Swagger- /api-docs的自定义身份验证

Question

我们有一个Spring5，非SpringBoot应用程序，使用Springfox 2.9.2 Swagger UI。

我不知道如何保护 /api-docsendpoint：我希望它每次访问时都调用我的身份验证函数。我让它为swagger-ui.html工作，但没有成功 /api-docs.这是我得到的。

@Configuration
@EnableSwagger2
@EnableWebMvc
public class SwaggerConfig implements WebMvcConfigurer {

    @Autowired
    protected AuthService authService;


    @Override
    public void addViewControllers(ViewControllerRegistry registry) {

        // registry.addViewController("/docs/swagger/api-docs"); doesnt work
        registry.addRedirectViewController("/docs/swagger/swagger-resources/configuration/ui", "/swagger-resources/configuration/ui");
        registry.addRedirectViewController("/docs/swagger/swagger-resources/configuration/security", "/swagger-resources/configuration/security");
        registry.addRedirectViewController("/docs/swagger/swagger-resources", "/swagger-resources");
    }

    class Interceptor implements HandlerInterceptor{
        @Override
        public boolean preHandle(final HttpServletRequest request, final HttpServletResponse response, final Object handler ) {
            try{
                authService.assertAdmin(); // I need to call this
            }catch (Exception e){
                return false;
            }
            return true;
        }
    }

    @Override
    public void addInterceptors( final InterceptorRegistry registry) {
        registry.addInterceptor(new Interceptor());
    }

    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        // docs/swagger/index.html
        registry.addResourceHandler("/docs/swagger/swagger-ui.html**")
            .addResourceLocations("classpath:/META-INF/resources/swagger-ui.html");

        // docs/swagger/webjars
        registry.addResourceHandler("/docs/swagger/webjars/**")
            .addResourceLocations("classpath:/META-INF/resources/webjars/");
    }
}

另一种选择是永久关闭对 /api-docs 的访问，只需直接调用从某个新终结点生成 JSON 的方法。这可能吗？

Answer 1

最终，我按照@UsamaAmjad的建议，通过Spring安保解决了这个问题。

open class SecurityInitializer : AbstractSecurityWebApplicationInitializer()

@Configuration
@EnableWebSecurity
open class SecurityConfig : WebSecurityConfigurerAdapter() {


    @Throws(Exception::class)
    override fun configure(http: HttpSecurity) {
        http.antMatcher("/docs/swagger/v2/api-docs").addFilter(myFilter())
    }

    open fun myFilter() = object : FilterSecurityInterceptor() {
        override fun doFilter(request: ServletRequest?, response: ServletResponse?, chain: FilterChain?) {

            if (do your stuff here) {
                chain!!.doFilter(request,response) // continue with other filters
            } else {
                super.doFilter(request, response, chain) // filter this request
            }
        }
    }
}