Spring Security 基于角色的 HTTP 请求授权

Question

我在从库存中删除项目以及在数据库中创建新资源时收到 403 禁止，下面是我的配置和我编写的控制器。

Web 安全配置类：

package com.inventoryservice.config;

import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpMethod;
import org.springframework.security.authorization.AuthorityAuthorizationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("test")
                .password("test_pass")
                .roles("ADMIN")
                .and()
                .withUser("store")
                .password("store_pass")
                .roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests()
                    .antMatchers(HttpMethod.DELETE, "/items-management").hasRole("ADMIN")
                    .antMatchers(HttpMethod.POST, "/items-management").hasAnyRole("ADMIN","USER")
                    .antMatchers(HttpMethod.GET, "/items-management").permitAll()
                .anyRequest().authenticated();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return NoOpPasswordEncoder.getInstance();
    }
}

库存控制器：

它的所有端点都配置有从服务中获取的数据库记录

package com.inventoryservice.controller;

import com.inventoryservice.dto.request.InventoryRequestDto;
import com.inventoryservice.dto.response.InventoryItemDto;
import com.inventoryservice.dto.response.InventoryResponseDto;
import com.inventoryservice.entity.Inventory;
import com.inventoryservice.service.ItemService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/items-management")
public class InventoryController {

    private ItemService itemService;

    @Autowired
    public InventoryController(ItemService itemService) {
        this.itemService = itemService;
    }

    @GetMapping
    public ResponseEntity<InventoryResponseDto> getItems() {
        return new ResponseEntity(
                InventoryResponseDto.builder()
                        .lines(itemService.getItems())
                        .build()
                , HttpStatus.OK
        );
    }

    @PostMapping
    public ResponseEntity<InventoryResponseDto> create(@RequestBody InventoryRequestDto inventory) {
        return new ResponseEntity(
                InventoryResponseDto
                        .builder()
                        .lines(itemService.create(inventory.getLines()))
                        .build()
                , HttpStatus.CREATED
        );
    }

    @DeleteMapping
    public ResponseEntity delete(@RequestBody InventoryItemDto inventoryItemDto) {
        itemService.deleteItems(
                inventoryItemDto.getItemIds()
        );
        return ResponseEntity.ok(inventoryItemDto);
    }
}

Answer 1

我遇到过这个问题，因为在 Spring Security 中，针对跨站点请求伪造 (CSRF) 攻击的保护是默认启用的，该攻击旨在诱骗用户在经过身份验证的应用程序中执行某些操作。

CSRF 保护旨在防止不良的变异行为，因此您的 POST 请求失败。 有关 CSRF 的更多信息，当禁用 CSRF 保护是合理的时， 请参阅文档。

现在，只是为了测试您的端点，您可以像这样禁用 CSRF：

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests()
        .antMatchers(HttpMethod.DELETE, "/items-management").hasRole("ADMIN")
        .antMatchers(HttpMethod.POST, "/items-management").hasAnyRole("ADMIN","USER")
        .antMatchers(HttpMethod.GET, "/items-management").permitAll()
        .anyRequest().authenticated()
        .csrf().disable();   // <- add this line
}