Spring security基本身份验证配置

Question

我一直在努力遵循这个教程：

https://www.baeldung.com/spring-security-basic-authentication

我创建了几个restendpoint，如下所示：

@RestController
public class PostController {

    @Autowired
    PostCommentService postCommentService;

    @Autowired
    PostService postService;

    @GetMapping("/comment")
    public PostComment getComment(@RequestParam Long id) {
       return postCommentService.findPostCommentById(id);
    }

    @PostMapping("/createPost")
    public void createPost(@RequestBody PostDTO body){
        postService.createPost(body);
    }
}

<parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.3.2.RELEASE</version>
        <relativePath/>
    </parent>

 <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
 </dependency>

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private MyBasicAuthenticationEntryPoint authenticationEntryPoint;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers( "/comment").permitAll()
                .anyRequest().authenticated()
                .and()
            .httpBasic()
            .authenticationEntryPoint(authenticationEntryPoint);

        http.addFilterAfter(new CustomFilter(),
                BasicAuthenticationFilter.class);
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("admin")
            .password(passwordEncoder().encode("password"))
            .authorities("ROLE_USER");
    }


    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}

public class CustomFilter extends GenericFilterBean {

    @Override
    public void doFilter(
            ServletRequest request,
            ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
        chain.doFilter(request, response);
    }

}

@Component
public class MyBasicAuthenticationEntryPoint extends BasicAuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authEx)
        throws IOException {
        response.addHeader("WWW-Authenticate", "Basic realm= + getRealmName() + ");
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        PrintWriter writer = response.getWriter();
        writer.println("HTTP Status 401 - " + authEx.getMessage());
    }

    @Override
    public void afterPropertiesSet(){
        setRealmName("spring");
        super.afterPropertiesSet();
    }
}

现在的问题是，每当我试图发送POST请求时，我都会得到以下错误消息：

HTTP状态401-访问此资源需要完全身份验证

我尝试了两种方法来发送请求，一种是通过邮递员

1.1 401 set-cookie:jsessionid=6fe84b06e90be7f2348c0935fe3da971；path=/；HttpOnly x-content-type-options：nosniff x-xss-protection：1；mode=block cache-control：no-cache,no-store,max-age=0,必须重新验证pragma：no-cache expires：0 x-frame-options：DENY www-authenticate：Basic realm=+getRealmName()+content-length：75 date：Thu,2020年9月10日13:47:14 GMT

HTTP状态401-访问此资源需要完全身份验证

Answer 1

出现这种情况是因为Spring Security在默认情况下启用了CSRF保护（这是有充分理由的）。你可以在这里阅读关于跨站点请求伪造的信息。在您的例子中，CsrfFilter检测到缺少或无效的CSRF令牌，您将得到401响应。使示例工作的最简单方法是在安全配置中禁用csrf-ing，但当然，在实际应用程序中不应该这样做。

    @Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .csrf()
            .disable()
            .authorizeRequests()
            .antMatchers( "/comment").permitAll()
            .anyRequest().authenticated()
            .and()
            .httpBasic()
            .authenticationEntryPoint(authenticationEntryPoint);

    http.addFilterAfter(new CustomFilter(),
            BasicAuthenticationFilter.class);
}