Spring Security为一个特定页面禁用HTTP Basic

Question

I'm trying to add web security in spring but I don't want the filter to apply to certain things. How is that done in java?

Overall, what I want to do is this:

/ and /login should not show a HTTP Basic authentication prompt to login, while everything else should go through the filter and pop up a login prompt window.

Through various example I found through spring I was able to come up with this as for a start but it obviously doesn't work:

@Configuration
@EnableWebMvcSecurity
public class AuthSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/css/**", "/js/**", "/img/**", "/lib/**");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().antMatcher("/").authorizeRequests().anyRequest().permitAll();
        http.csrf().disable().antMatcher("/**").authorizeRequests().anyRequest().hasRole("ADMIN").and().httpBasic();
    }

    @Autowired
    protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("admin").password("admin123").roles("ADMIN")
                .and()
                .withUser("user").password("user123").roles("USER");
    }

}

Answer 1

Rewrite your configure(HttpSecurity http) method like the following:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .httpBasic()
            .and()
            .authorizeRequests()
                .antMatchers("/", "/login").permitAll()
                .anyRequest().hasRole("ADMIN")
            .and()
            .csrf()
                .disable();
}

"/" and "/login" SHOULD NOT show a httpbasic authentication prompt to login, while everything else SHOULD go through the filter and pop up a login prompt window.

If you seriously planning to use HTTP Basic, I guess you wouldn't need a separate /login handler, since browser-based clients can use the default browser based pop up and other clients can send HTTP Basic requests through Authorization header.