Spring 啟動 HttpSecurity 始終 403 禁止

Question

我總是得到 http 狀態 403。我有這個安全配置：

@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
    httpSecurity
        .cors().and().csrf().disable()
        .authorizeRequests()
        .antMatchers("/api/users/login/").permitAll()
        .anyRequest().authenticated();
}


@Bean
CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(Arrays.asList("*"));
    configuration.setAllowedMethods(Arrays.asList("*"));
    configuration.setAllowedHeaders(Arrays.asList("*"));
    configuration.setAllowCredentials(true);
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

我無法發布到/api/users/login

2019-10-15 12:25:49.567[0;39m [32mDEBUG[0;39m [35m7423[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.web.servlet.DispatcherServlet [0;39m [2m:[0;39m "ERROR" dispatch for POST "/error", parameters={} [2m2019-10-15 12:25:49.576[0; 39m [32mDEBUG[0;39m [35m7423[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36ms.wsmmaRequestMappingHandlerMapping[0;39m [2m:[0 ;39m Mapped to public org.springframework.http.ResponseEntity> org.springframework.boot.autoconfigure.web.servlet.error.BasicErrorController.error(javax.servlet.http.HttpServletRequest) [2m2019-10-15 12:25:49.605 [0;39m [32mDEBUG[0;39m [35m7423[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.swsmmaHttpEntityMethodProcessor [0;39m [2m :[0;39m 使用 'application/json'，給定 [ / ] 並支持 [application/json, application/ +json, application/json, application/ +json] [2m2019-10-15 12:25:49.608[0 ;39m [32mDEB UG[0;39m [35m7423[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.swsmmaHttpEntityMethodProcessor [0;39m [2m:[0;39m寫作 [{timestamp=Tue Oct 15 12:25:49 CEST 2019, status=403, error=Forbidden, message=Access Denied, path=/ (truncated)...] [2m2019-10-15 12:25:49.661 [0;39m [32mDEBUG[0;39m [35m7423[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.web.servlet.DispatcherServlet [0;39m [2m:[0;39m 退出“錯誤”調度，狀態 403

Answer 1

嘗試.antMatchers(HttpMethod.POST,"/api/users/login").permitAll() ，還請注意您有.antMatchers("/api/users/login/")並且您正在向/api/users/login發出請求/api/users/login note extra/在您的 antMatchers 中。

您還可以使用configure(WebSecurity web)繞過 Spring 安全過濾器鏈，如此處所述