使用spring security在静态内容上禁用基本auth

Question

@Configuration
@EnableWebSecurity
public class SecrityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private AuthenticationEntryPoint authEntryPoint;

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication().withUser("john123").password("password").roles("USER");
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable().authorizeRequests()
            .anyRequest().authenticated()
            .and().httpBasic()
            .authenticationEntryPoint(authEntryPoint);
}}      

Answer 1

您可以通过服务器静态内容来管理它。

>

可以重写静态内容的安全性。

@Override
  public void configure(WebSecurity web) throws Exception {
    web
      .ignoring()
         .antMatchers("/target/classes/static/**");
  }

您甚至可以使用匹配的AntMacher在http安全重写中管理它。

@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable().authorizeRequests()
        .antMatchers("/target/classes/static/**").permitAll()
        .anyRequest().authenticated()
        .and().httpBasic()
        .authenticationEntryPoint(authEntryPoint);
}