错误未经授权，访问此资源需要完全身份验证

Question

我试图在我的API中向一个endpoint发出请求，然而，每次试图访问执行器endpoint都会返回401错误，访问这个资源需要完全身份验证。我只是使用spring security对用户的密码进行加密，然后再将它们存储到数据库中。我已经检查了所有类似的问题，并执行了他们给出的所有解决方案，但仍然没有运气。

server.port=8080
spring.jpa.hibernate.ddl-auto=create
spring.datasource.url=jdbc:mysql://localhost:3306/DevUserManagementDB
spring.datasource.username=root
spring.datasource.password=toor
spring.datasource.driver-class-name=com.mysql.jdbc.Driver
#spring.jpa.database-platform=org.hibernate.dialect.MySQL5Dialect
spring.jpa.properties.hibernate.dialect = org.hibernate.dialect.MySQL5Dialect
spring.jpa.hibernate.ddl-auto=update
management.security.enabled=false

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>1.5.9.RELEASE</version>
    <relativePath/> <!-- lookup parent from repository -->
</parent>

<properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
    <java.version>1.8</java.version>
</properties>
<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
            <dependency>
                    <groupId>mysql</groupId>
                    <artifactId>mysql-connector-java</artifactId>
            </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>

        <dependency>
                <groupId>org.eclipse.persistence</groupId>
                <artifactId>javax.persistence</artifactId>
                <version>2.2.0</version>
                <type>jar</type>
        </dependency>
            <dependency>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-starter-actuator</artifactId>
            </dependency>

        <!-- Spring Security -->
           <dependency>
                  <groupId>org.springframework.boot</groupId>
                  <artifactId>spring-boot-starter-security</artifactId>

            </dependency>

            <dependency>
                  <groupId>org.springframework.boot</groupId>
                  <artifactId>spring-boot-devtools</artifactId>
            </dependency>

            <dependency>
                 <groupId>commons-validator</groupId>
                 <artifactId>commons-validator</artifactId>
                 <version>1.6</version>
                    <type>jar</type>
            </dependency>
</dependencies>

<build>
    <plugins>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
                            <configuration>
                                <executable>true</executable>
                            </configuration>
        </plugin>
    </plugins>
</build>

securityconfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired  
private UserService userService;


@Override
protected void configure(HttpSecurity http) throws Exception {

    http.authorizeRequests().antMatchers("/users").permitAll()
            .antMatchers("/motion").permitAll().and().csrf().disable();
}
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

userService.java

@Service
@Transactional
public class UserService  implements UserDetailsService {

   @Autowired
   private PasswordEncoder passwordEncoder;

   public Response AddUser(Users user) {
      if( user == null ){
          throw new ResourceNotFoundException("Empty", "Missing Data Exception");
      } else {
          user.setPassword(passwordEncoder.encode(user.getPassword()));
          userRepository.save(user);
          String customerNum = Long.toString(userDetails.getCustomerNumber);
          return new Response("customerNum", "Customer Created Successfully");
      }

  }
}

Answer 1

如果您只使用Spring Security类，那么最简单的方法是通过删除@enableWebSecurity来禁用Spring Security筛选器，即：

@Configuration
public class SecurityConfig  {
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

如果你不想那样，你也可以试试这个：

http.authorizeRequests().antMatchers("/**").permitAll().and().csrf().disable();