在V2.0.x中无法使用Spring Cloud+boot调用/encryptendpoint

Question

我使用的是Spring云和安全示例。在本例中，我使用的是Spring Boot版本1.4.1.release。Spring启动父版本到2.0.4.relase。当我更新endpoint后的依赖项时，就开始中断了。

我已经浏览了Spring Cloud Config-Encrypt密码和文档http://Cloud.Spring.io/spring-cloud-statist/finchley.release/single/spring-cloud.html，但不确定为什么会出现forbiddeb错误。

我试着用卷曲和邮递员，得到禁止的错误。

注意：我的服务器运行在端口8888上&已经添加了JCE文件

帖子:http://localhost:8888/encrypt

下面我使用的代码

<parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.4.RELEASE</version>
        <relativePath /> <!-- lookup parent from repository -->
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
        <spring-cloud.version>Finchley.SR1</spring-cloud.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-config-server</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

    </dependencies>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-dependencies</artifactId>
                <version>${spring-cloud.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

---

server:
  port: 8888


spring:
  cloud:
    config:
      server:
        git:
          uri: https://github.com/rseroter/pluralsight-spring-cloudconfig-wa-tolls

          search-paths:
          - 'station*'
          repos:
            perf: 
              pattern:
              - "*/perf"
              uri : https://github.com/rseroter/pluralsight-spring-cloudconfig-wa-tolls-perf
              search-paths :
              - 'station*'

# Enable security for Basic Auth
  security:
    user:
      name: ABC_123
      password: ABC##123

encrypt.key=ABCDEFGHIJKLMNOPQRSTUVWXYZ

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
    @Override
    protected void configure(HttpSecurity http) throws Exception{
        http.authorizeRequests().antMatchers("/").permitAll();
    }
}

Answer 1

问题是Spring Security默认情况下启用csrf保护。你可以在这里阅读更多信息。

只需禁用csrf保护将有助于/加密再次访问。

http.csrf().disable()
            .authorizeRequests().mvcMatchers(HttpMethod.POST, "/encrypt/**")
            .permitAll();