Angular 2 CORSSpring启动Rest控制器，具有Spring安全性

Question

我使用angular2作为前端和Spring启动Rest控制器。在添加Spring安全性之前，我的应用程序工作正常。添加安全性后，带参数的函数不会在Spring启动Rest控制器中调用。下面是代码

Rest Controller:
----------------
@RestController
public class JobCleanupServiceController {

    private static final Logger logger = LoggerFactory.getLogger(JobCleanupServiceController.class);
   @Autowired
   JobCleanupDAO dao;

    @CrossOrigin(origins = "http://localhost:4200")
    @RequestMapping("/jobcleanup")

    public Collection<JobCleanup> index(@RequestBody String owner) {

        logger.info("Display All Jobs"+ owner);
        return dao.findAll(owner);

    }


    @CrossOrigin(origins = "http://localhost:4200")
    @RequestMapping("/jobcleanupclosedtickets")

    public JobCleanupMetrics getJobCleanupClosedTickets()
    {
        logger.info("JobCleanupMetrics getJobCleanupClosedTickets ");
        return dao.getJobCleanupClosedTickets();
    }



    @CrossOrigin(origins = "http://localhost:4200")
    @RequestMapping("/jobcleanuplinechartdata")
    public JobCleanupChart getJobCleanupLineChartData(@RequestBody String  owner){
        return dao.getJobCleanupLineChartData(owner);
    }

WebConfig.java
-------------

@Configuration
public class WebConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**");
    }
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors();
        http.authorizeRequests()
                    .antMatchers(
                            "/jobcleanup",
                            "/jobcleanupclosedtickets",
                            "/jobcleanuplinechartdata"
                    ).permitAll();
    }

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        final CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("*"));
        configuration.setAllowedMethods(Arrays.asList("*"));
        configuration.setAllowCredentials(true);
        configuration.setAllowedHeaders(Arrays.asList("*"));
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

在我加入spring security之前http://localhost:4200，所有这些都被称为“/jobcleanup”、“/jobcleanupclosedtickets”、“/JobCleanupUplineChartData”。在添加spring security only之后，会调用“/jobcleanupclosedtickets”，其他方法不会被调用。除了“/jobcleanupclosedtickets”之外，其他方法都有请求主体。

有人能帮我解决这个问题吗？

Answer 1

更新了SecurityConfig。java如下所示。默认情况下，csrf在spring security中启用。

 @Configuration
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
        @Override
        protected void configure(HttpSecurity http) throws Exception {

    http.csrf().disable();
    http.cors();

        }

        @Bean
        public CorsConfigurationSource corsConfigurationSource() {
            final CorsConfiguration configuration = new CorsConfiguration();
            configuration.setAllowedOrigins(Arrays.asList("*"));
            configuration.setAllowedMethods(Arrays.asList("*"));
            configuration.setAllowCredentials(true);
            configuration.setAllowedHeaders(Arrays.asList("*"));
            final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
            source.registerCorsConfiguration("/**", configuration);
            return source;
        }
    }