邮政许可证全部不考虑

Question

我使用Spring安全，我试图允许一个帖子不需要连接。

所以在一个类谁扩展 WebSecurityConfigurerAdapter

@Override
public void configure(HttpSecurity httpSecurity) throws Exception {
    httpSecurity.authorizeRequests()
            .antMatchers(
                    "/",
                    "/help**",
                    "/css/**",
                    "/js/**",
                    "/img/**").permitAll()
            .antMatchers(HttpMethod.POST, "/printdownload**").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin().loginPage("/login").permitAll()
            .successHandler(customAuthenticationSuccessHandler)
            .and()
            .logout();
}

当我试着呼叫这个控制器时

@PostMapping("/printdownload")
public String printTestament(@RequestBody TestamentWizard testamentDocuement){

....}

我明白了

 o.s.security.web.FilterChainProxy        : Securing POST /printdownload
 s.s.w.c.SecurityContextPersistenceFilter : Set SecurityContextHolder to empty SecurityContext
 o.s.security.web.csrf.CsrfFilter         : Invalid CSRF token found for http://localhost:8080/printdownload
 o.s.s.w.access.AccessDeniedHandlerImpl   : Responding with 403 status code
 w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext
 w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext
 s.s.w.c.SecurityContextPersistenceFilter : Cleared SecurityContextHolder to complete request
 o.s.security.web.FilterChainProxy        : Securing POST /error
 s.s.w.c.SecurityContextPersistenceFilter : Set SecurityContextHolder to empty SecurityContext
 o.s.s.w.a.AnonymousAuthenticationFilter  : Set SecurityContextHolder to anonymous SecurityContext
 o.s.s.w.a.i.FilterSecurityInterceptor    : Failed to authorize filter invocation [POST /error] with attributes [authenticated]
 o.s.s.web.DefaultRedirectStrategy        : Redirecting to http://localhost:8080/login
 w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext
 w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext
 s.s.w.c.SecurityContextPersistenceFilter : Cleared SecurityContextHolder to complete request
 o.s.security.web.FilterChainProxy        : Securing GET /login
 s.s.w.c.SecurityContextPersistenceFilter : Set SecurityContextHolder to empty SecurityContext
 o.s.s.w.a.AnonymousAuthenticationFilter  : Set SecurityContextHolder to anonymous SecurityContext
 o.s.s.w.a.i.FilterSecurityInterceptor    : Authorized filter invocation [GET /login] with attributes [permitAll]
 o.s.security.web.FilterChainProxy        : Secured GET /login
 w.c.HttpSessionSecurityContextRepository : Did not store anonymous SecurityContext
 w.c.HttpSessionSecurityContextRepository : Did not store anonymous SecurityContext
 s.s.w.c.SecurityContextPersistenceFilter : Cleared SecurityContextHolder to complete request

只是不明白为什么当我指定允许的时候，帖子是安全的

Answer 1

Spring 安全性通过深度防御来保护请求。因此，像permitAll（）和authenticated（）这样的访问规则并不是保护Web应用程序的唯一内容。

在您的情况下，CSRF 保护会拒绝请求，因为默认情况下会启用该请求以及其他针对漏洞的保护。您可以在参考文档中阅读有关 CSRF 保护以及为什么 POST 请求需要 CSRF 令牌的信息。