Springboot安全角色已被忽略

Question

我试图保护我的Spring启动应用程序（1.21）看起来像我的antMatcher（"/报告**"）. hasRole（"报告"）的一些URL模式被忽略。

e、 g.如果我浏览到localhost:9000/report/books之类的内容，我需要登录，它只适用于我的用户名密码组合，但我没有将角色报告设置为我的用户“user”。所以我希望我不被允许访问报告网站，但页面会显示出来。

我必须如何更改它，只有具有角色报告的用户才能访问该url？

EDIT1更新的源文件

一个pplication.java

@SpringBootApplication
@EnableTransactionManagement
public class Application {

    public static void main(String[] args)  {
        @SuppressWarnings("unused")
        ApplicationContext ctx = SpringApplication.run(Application.class, args);
    }
}

MvcConfig.java

@Configuration
public class MvcConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/login").setViewName("login");    
    }

    @Bean
    public EmbeddedServletContainerCustomizer containerCustomizer(){
        return new MyCustomizer();
    }

    private static class MyCustomizer implements EmbeddedServletContainerCustomizer {

        @Override
        public void customize(ConfigurableEmbeddedServletContainer factory) {
            factory.addErrorPages(new ErrorPage(HttpStatus.NOT_FOUND, "/error/404"));
            factory.addErrorPages(new ErrorPage(Exception.class, "/error/exception"));
        }

    }

    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {    
      registry.addResourceHandler("/error/**").addResourceLocations("classpath:/static/");
      registry.addResourceHandler("/static/**").addResourceLocations("classpath:/static/");
      registry.addResourceHandler("/css/**").addResourceLocations("classpath:/static/css/");
      registry.addResourceHandler("/images/**").addResourceLocations("classpath:/static/images/");
      registry.addResourceHandler("/js/**").addResourceLocations("classpath:/static/js/");
    }

}

WebSecurityConfig.java

@Configuration
@EnableWebMvcSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {


        http.sessionManagement().enableSessionUrlRewriting(false);

        http
            .formLogin()
                .loginPage("/login")
                .permitAll()
            .and()
                .logout()
                .permitAll()
        .and()
            .authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/report**").hasRole("REPORT")
                .anyRequest().fullyAuthenticated();

    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth
            .inMemoryAuthentication()
            .withUser("user").password("user").roles("USER").and()
            .withUser("admin").password("admin").roles("ADMIN");
    }

}

Answer 1

我需要改变以下几点：

1. 将/报告**更改为/报告/**
2. 加上。和（）。异常处理（）。accessDeniedPage（“/error/403”）
3. 也许它没有@Order就可以工作，但我在spring boot示例中看到了它
4. （必须将/error/403映射到errorpage）

网络安全配置

@Configuration
@EnableWebMvcSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {


        http.sessionManagement().enableSessionUrlRewriting(false);

        http
            .formLogin()
                .loginPage("/login")
                .permitAll()
            .and()
                .logout()
                    .permitAll()
            .and()
                .authorizeRequests()
                    .antMatchers("/").permitAll()
                    .antMatchers("/report/**").hasRole("REPORT")
                    .anyRequest().fullyAuthenticated()
            .and().exceptionHandling().accessDeniedPage("/error/403");

    }

    @Override
    @Order(Ordered.HIGHEST_PRECEDENCE)
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth
            .inMemoryAuthentication()
                .withUser("user").password("user").roles("USER").and()
                .withUser("admin").password("admin").roles("ADMIN","REPORT");
    }

}