Spring Security：所有endpoint返回状态200，并且作为antMatchers对约束无响应

Question

我希望根据角色限制endpoint的使用:管理员/用户。

因此，我试图使用NoopPasswordenCoder实现Spring Security（出于测试目的），但问题是:
所有endpoint返回status200，并且对约束不响应为antmatchers。

澄清一下：我想作为用户登录，并因为antmatcher而得到错误：

.antMatchers("/api/addresses")
.hasAuthority("ROLE_ADMIN")

我测试了Spring Security配置的格式：

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(inMemoryUserDetailsManager());
    }

    @Bean
    public InMemoryUserDetailsManager inMemoryUserDetailsManager() {
        final Properties users = new Properties();
        users.put("admin","{noop}admin,ROLE_ADMIN,enabled");
        users.put("user","{noop}user,ROLE_USER,enabled");
        return new InMemoryUserDetailsManager(users);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .authorizeRequests()
                .antMatchers("/api/addresses")
                .access("hasAuthority('ROLE_ADMIN')")
                .antMatchers("/api/address/**")
                .access("hasAuthority('ROLE_ADMIN') or hasAuthority('ROLE_USER')")
                .anyRequest()
                .authenticated()
                .and()
                .httpBasic()
                .and()
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }
}

基于示例配置。

在调查过程中，我试着发表评论，例如：

.antMatchers("/api/address/**")
.access("hasAuthority('ROLE_ADMIN') or hasAuthority('ROLE_USER')")

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(inMemoryUserDetailsManager());
    }

    @Bean
    public InMemoryUserDetailsManager inMemoryUserDetailsManager() {
        final Properties users = new Properties();
        users.put("ADMIN","{noop}admin,ROLE_ADMIN,enabled");
        users.put("USER","{noop}user,ROLE_USER,enabled");
        return new InMemoryUserDetailsManager(users);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .authorizeRequests()
                .antMatchers("/api/addresses")
                .hasAuthority("ROLE_ADMIN")
                .antMatchers("/api/address/**")
                .hasAnyAuthority("ROLE_ADMIN", "ROLE_USER")
                .anyRequest()
                .authenticated()
                .and()
                .httpBasic()
                .and()
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }
}

我尝试在Postman中清除cookies，以用户身份登录，但仍然得到200。

只有当我不在Postman中使用GET请求时，我才会获得401:

UPD#2:

• Java 11
• spring-boot-starter-parent 2.5.3
• spring-boot-starter-security 2.5.3

Answer 1

问题的原因是冗余配置选项：

server.servlet.context-path=/api

因为/api前缀已经存在于.antmatchers()中

server.servlet.context-path=/api

使用application.properties

解决方案3：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(inMemoryUserDetailsManager());
    }

    @Bean
    public InMemoryUserDetailsManager inMemoryUserDetailsManager() {
        final Properties users = new Properties();
        users.put("admin","{noop}admin,ROLE_ADMIN,enabled");
        users.put("user","{noop}user,ROLE_USER,enabled");
        return new InMemoryUserDetailsManager(users);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .authorizeRequests()
                .anyRequest()
                .permitAll()
                .and()
                .httpBasic()
                .and()
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }
}

@PreAuthorize("hasAuthority('ROLE_ADMIN')") 

@PreAuthorize("hasAuthority('ROLE_ADMIN') or hasAuthority('ROLE_USER')")

结果，我得到的是403而不是200: