Spring Boot Security通过WebSecurity不忽略certian url

Question

    protected void configure(HttpSecurity http) throws Exception {

    RequestMatcher csrfRequestMatcher = new RequestMatcher() {
          private AntPathRequestMatcher[] requestMatchers = {
              new AntPathRequestMatcher("/iams/w/*")
          };
          @Override
          public boolean matches(HttpServletRequest request) {
            for (AntPathRequestMatcher rm : requestMatchers) {
              if (rm.matches(request)) { return true; }
            }
            return false;
          } // method matches

        };      


    http
        .csrf()
        .requireCsrfProtectionMatcher(csrfRequestMatcher)
        .and()
        .authorizeRequests()
            .anyRequest().authenticated()
            .and()
        .requestCache()
            .requestCache(new NullRequestCache())
            .and()
        .httpBasic();
}

    public void configure(WebSecurity web) throws Exception {

    web.ignoring().antMatchers(
            "/myapp/docs/**",
            "/myapp/docs/*",
            "/myapp/docs/index.html",
            "/resources/**", 
            "/static/**");

}

@EnableWebSecurity

@EnableGlobalMethodSecurity（prePostEnabled=true）公共类SecurityConfig扩展了WebSecurityConfigurerAdapter{

我错过了什么？请指教。

Answer 1

您的代码中有一个错误顺序。

http
    .csrf()
    .requireCsrfProtectionMatcher(csrfRequestMatcher)
    .and()
    .authorizeRequests()
        .anyRequest().authenticated()
        .and()
    .requestCache()
        .requestCache(new NullRequestCache())
        .and()
    .httpBasic();

因此，需要对任何请求进行身份验证。您可以直接使用antmatchers。

http
        .authorizeRequests()
        .antMatchers("/iams/w/*")
        .authenticated()
        .and()
        .httpBasic()
        .and()
        .requestCache()
        .requestCache(new NullRequestCache())
        .csrf().disable()

希望对你有帮助。