Spring security不允许使用简单匹配器和permitAll访问

Question

就Spring security而言，它对我来说是全新的。我在网上找到了许多描述如何设置基本安全性的资源，并且能够让HTTPS REST调用在服务器端使用以下配置：

@Configuration
@EnableWebSecurity
@EnableConfigurationProperties(SecurityAuthProperties.class)
public class ServerSecurityConfiguration extends WebSecurityConfigurerAdapter {

  private final SecurityAuthProperties properties;

  @Autowired
  public ServerSecurityConfiguration(SecurityAuthProperties properties) {
    this.properties = properties;
  }

  @Override
  public void configure(HttpSecurity http) throws Exception {
    properties.getEndpoints().forEach((key, value) -> {
      try {
        for (HttpMethod method : value.getMethods()) {
          http.authorizeRequests().antMatchers(method, value.getPath()).permitAll().and()
              .httpBasic().and().csrf().disable();
        }
      } catch (Exception e) {
        throw new SecurityConfigurationException(
            "Problem encountered while setting up endpoint restrictions", e);
      }
    });

    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  }

}

  @Override
  public void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests().antMatchers("/rst/**").permitAll();
    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  }

在我看来，这段代码允许访问路径/rst及其下的任何内容，但似乎恰恰相反。我错过了什么？

注意：我要提到的另一件事是，目前没有“用户”身份验证。“客户端”不是基于web的，而是一个单独的Spring Boot服务，它有自己的客户端安全配置。

更新：

@RestController
@RequestMapping("/rst/missionPlanning")
public class MissionPlannerController {

  @Autowired
  private MissionPlanner         service;
  @Autowired
  private ThreadPoolTaskExecutor executor;

  @PostMapping(value = "/planMission", produces = MediaType.APPLICATION_JSON_VALUE)
  public DeferredResult<ResponseEntity<GeneralResponse>> planMission() {
    DeferredResult<ResponseEntity<GeneralResponse>> result = new DeferredResult<>(60000L);
    executor.execute(new Runner(result));
    return result;
  }

  private class Runner implements ITask {

    private DeferredResult<ResponseEntity<GeneralResponse>> result;

    public Runner(DeferredResult<ResponseEntity<GeneralResponse>> result) {
      this.result = result;
    }

    @Override
    public void executeTask() {
      // Invoke service and set result.
      result.setResult(ResponseEntity.ok(service.planMission()));
    }
  }
}

  @Override
  public void configure(HttpSecurity http) throws Exception {
    http.csrf().disable().authorizeRequests().antMatchers("/rst/**").permitAll();
    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  }

Answer 1

您设置控制器的方式可能有问题。包含该路径的控制器是否具有@requestmapping（“/rst”）？

如果你用你的控制器的样子更新你的帖子会很有帮助。

编辑：看来你的问题是在你必须禁用CSRF时所提出的请求的类型。

您可以在此阅读更多信息:https://docs.spring.io/spring-security/site/docs/3.2.0.ci-snapshot/reference/html/csrf.html#csrf-include-csrf-token

在这里：https://www.baeldung.com/spring-security-csrf