实现Spring Security性后，删除和放置终结点不起作用

Question

我目前正在开发一个带有React前端和Spring Boot后端的fullstack web应用程序。我已经为身份验证实现了Spring Security性和JWT，但此后我无法访问APIendpoint（请参阅控制器）。我已经设法访问了GET请求endpoint，但是，尽管在启动请求之前登录了后端，但PUT或DELETE请求似乎都不起作用。

我在另一篇文章中看到禁用csrf解决了这个问题，但我从来没有启用过它，所以这对我来说不起作用。

WebSecurity配置文件：

@Configuration
@AllArgsConstructor
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeRequests()
                    .antMatchers("/api/v*/registration/**")
                    .permitAll()
                .anyRequest()
                .authenticated().and()
                .formLogin();
    }

控制器（REST API）

@RestController
@RequestMapping(path = "/question")
@CrossOrigin("*")
public class QuestionController {

    private final QuestionService questionService;

    @Autowired
    public QuestionController(QuestionService questionService) {
        this.questionService = questionService;
    }

    @CrossOrigin("*")
    @GetMapping("/all")
    public ResponseEntity<List<Question>> getAllQuestions() {
        List<Question> questions = questionService.findAllQuestions();
        return new ResponseEntity<>(questions, HttpStatus.OK);
    }

    @CrossOrigin("*")
    @GetMapping("/find/{id}")
    public ResponseEntity<Question> getQuestionById(@PathVariable("id") Long id) {
        Question question = questionService.findQuestionById(id);
        return new ResponseEntity<>(question, HttpStatus.OK);
    }

    @CrossOrigin("*")
    @PostMapping("/add")
    public ResponseEntity<Question> addQuestion(@RequestBody Question question) {
        Question newQuestion = questionService.addQuestion(question);
        return new ResponseEntity<>(newQuestion, HttpStatus.CREATED);
    }

    @CrossOrigin("*")
    @PutMapping("/update/{id}")
    public ResponseEntity<Question> updateQuestion(@RequestBody Question question) {
        Question updateQuestion = questionService.updateQuestion(question);
        return new ResponseEntity<>(updateQuestion, HttpStatus.OK);
    }

    @CrossOrigin("*")
    @DeleteMapping("(/delete/{id}")
    public ResponseEntity<Question> deleteQuestion(@PathVariable("id") Long id) {
        questionService.deleteQuestion(id);
        return new ResponseEntity<>(HttpStatus.OK);
    }
}

编辑：这是实现UserDetailsService的代码

@Service
@Autowired can be left out by using this annotation.
@AllArgsConstructor
public class BenutzerkontoService implements UserDetailsService {

    private final static String USER_NOT_FOUND_MSG = "User with email %s not found";

    private final BenutzerkontoRepository benutzerkontoRepository;
    private final BCryptPasswordEncoder bCryptPasswordEncoder;
    private final ConfirmationTokenService confirmationTokenService;

    public List<Benutzerkonto> findAllBenutzerkonto() {
        // findAll() returns a list of all user objects
        return benutzerkontoRepository.findAll();
    }

    /**
     * This method is responsible for identifying the given email inside the database.
     *
     * @param email
     * @return
     * @throws UsernameNotFoundException
     */
    @Override
    public UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
        return benutzerkontoRepository.findByEmail(email).orElseThrow(() -> new UsernameNotFoundException(String.format(USER_NOT_FOUND_MSG, email)));
    }

    /**
     * The following function checks, whether the user already exists (by email) and registers the user with an
     * encoded password, if the email address does not exist already.
     *
     * The user also gets a random JSON Web Token assigned
     *
     * @param benutzerkonto
     * @return
     */
    public String signUpUser(Benutzerkonto benutzerkonto) {
        // Check whether user exists
        boolean userExists = benutzerkontoRepository.findByEmail(benutzerkonto.getEmail()).isPresent();

        if (userExists) {
            throw new IllegalStateException("Email is already taken");
        }

        // Encode the user password
        String encodedPassword = bCryptPasswordEncoder.encode(benutzerkonto.getPassword());

        // Replace the plain text password with the encoded version
        benutzerkonto.setPasswort(encodedPassword);

        // Save user to database
        benutzerkontoRepository.save(benutzerkonto);

        // Create random String via the UUID class for using it as token
        String token = UUID.randomUUID().toString();

        // Instantiate ConfirmationToken class, which defines the token for account confirmation
        ConfirmationToken confirmationToken = new ConfirmationToken(
                token,
                LocalDateTime.now(),
                // Make token invalid after 15 minutes
                LocalDateTime.now().plusMinutes(15),
                benutzerkonto
        );

        // Save token to database
        // TODO: Shouldn't it be saved by a confirmationTokenRepository object? Why does this also work?
        confirmationTokenService.saveConfirmationToken(confirmationToken);

        return token;
    }

    /**
     * This function takes the email address as a parameter and enables/activates the email for logging in.
     *
     * @param email
     * @return
     */
    public int enableAppUser(String email) {
        return benutzerkontoRepository.enableAppUser(email);
    }

    /**
     * This method adds a new user account to the database, but it searches for the passed value of email
     * inside the database first. The user object "benutzerkonto" will only be saved in the database repository,
     * if the email does not exist already.
     *
     * @param benutzerkonto
    */
    public void addNewUser(Benutzerkonto benutzerkonto) {
        // userEmailPresence can be null, if the email does not exist in the database yet, which is why it's an Optional.
        Optional<Benutzerkonto> userEmailPresence = benutzerkontoRepository.findBenutzerkontoByEmail(benutzerkonto.getUsername());
        if (userEmailPresence.isPresent()) {
            throw new IllegalStateException("Email already taken.");
        } else {
            benutzerkontoRepository.save(benutzerkonto);
        }

    }

}

Answer 1

因此，除了请求 /api/v*/注册/**其他都是安全的。这是什么意思？，这意味着在您拥有授权角色的授权用户之前，无法访问任何其他终结点。所以你需要做一些事情，比如：

>

实现包组织的UserDetails。springframework。安全果心userdetails并实现该方法：

@覆盖公共收藏

向实体类添加角色：

@OneTo很多（读取=FetchType.EAGER，级联=CascadeType。PERSIST）@JoinTable（name="user_role"，joinColns=@JoinColiv（name="user_id"，引用的列名="id"），inverseJoinColns=@JoinColiv（name="role_id"，引用的列名="id"））私有列表角色；

在endpoint中使用这些角色：

@preAuthorize（hasRole（'ROLE_role_name'））@GetMap（path=EndPoint.PATIENT_HOME，消耗="应用程序/json"，产生="应用程序/json"）公共响应实体主页（主要主体）{

 return new ResponseEntity<YourDTO>(yourDTO, HttpStatus.OK);

}