Spring Security在自定义筛选器上排除URL

Question

@SuppressWarnings("SpringJavaAutowiringInspection")
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

   @Autowired
   private JwtAuthenticationEntryPoint unauthorizedHandler;

   @Autowired
   private UserDetailsService userDetailsService;

   @Autowired
   public void configureAuthentication(AuthenticationManagerBuilder
      authenticationManagerBuilder) throws Exception {
      authenticationManagerBuilder.userDetailsService(userDetailsService);
   }

   @Bean
   public JwtAuthenticationTokenFilter authenticationTokenFilterBean() throws Exception {
      return new JwtAuthenticationTokenFilter();
   }

   @Override
   protected void configure(HttpSecurity httpSecurity) throws Exception {
      httpSecurity
         .csrf().disable()
         .exceptionHandling()
             .authenticationEntryPoint(unauthorizedHandler)
             .and()
         .sessionManagement()
             .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
             .and()
         .authorizeRequests()
             .antMatchers("/test").permitAll()
             .antMatchers("/api/**").permitAll()
             .anyRequest().authenticated();

      httpSecurity.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
   }
}

Answer 1

您可以为某些URL禁用Spring Security筛选器链，请参阅WebSecurity#忽略:

允许添加Spring Security应该忽略的RequestMatcher实例。Spring Security提供的Web安全性（包括SecurityContext)在匹配的HttpServletRequest上不可用。通常，注册的请求应该是静态资源的请求。对于动态请求，请考虑将请求映射为允许所有用户。

用法示例：

webSecurityBuilder.ignoring()
// ignore all URLs that start with /resources/ or /static/
           .antMatchers("/resources/**", "/static/**");