Spring Boot HttpSecurity始终403禁止

Question

我总是得到http状态403。我有以下安全配置：

@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
    httpSecurity
        .cors().and().csrf().disable()
        .authorizeRequests()
        .antMatchers("/api/users/login/").permitAll()
        .anyRequest().authenticated();
}


@Bean
CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(Arrays.asList("*"));
    configuration.setAllowedMethods(Arrays.asList("*"));
    configuration.setAllowedHeaders(Arrays.asList("*"));
    configuration.setAllowCredentials(true);
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

我无法发布到/api/users/login

2019-10-15 12:25:49.567[0；39m[32mdebug[0；39m[35m7423[0；39m[2m---[0；39m[2m[nio-8080-exec-1][0；39m[36mo.s.web.servlet.dispatcherservlet[0；39m:[2m:[0；39m“error”POST“/错误”的调度，参数={}[2m2019-10-15 12:25:49.576[0；39m[32mdebug[0；39m[35m7423[0；39m[2m---[0；39m[2m[2m[nio-8080-exec]-1][0；39M[36ms.w.s.m.a.RequestMappingHandlerMapping[0；39M[2M:[0；39M映射到公共org.springframework.http.responseEntity>org.springframework.boot.autocigure.web.servlet.error.basicerrorcontroller.error(javax.servlet.http.httpservletrequest)[2M2019-10-15 12:25:49.605[0；39M[32Mdebug[0；39M[35M7423[0；39M[2M---[0；39M[2M[2M[2M][0；M.M.A.HttpEntityMethodProcessor[0；39M[2M:[0；39M，使用“application/json”，给定[/]并支持[application/json,application/json,application/json,application/+json“[2M2019-10-15 12:25:49.608[0；39M[32Mdebug[0；39M[35M7423[0；39M[2M---[0；[2M:[0；39M正在写入[{TimeStamp=TUE Oct 15 12:25:49 CEST 2019,status=403,Error=禁止,Message=拒绝访问,Path=/（截断）...][2M2019-10-15 12:25:49.661[0；39M[32MDEBUG[0；39M[35M7423[0；39M[2M---[0；39M[2M[2M[nio-8080-exec-1][0；39M[2M[36MO.S.web.servlet.DispatcherServlet[0；39M[2M:[0；39M][36M.S.web.Servlet.DispatcherServlet[0；39M[2M:[0；39M]退出“错误”调度,状态403

Answer 1

尝试.antmatchers（httpmethod.post,“/api/users/login”）.PermitAll（），还请注意您有.antmatchers（“/api/users/login/”），并且您正在请求/api/users/login在您的antmatchers中添加注释。

您还可以使用configure(WebSecurity web)，它将绕过这里描述的Spring Security筛选器链