java - Spring Security：WebSecurityConfig 类`antMatchers(...).permitAll()` 不起作用

@EnableWebSecurity @ComponentScan(value = {"com.mywebsite.framework.security", "com.mywebsite.utility"}) public class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.addFilterBefore(crossPlatformFilter, SessionManagementFilter.class) .csrf().disable() .authorizeRequests() // WORKS AS EXPECTED .antMatchers(HttpMethod.POST, "/mywebsite/v1/something_1").permitAll() // WORKS AS EXPECTED .antMatchers(HttpMethod.POST, "/mywebsite/v1/something_2").permitAll() // WORKS AS EXPECTED .antMatchers(HttpMethod.POST, "/mywebsite/v1/something_3").permitAll() // NOT WORKING, RETURNS 401 Http Code .antMatchers(HttpMethod.GET, "/mywebsite/v1/something_4").permitAll() //TODO: Not Working, returning 401 .anyRequest().authenticated() .and() .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS); http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class).authorizeRequests(); } }

.s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 1 of 15 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 2 of 15 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' w.c.HttpSessionSecurityContextRepository.readSecurityContextFromSession 167 -- No HttpSession currently exists w.c.HttpSessionSecurityContextRepository.loadContext 117 -- No SecurityContext was available from the HttpSession: null. A new one will be created. .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 3 of 15 in additional filter chain; firing Filter: 'HeaderWriterFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 4 of 15 in additional filter chain; firing Filter: 'CsrfFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 5 of 15 in additional filter chain; firing Filter: 'LogoutFilter' o.s.s.w.u.m.AntPathRequestMatcher.matches 157 -- Request 'GET /mywebsite/v1/something_4' doesn't match 'POST /logout' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 6 of 15 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter' o.s.s.w.u.m.AntPathRequestMatcher.matches 157 -- Request 'GET /mywebsite/v1/something_4' doesn't match 'POST /login' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 7 of 15 in additional filter chain; firing Filter: 'DefaultLoginPageGeneratingFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 8 of 15 in additional filter chain; firing Filter: 'DefaultLogoutPageGeneratingFilter' o.s.s.w.u.m.AntPathRequestMatcher.matches 177 -- Checking match of request : '/mywebsite/v1/something_4'; against '/logout' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 9 of 15 in additional filter chain; firing Filter: 'BasicAuthenticationFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 10 of 15 in additional filter chain; firing Filter: 'RequestCacheAwareFilter' o.s.s.w.s.HttpSessionRequestCache.getMatchingRequest 95 -- saved request doesn't match .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 11 of 15 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 12 of 15 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter' o.s.s.w.a.AnonymousAuthenticationFilter.doFilter 100 -- Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@bddba886: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 13 of 15 in additional filter chain; firing Filter: 'SessionManagementFilter' o.s.s.w.s.SessionManagementFilter.doFilter 124 -- Requested session ID 17C1F2C0B0E165F7DCF87E14CDB0F6DA is invalid. .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 14 of 15 in additional filter chain; firing Filter: 'ExceptionTranslationFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /mywebsite/v1/something_4 at position 15 of 15 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' o.s.s.a.i.AbstractSecurityInterceptor.beforeInvocation 219 -- Secure object: FilterInvocation: URL: /mywebsite/v1/something_4; Attributes: [authenticated] o.s.s.a.i.AbstractSecurityInterceptor.authenticateIfRequired 348 -- Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@bddba886: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS o.s.s.a.v.AffirmativeBased .decide 66 -- Voter: org.springframework.security.web.access.expression.WebExpressionVoter@56253eba, returned: -1 o.s.s.w.a.ExceptionTranslationFilter.handleSpringSecurityException 180 -- Access is denied (user is anonymous); redirecting to authentication entry point org.springframework.security.access.AccessDeniedException: Access is denied at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-5.3.8.RELEASE.jar:5.3.8.RELEASE] ........... o.s.s.w.u.m.AndRequestMatcher .matches 66 -- Trying to match using Ant [pattern='/**', GET] o.s.s.w.u.m.AntPathRequestMatcher.matches 167 -- Request '/mywebsite/v1/something_4' matched by universal pattern '/**' o.s.s.w.u.m.AndRequestMatcher .matches 66 -- Trying to match using NegatedRequestMatcher [requestMatcher=Ant [pattern='/**/favicon.*']] o.s.s.w.u.m.AntPathRequestMatcher.matches 177 -- Checking match of request : '/mywebsite/v1/something_4'; against '/**/favicon.