Spring Security条件基础认证

Question

I have a endpoint that I want to allow access to without needing basic auth. It is the endpoint below as follows:

  @ApiOperation(value = "Get a image by id", response = ResponseEntity.class)
@RequestMapping(value = "/{id}", method = RequestMethod.GET)   //sets the mapping url and the HTTP method
public void getById(@PathVariable("id") Long id, HttpServletResponse response) throws NotFoundException {
    ImageView view;
    try {
        view = manager.get(id);
        ByteArrayInputStream in = new ByteArrayInputStream(view.getImageData());
        response.setContentType(MediaType.parseMediaType(view.getImageMimeType()).toString());
        IOUtils.copy(in, response.getOutputStream());
    } catch (NotFoundException e) {
        response.setStatus(204); //HttpStatus.NO_CONTENT);
        return;
    } catch (IOException ioe) {
        response.setStatus(400);//HttpState.BAD_REQUEST
        return;
    }
}

I have read several other stack overflow post on people having similar issues and saw that overriding the security config works. Below is a solution that I have devised from reading several post. However, I am still having an issue and receive a 401 upon requesting the resource without auth. Side not, the full route would be "{host}/service/v1/images/{id}"

 @Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable()   //disable csrf being needed for header in a request
            .authorizeRequests()    //authorize the following request based on following set rules
            .antMatchers(HttpMethod.OPTIONS, "**").permitAll() //allow any user to access this when OPTIONS
            .antMatchers(HttpMethod.GET,"**/service/v1/images/**").permitAll() //allows GETS for given route permitted to all users
            .anyRequest().authenticated() //catch all: this implies that if nothing matches the above two patterns, then require authentication
            .and().httpBasic(); //utilize http basic for authentication

}

Any insight into what I may be doing wrong and how to correct this would be appreciated.

Answer 1

In order to ignore security for a specific URLs do this:

In addition to your

@Override
protected void configure(HttpSecurity http) throws Exception { ... }

you'll need to override also the next method:

@Override
public void configure(WebSecurity web) throws Exception { ... }

On that method you can write something like this in order to ignore security for a specific URLs:

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/css/**", "/js/**", 
            "/app/controllers/**", "/app/partials/**", "/app/*",
            "/", "/index.html", "/favicon.ico");
}

the example above will disable security for the ant matchers specified.

you can drop the permitAll()