没有上下文根路径的spring-webflux安全中的白名单endpoint

Question

我试图将所有以 /health结尾的自定义endpoint列入白名单，但在WebFlux Security中，我无法使用正则表达式来匹配所有endpoint。例如 /app/health、 /app/meta/health、 /app/custom/meta/health、 /api/app/custom/meta/health等。在构建SecurityWebFilterChain时，我找不到任何模式（或正则表达式）用一个条目将这些endpoint列入白名单。如果我尝试使用正则表达式，我也会收到警告

spring-security '**' patterns are not supported in the middle of patterns and will be rejected in the future. Consider using '*' instead for matching a single path segment.

下面是代码片段

String[] ALLOWED_PATTERNS = {".*/health"};
// String[] ALLOWED_PATTERNS = {"/*/health"};  // allows whitelist /app/health endpoint
// String[] ALLOWED_PATTERNS = {"/*/health", "/*/*/health"};  // need generic way to whitelist all

@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) {
    return http
        .authorizeExchange()
        .pathMatchers(ALLOWED_PATTERNS).permitAll()
        .anyExchange().authenticated()
         ...
        .build();
}

我可以通过提供antMatcher在Spring Security（不是反应性/Web流量安全）中实现相同的功能

@Override
public void configure(WebSecurity web) {
   web.ignoring().antMatchers("/**/health");
}

注意：这不是spring执行器健康endpoint，而是自定义健康endpoint

Answer 1

你可以写你自己的匹配器。

import com.google.common.cache.Cache;
import com.google.common.cache.CacheBuilder;
import lombok.extern.slf4j.Slf4j;
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;

import java.util.concurrent.ConcurrentMap;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

@Slf4j
public class RegexRequestMatcher {

    private static final Cache<String, Pattern> CACHE = CacheBuilder.newBuilder().build();
    private static final ConcurrentMap<String, Pattern> PATTERNS = CACHE.asMap();

    public static Mono<ServerWebExchangeMatcher.MatchResult> matches(String regex, ServerWebExchange exchange) {
        return matches(regex, exchange.getRequest().getURI().getPath());
    }

    public static Mono<ServerWebExchangeMatcher.MatchResult> matches(String regex, String uri) {
        Pattern pattern = getPattern(regex);
        Matcher matcher = pattern.matcher(uri);
        boolean matches = matcher.matches();
        return Mono.just(matches)
                .flatMap(m -> m ? ServerWebExchangeMatcher.MatchResult.match() : ServerWebExchangeMatcher.MatchResult.notMatch());
    }

    private static Pattern getPattern(String regex) {
        return PATTERNS.computeIfAbsent(regex, r -> Pattern.compile(r));
    }
}

然后，您可以使用自己的匹配器，而不是路径匹配器。

.matchers(exchange -> RegexRequestMatcher.matches(".*/health", exchange)).permitAll()