*' o.s.s.w.u.m.NegatedRequestMatcher.matches 51 -- matches = true o.s.s.w.u.m.AndRequestMatcher .matches 66 -- Trying to match using NegatedRequestMatcher [requestMatcher=MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@5bb661e0, matchingMediaTypes=[application/json], useEquals=false, ignoredMediaTypes=[*/*]]] o.s.s.w.u.m.MediaTypeRequestMatcher.matches 203 -- httpRequestMediaTypes=[*/*] o.s.s.w.u.m.MediaTypeRequestMatcher.matches 207 -- Processing */* o.s.s.w.u.m.MediaTypeRequestMatcher.matches 210 -- Ignoring o.s.s.w.u.m.MediaTypeRequestMatcher.matches 231 -- Did not match any media types o.s.s.w.u.m.NegatedRequestMatcher.matches 51 -- matches = true o.s.s.w.u.m.AndRequestMatcher .matches 66 -- Trying to match using NegatedRequestMatcher [requestMatcher=RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest]] o.s.s.w.u.m.NegatedRequestMatcher.matches 51 -- matches = true o.s.s.w.u.m.AndRequestMatcher .matches 66 -- Trying to match using NegatedRequestMatcher [requestMatcher=MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@5bb661e0, matchingMediaTypes=[multipart/form-data], useEquals=false, ignoredMediaTypes=[*/*]]] o.s.s.w.u.m.MediaTypeRequestMatcher.matches 203 -- httpRequestMediaTypes=[*/*] o.s.s.w.u.m.MediaTypeRequestMatcher.matches 207 -- Processing */* o.s.s.w.u.m.MediaTypeRequestMatcher.matches 210 -- Ignoring o.s.s.w.u.m.MediaTypeRequestMatcher.matches 231 -- Did not match any media types o.s.s.w.u.m.NegatedRequestMatcher.matches 51 -- matches = true o.s.s.w.u.m.AndRequestMatcher .matches 66 -- Trying to match using NegatedRequestMatcher [requestMatcher=MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@5bb661e0, matchingMediaTypes=[text/event-stream], useEquals=false, ignoredMediaTypes=[*/*]]] o.s.s.w.u.m.MediaTypeRequestMatcher.matches 203 -- httpRequestMediaTypes=[*/*] o.s.s.w.u.m.MediaTypeRequestMatcher.matches 207 -- Processing */* o.s.s.w.u.m.MediaTypeRequestMatcher.matches 210 -- Ignoring o.s.s.w.u.m.MediaTypeRequestMatcher.matches 231 -- Did not match any media types o.s.s.w.u.m.NegatedRequestMatcher.matches 51 -- matches = true o.s.s.w.u.m.AndRequestMatcher .matches 73 -- All requestMatchers returned true o.s.s.w.s.HttpSessionRequestCache.saveRequest 61 -- DefaultSavedRequest added to Session: DefaultSavedRequest[http://localhost:8080/mywebsite/v1/something_4] o.s.s.w.a.ExceptionTranslationFilter.sendStartAuthentication 211 -- Calling Authentication entry point. s.w.a.DelegatingAuthenticationEntryPoint.commence 78 -- Trying to match using AndRequestMatcher [requestMatchers=[NegatedRequestMatcher [requestMatcher=RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest]], MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@5bb661e0, matchingMediaTypes=[application/xhtml+xml, image/*, text/html, text/plain], useEquals=false, ignoredMediaTypes=[*/*]]]] o.s.s.w.u.m.AndRequestMatcher .matches 66 -- Trying to match using NegatedRequestMatcher [requestMatcher=RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest]] o.s.s.w.u.m.NegatedRequestMatcher.matches 51 -- matches = true o.s.s.w.u.m.AndRequestMatcher .matches 66 -- Trying to match using MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@5bb661e0, matchingMediaTypes=[application/xhtml+xml, image/*, text/html, text/plain], useEquals=false, ignoredMediaTypes=[*/*]] o.s.s.w.u.m.MediaTypeRequestMatcher.matches 203 -- httpRequestMediaTypes=[*/*] o.s.s.w.u.m.MediaTypeRequestMatcher.matches 207 -- Processing */* o.s.s.w.u.m.MediaTypeRequestMatcher.matches 210 -- Ignoring o.s.s.w.u.m.MediaTypeRequestMatcher.matches 231 -- Did not match any media types o.s.s.w.u.m.AndRequestMatcher .matches 69 -- Did not match s.w.a.DelegatingAuthenticationEntryPoint.commence 78 -- Trying to match using OrRequestMatcher [requestMatchers=[RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest], AndRequestMatcher [requestMatchers=[NegatedRequestMatcher [requestMatcher=MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@5bb661e0, matchingMediaTypes=[text/html], useEquals=false, ignoredMediaTypes=[]]], MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@5bb661e0, matchingMediaTypes=[application/atom+xml, application/x-www-form-urlencoded, application/json, application/octet-stream, application/xml, multipart/form-data, text/xml], useEquals=false, ignoredMediaTypes=[*/*]]]], MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@5bb661e0, matchingMediaTypes=[*/*], useEquals=true, ignoredMediaTypes=[]]]] o.s.s.w.u.m.OrRequestMatcher .matches 65 -- Trying to match using RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest] o.s.s.w.u.m.OrRequestMatcher .matches 65 -- Trying to match using AndRequestMatcher [requestMatchers=[NegatedRequestMatcher [requestMatcher=MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@5bb661e0, matchingMediaTypes=[text/html], useEquals=false, ignoredMediaTypes=[]]], MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@5bb661e0, matchingMediaTypes=[application/atom+xml, application/x-www-form-urlencoded, application/json, application/octet-stream, application/xml, multipart/form-data, text/xml], useEquals=false, ignoredMediaTypes=[*/*]]]] o.s.s.w.u.m.AndRequestMatcher .matches 66 -- Trying to match using NegatedRequestMatcher [requestMatcher=MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@5bb661e0, matchingMediaTypes=[text/html], useEquals=false, ignoredMediaTypes=[]]] o.s.s.w.u.m.MediaTypeRequestMatcher.matches 