如何禁用特定endpoint的身份验证？

Question

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/chores");
}

@SpringBootTest
@AutoConfigureMockMvc
public class ChoreApplicationTest
{
    @Autowired
    private MockMvc mockMvc;

    @Test
    public void choresShouldBeEmptyAtStart() throws Exception
    {
        this.mockMvc.perform(get("/chores")).
                andExpect(status().isOk());
    }

java.lang.AssertionError: Status expected:<200> but was:<401>
Expected :200
Actual   :401

@Configuration
@EnableWebSecurity
public class SecurityConfigurer extends WebSecurityConfigurerAdapter
{
    @Override
    public void configure(WebSecurity web) throws Exception
    {
        web.ignoring().antMatchers("/chores");
        super.configure(web);
    }
}

我想你可以想象家务控制器中有什么，但为了完整起见，这里有相关的部分：

@RestController
public class ChoreController
{
    private final ChoreRepository repository;

    ChoreController(ChoreRepository repository)
    {
        this.repository = repository;
    }

    @GetMapping("/chores")
    List<Chore> all()
    {
        return this.repository.findAll();
    }
}

下面是测试在输出中打印的请求：

MockHttpServletRequest:
      HTTP Method = GET
      Request URI = /chores
       Parameters = {}
          Headers = []
             Body = null
    Session Attrs = {SPRING_SECURITY_SAVED_REQUEST=DefaultSavedRequest[http://localhost/chores]}

那么，为什么我的测试会得到401的返回代码，我如何修复它？

Answer 1

安全配置在configure（WebSecurity web）中是正确的，但问题是SecurityConfigurer由于包不同而无法调用。

Spring Boot从主应用程序即ChoreApplication开始执行，还请注意，除了SecurityConfigurer（包安全）之外，所有类都在包托管中

我们的主应用程序类由@springbootapplication组成，其中

@SpringBootApplication = @SpringBootConfiguration + @EnableAutoConfiguration + @ComponentScan

默认情况下，spring会处理包杂务中的所有类，这里的问题是spring不知道其他包中的类。在包安全性中securityconfigurer

为了调用securityconfigurer，我们必须在@componentscan(basePackages={“chores”,“security”}）中添加安全包

ChoreApplication.java

package chores;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.ComponentScan;

@SpringBootApplication
@ComponentScan(basePackages = {"chores", "security"})
public class ChoreApplication
{
    public static void main(String args[])
    {
        SpringApplication.run(ChoreApplication.class, args);
    }
}

package security;

import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class SecurityConfigurer extends WebSecurityConfigurerAdapter {
    @Override
    public void configure(WebSecurity web) {
        web.ignoring().antMatchers("/chores");
    }
}

你可能喜欢探索

Spring Security配置：HttpSecurity-vs-Webecurity

如何使用@ComponentScan注释扫描多个路径