Spring Boot应用程序即使在加载图像时也会为资源中的所有静态内容返回401

Question

我有一个Spring Boot webapp，有一些针对不同路由的安全配置。该项目的一些资源如下：

• 资源/
• 静态/
  • CSS/
  • IMG/
  • JS/
  • 库/

  我发现的一些已经问过的问题是：

  • Spring Boot不提供静态内容
  • Springboot 401未经授权，即使没有安全性
  • SpringBoot无法从资源文件夹加载js文件
  • Spring测试返回不安全URL的401

  我已经找到了很多spring文档

  @EnableWebMvc
  @Configuration
  @ImportResource({"classpath:mongo-config.xml"})
  public class ProjectConfiguration implements  WebMvcConfigurer {
  
  @Override
  public void addResourceHandlers(ResourceHandlerRegistry registry) {
      registry.addResourceHandler(
              "/img/**",
              "/css/**",
              "/js/**",
              "/libs/**")
              .addResourceLocations(
                      "classpath:/static/img/",
                      "classpath:/static/css/",
                      "classpath:/static/js/",
                      "classpath:/static/libs/");
  }
  

  @EnableWebSecurity
  @Configuration
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      System.out.println("Security Config");
      http    .csrf().disable()
              .httpBasic().disable()
              .authorizeRequests()
                  .antMatchers("/js/**","/css/**","/img/**","/libs/**").permitAll()
                  .antMatchers("/userManagement", "/userManagement/**", "/rest/auth").permitAll()
                  .antMatchers("/admin", "/admin/**").hasRole("ADMIN")
                  .antMatchers("/managementSettings", "/managementSettings/**").hasRole("MANAGEMENT")
                  .antMatchers("/user/**").hasRole("USER")
                  .antMatchers("/**").hasAnyRole("USER", "DEMO", "MANAGEMENT")
                  .anyRequest().authenticated()
                  .and()
              .formLogin()
                  .loginPage("/login")
                  .permitAll()
                  .successHandler( CustomSimpleURLAuthenticationSuccesHandler())
                  .failureUrl("/login?error")
                  .and()
              .logout()
                  .permitAll()
                  .logoutRequestMatcher( new AntPathRequestMatcher("/logout"))
                  .logoutSuccessUrl("/login")
                  .and()
              .addFilterAfter(AjaxRedirectFilter(), ExceptionTranslationFilter.class)
              .headers()
                  .httpPublicKeyPinning()
                  .addSha256Pins("*********************","*************************")
                  .includeSubDomains(true)
                  .maxAgeInSeconds(10000);
  }
  
  @Override
  public void configure(WebSecurity web) {
      web
              .ignoring()
              .antMatchers("/js/**","/css/**","/img/**","/libs/**");
  }
  

  <div class="content">
      <img style="margin:auto" class="img-responsive" th:src="@{/img/logo.png}"/>
  </div>
  

  那么，既然说了这么多，我如何在我的视图中加载所有的静态文件呢？我不介意有自定义或默认路径，只要我能够访问我的文件

Answer 1

您必须将资产URL的安全性配置为permitAll，如本教程中的第五个扇区https://www.baeldung.com/spring-mvc-statig-resources。我猜。