获取后，Spring Security访问被拒绝403

Question

此url＜code＞http://localhost:8070/produits与Postman一起工作很好。它返回以下内容：

添加Spring Security性后，此url返回403访问被拒绝，即使用户名和密码正确。

安全配置.java

    import javax.sql.DataSource;


@Configuration

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter    {


    @Autowired
    private DataSource dataSource;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {


        /*auth.inMemoryAuthentication().withUser("admin").password("1234").roles("ADMIN","USER");
        auth.inMemoryAuthentication().withUser("user").password("1234").roles("USER");*/

        auth.jdbcAuthentication().dataSource(dataSource)
        .usersByUsernameQuery("select username as principal,password as credentials,active from users where username =?").
        authoritiesByUsernameQuery("select username as principal,roles as role from users_roles where username =?")
        .rolePrefix("ROLE_").passwordEncoder(new Md5PasswordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {


        http.authorizeRequests().antMatchers("/produits").hasRole("USER");


    }


}

宁静的服务

@Autowired
private ProduitRepository produitRepository;


@RequestMapping(value="/produits",method=RequestMethod.GET)
public List<Produit> listProduits()
{
    return produitRepository.findAll();
}

Answer 1

从你的截图中我可以看到，你正在尝试在邮递员中使用基本身份验证。如果是，您至少应该启用它。试试这个：

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.httpBasic();
    http.authorizeRequests().antMatchers("/produits").hasRole("USER");
}