Swagger OpenAPI UI发送POST，PUT和DELETE请求的403响应状态：Nginx Proxy后面的服务器

Question

问题:Swagger UI openAPI的Get请求正在工作，而其他方法类型给出403错误。

屬地：

<dependency>
        <groupId>org.springdoc</groupId>
        <artifactId>springdoc-openapi-ui</artifactId>
        <version>1.6.6</version>
</dependency>

摇摆配置：

@Configuration
@OpenAPIDefinition(servers = {
        @Server(url = "https://hostname")
})
@SecurityScheme(name = auth, type = SecuritySchemeType.HTTP, bearerFormat = "JWT", scheme = "bearer")
public class SwaggerConfig {
}

安全配置：

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
        http.cors().and().csrf().disable()
            .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
            .authorizeRequests()
            .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
            .anyRequest().authenticated();

        http.addFilterBefore(authenticationJwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);
    }
    
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/swagger-ui/**","/v3/api-docs/**");
        }
    }

我们还尝试忽略这些路径:WebSecurity中的< code>/swagger-resources/**，/webjars/**,仍然不起作用。

Post请求错误消息403

原始编辑：进一步研究发现，这可能是由于nginx代理。在我的本地服务器上一切正常，但在其他托管在nginx代理后面的环境中却无法正常工作。

Answer 1

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
private static final String[] WHITELIST = {
        "/v2/api-docs",
        "/v3/api-docs",
        "/**/v3/api-docs",
        "/swagger-resources",
        "/swagger-resources/**",
        "/configuration/ui",
        "/configuration/security",
        "/swagger-ui.html",
        "**/swagger-ui.html",
        "/**/swagger-ui.html**",
        "/swagger-ui.html**",
        "/webjars/**"
};

@Configuration
@Order(2)
public static class SwaggerSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers(WHITELIST).permitAll();
        http.csrf().disable();
    }
}
}