Spring-安全。5.1.5发布到Spring-安全性..5.4.6破坏安全配置

Question

安全配置工作代码

@EnableWebSecurity
@configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter{
@override
protected void configure(HttpSecurity httpSecurity) throws Exception {
super.configure(httpSecurity);
httpSecurity.authorizeRequests().anyRequest().permitAll();
httpSecurity.csrf().disable();
httpSecurity.headers().frameOptions().disable();
}
}

Answer 1

当调用super.configure(httpSecurity)时，它执行以下操作：

http.authorizeRequests((requests) -> requests.anyRequest().authenticated());
http.formLogin();
http.httpBasic();

之后，再次使用anyrequest配置请求。在Spring Security的最近版本中是不允许的。

我建议您不要调用super.configure(httpSecurity)，而是禁用默认值并进行配置，如下所示：

@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter{
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity.formLogin().disable();
        httpSecurity.httpBasic().disable();
        httpSecurity.authorizeRequests((requests) ->
            requests.anyRequest().permitAll()
        );
        httpSecurity.csrf().disable();
        httpSecurity.headers().frameOptions().disable();
    }
}