203 -- httpRequestMediaTypes=[*/*] o.s.s.w.u.m.MediaTypeRequestMatcher.matches 207 -- Processing */* o.s.s.w.u.m.MediaTypeRequestMatcher.matches 223 -- text/html .isCompatibleWith */* = true o.s.s.w.u.m.NegatedRequestMatcher.matches 51 -- matches = false o.s.s.w.u.m.AndRequestMatcher .matches 69 -- Did not match o.s.s.w.u.m.OrRequestMatcher .matches 65 -- Trying to match using MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@5bb661e0, matchingMediaTypes=[*/*], useEquals=true, ignoredMediaTypes=[]] o.s.s.w.u.m.MediaTypeRequestMatcher.matches 203 -- httpRequestMediaTypes=[*/*] o.s.s.w.u.m.MediaTypeRequestMatcher.matches 207 -- Processing */* o.s.s.w.u.m.MediaTypeRequestMatcher.matches 216 -- isEqualTo true o.s.s.w.u.m.OrRequestMatcher .matches 68 -- matched s.w.a.DelegatingAuthenticationEntryPoint.commence 83 -- Match found! Executing org.springframework.security.web.authentication.DelegatingAuthenticationEntryPoint@3d3e9163 s.w.a.DelegatingAuthenticationEntryPoint.commence 78 -- Trying to match using RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest] s.w.a.DelegatingAuthenticationEntryPoint.commence 91 -- No match found. Using default entry point org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint@4da27f00 o.s.s.w.h.w.HstsHeaderWriter .writeHeaders 169 -- Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@2784c3cd tRepository$SaveToSessionResponseWrapper.saveContext 346 -- SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. tRepository$SaveToSessionResponseWrapper.saveContext 346 -- SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. s.s.w.c.SecurityContextPersistenceFilter.doFilter 119 -- SecurityContextHolder now cleared, as request processing completed .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 1 of 15 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 2 of 15 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' w.c.HttpSessionSecurityContextRepository.readSecurityContextFromSession 179 -- HttpSession returned null object for SPRING_SECURITY_CONTEXT w.c.HttpSessionSecurityContextRepository.loadContext 117 -- No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@591f2d03. A new one will be created. .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 3 of 15 in additional filter chain; firing Filter: 'HeaderWriterFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 4 of 15 in additional filter chain; firing Filter: 'CsrfFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 5 of 15 in additional filter chain; firing Filter: 'LogoutFilter' o.s.s.w.u.m.AntPathRequestMatcher.matches 157 -- Request 'GET /error' doesn't match 'POST /logout' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 6 of 15 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter' o.s.s.w.u.m.AntPathRequestMatcher.matches 157 -- Request 'GET /error' doesn't match 'POST /login' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 7 of 15 in additional filter chain; firing Filter: 'DefaultLoginPageGeneratingFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 8 of 15 in additional filter chain; firing Filter: 'DefaultLogoutPageGeneratingFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 9 of 15 in additional filter chain; firing Filter: 'BasicAuthenticationFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 10 of 15 in additional filter chain; firing Filter: 'RequestCacheAwareFilter' o.s.s.w.s.DefaultSavedRequest .propertyEquals 359 -- pathInfo: both null (property equals) o.s.s.w.s.DefaultSavedRequest .propertyEquals 359 -- queryString: both null (property equals) o.s.s.w.s.DefaultSavedRequest .propertyEquals 383 -- requestURI: arg1=/mywebsite/v1/something_4; arg2=/error (property not equals) o.s.s.w.s.HttpSessionRequestCache.getMatchingRequest 95 -- saved request doesn't match .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 11 of 15 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 12 of 15 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter' o.s.s.w.a.AnonymousAuthenticationFilter.doFilter 100 -- Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@bddba886: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: EC7B42A8FB862A6AEBDC3CD49485BEE9; Granted Authorities: ROLE_ANONYMOUS' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 13 of 15 in additional filter chain; firing Filter: 'SessionManagementFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 14 of 15 in additional filter chain; firing Filter: 'ExceptionTranslationFilter' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 328 -- /error at position 15 of 15 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' .s.w.FilterChainProxy$VirtualFilterChain.doFilter 313 -- /error reached end of additional filter chain; proceeding with original chain tRepository$SaveToSessionResponseWrapper.saveContext 346 -- SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. o.s.s.w.a.ExceptionTranslationFilter.doFilter 120 -- Chain processed normally tRepository$SaveToSessionResponseWrapper.saveContext 346 -- SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. s.s.w.c.SecurityContextPersistenceFilter.doFilter 119 -- SecurityContextHolder now cleared, as request processing completed