403 Forbidden for OpenApiSwagger in Spring Boot Security

Question

我有 Spring 具有 Spring 安全性的启动应用程序。 配置配置类 localhost-Swagger 后返回 403 Forbidden。 我无法弄清楚可能是什么问题。

http://localhost:8080/swagger-ui.html#/ - 403 禁止

安全配置：

@Configuration
@EnableWebSecurity
public class SecurityConfiguration {

    @Bean
    public SessionRegistry sessionRegistry() {
        return new SessionRegistryImpl();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration)
            throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        http.authorizeRequests()
            .antMatchers("/api/user/login").permitAll()
            .anyRequest().authenticated();

        return http.build();
    }

    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return (web) -> web.ignoring()
                           .antMatchers("/api/user/auth")
                           .antMatchers("/v3/api-docs")
                           .antMatchers("/swagger-resources/**")
                           .antMatchers("/swagger-ui.html")
                           .antMatchers("/configuration/**")
                           .antMatchers("/webjars/**")
                           .antMatchers("/public");
    }
}

build.gradle：

dependencies {
    implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: '2.7.2'
    implementation group: 'org.springframework.boot', name: 'spring-boot-starter-jdbc', version: '2.7.2'
    implementation group: 'org.springframework.boot', name: 'spring-boot-starter-security', version: '2.7.2'

    implementation group: 'com.microsoft.sqlserver', name: 'mssql-jdbc', version: '9.4.1.jre16'

    implementation group: 'org.json', name: 'json', version: '20220320'

    implementation group: 'org.springdoc', name: 'springdoc-openapi-ui', version: '1.6.9'

    implementation group: 'javax.xml.bind', name: 'jaxb-api', version: '2.3.1'

    compileOnly 'org.projectlombok:lombok:1.18.24'

    annotationProcessor 'org.projectlombok:lombok:1.18.24'
}

PS 请不要建议从 WebSecurityConfigurerAdapter 继承 class，因为它在我的 Spring Security 版本中已弃用。

Answer 1

您可以在 web 安全配置中使用“/swagger-ui/**”而不是“/swagger-ui.html”。

 @Bean
public WebSecurityCustomizer webSecurityCustomizer() {
    return (web) -> web.ignoring()
                       .antMatchers("/api/auth/**")
                       .antMatchers("/v3/api-docs/**")
                       .antMatchers("configuration/**")
                       .antMatchers("/swagger*/**")
                       .antMatchers("/webjars/**")
                       .antMatchers("/swagger-ui/**");
}

你把springdoc.swagger-ui.path放在你的应用程序属性文件中了吗？