如何在Spring Security中允许静态文件夹和css文件作为antMtchers被删除

eit6fx6z  于 2024-01-05  发布在  Spring
关注(0)|答案(1)|浏览(153)
  1. package com.example.config;
  2. import org.springframework.beans.factory.annotation.Autowired;
  3. import org.springframework.context.annotation.Bean;
  4. import org.springframework.context.annotation.Configuration;
  5. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  6. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  7. //import org.springframework.security.config.annotation.web.builders.WebSecurity;
  8. import org.springframework.security.crypto.password.PasswordEncoder;
  9. import org.springframework.security.web.SecurityFilterChain;
  10. import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
  11. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  12. import org.springframework.security.config.annotation.web.configuration.*;
  13. import com.example.service.CustomUserDetailsService;
  14. @Configuration
  15. @EnableWebSecurity
  16. public class SecurityConfig {
  17. @Autowired
  18. CustomUserDetailsService customUserDetailsServcie;
  19. @Bean
  20. public static PasswordEncoder passwordEncoder() {
  21. return new BCryptPasswordEncoder();
  22. }
  23. @Bean
  24. public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
  25. http.csrf().disable().authorizeHttpRequests()
  26. .requestMatchers("/registration", "/password-request", "/reset-password", "../static/css",
  27. "../static/images")
  28. .permitAll().requestMatchers("home").permitAll().and().formLogin().loginPage("/login")
  29. .loginProcessingUrl("/login").defaultSuccessUrl("/home", true).permitAll().and().logout()
  30. .invalidateHttpSession(true).clearAuthentication(true)
  31. .logoutRequestMatcher(new AntPathRequestMatcher("/logout")).logoutSuccessUrl("/login?logout")
  32. .permitAll();
  33. return http.build();
  34. }
  35. public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
  36. auth.userDetailsService(customUserDetailsServcie).passwordEncoder(passwordEncoder());
  37. }
  38. }

字符串
我看过视频,也读过帖子,但到处都是用antMatchers解决问题的方法。stackoverflow里的大多数帖子都是旧的,现在由于antMatchers在最新的Spring不工作,所以没有任何合适的解决方案。

6qqygrtg

6qqygrtg1#

您需要添加

  1. http.requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()

字符串
配置Spring Security以允许对src/main/resources/static下的资源进行未经身份验证的访问。另外,
第一个月
从你的配置。

相关问题