczxx3#

而不是.requestMatchers(“/**/Handle”)。
试试下面,
第一个月
如果不起作用就告诉我

相关问题