Spring Oauth2 Angularjs登录不是Woking

Question

Currently I'm developing Spring OAuth2 security project with Angularjs. I'm taking a token with oauth server and I'm parsing to headers but when I try to redirect to home page I'm thrown by "Full authentication is required to access this resource" but I loged in and client server gives an anonymousUser and access denied.

@Configuration
@EnableWebSecurity
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
public void configure(WebSecurity web) throws Exception {

    web
            .ignoring()
            .antMatchers("/login.html")
            .antMatchers("/js/**")
            .antMatchers("/css/**")
            .antMatchers("/metronic/css/**")
            .antMatchers("/metronic/js/**")
            .antMatchers("/metronic/image/**")
            .antMatchers("/image/**")
            .antMatchers("/language/**")
            .antMatchers("/404.html")
            .antMatchers("/logout")
            .antMatchers("/kilitEkrani.html")
            .antMatchers("/metronic/css/fonts/**")
            .antMatchers("/metronic/fonts/**");

}

@Override
public void configure(HttpSecurity http) throws Exception {

    http.authorizeRequests().antMatchers("/css/**", "/metronic/css/**").permitAll()
            .and().authorizeRequests().antMatchers("/metronic/image/**", "/image/**", "/metronic/css/fonts/**", "/metronic/fonts/**").permitAll()
            .and().authorizeRequests().antMatchers("/js/**", "/metronic/js/**").permitAll()
            .and().httpBasic().and().authorizeRequests()
            .antMatchers("/login.html", "/language/**", "/api/kullanici/user", "/logout", "/kilitEkrani.html", "/404.html").permitAll()
            .anyRequest().authenticated().and()
            .addFilterAfter(csrfHeaderFilter(), CsrfFilter.class).csrf().csrfTokenRepository(csrfTokenRepository()).and()
            .logout()
            .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
            .logoutSuccessUrl("/login.html")
            .permitAll().and().csrf().disable();
}

private Filter csrfHeaderFilter() {
    return new OncePerRequestFilter() {
        @Override
        protected void doFilterInternal(HttpServletRequest request,
                HttpServletResponse response, FilterChain filterChain)
                throws ServletException, IOException {
            CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class
                    .getName());
            if (csrf != null) {
                Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN");
                String token = csrf.getToken();
                if (cookie == null || token != null
                        && !token.equals(cookie.getValue())) {
                    cookie = new Cookie("XSRF-TOKEN", token);
                    cookie.setPath("/");
                    response.addCookie(cookie);
                }
            }
            filterChain.doFilter(request, response);
        }
    };
}

private CsrfTokenRepository csrfTokenRepository() {
    HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
    repository.setHeaderName("X-XSRF-TOKEN");
    return repository;
}
}

This is my security config. Am I missing something? Help please...

Answer 1

I think the problem is that you make use of basic authentication in the auth server. You can try to disable the basic authentication and use form authentication instead.