在处理webhook时，我会收到未经授权的401

Question

当处理webhook时，我得到一个未经授权的401，我使用Spring Security和Vaadin

@RestController
@Log4j2
public class WebHookController {

  @Inject
  KeywordPlanService service;
  @Inject
  SheetsService sheetsService;

  MainView view;

  @PostMapping("/notifications")
  @AnonymousAllowed
  public ResponseEntity<Void> webHookHandler(HttpServletRequest request) {
    String headerGoogChanged = request.getHeader("x-goog-changed");
    if (!ObjectUtils.isEmpty(headerGoogChanged) && headerGoogChanged.contains("content")) {
      service.parseDashboardAndSave(view.getGrid(), sheetsService.readSheetValuesBatch());
      sheetsService.writeSheetValuesBatch(service.getKeyWordDashboards());
      log.info("Push notification processed: {}", request);
    }
    return ResponseEntity.ok().build();
  }
}

和

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends VaadinWebSecurityConfigurerAdapter {

  private static final String LOGIN_URL = "/login";

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    super.configure(http);
    http
        .oauth2Login()
        .loginPage(LOGIN_URL)
        .permitAll();
  }...

我知道我需要公开我的endpoint

/通知

如何公开endpoint？

已更新

   @Override
      protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.authorizeRequests()
            .antMatchers("/notifications")
            .permitAll()
            .anyRequest()
            .authenticated()
            .and()
            .oauth2Login()
            .loginPage(LOGIN_URL);
    
    
      }

引发消息

2022-06-10 17:39:30.040WARN 37089 --- [ restartedMain]ConfigServletWebServerApplication Context：在上下文初始化期间遇到异常-取消刷新尝试：org.springframework.beans.factory.BeanCreationException：创建名为“springSecurityFilterChain”的bean时出错在类路径资源[org/springFramework/Security/config/注释/web/配置/WebSecurityConfiguration.class]中定义2022-06-10 17:39:30.041WARN 37089 --- [ restartedMain]中定义的名称为“springSecurityFilterChain”的bean错误：通过工厂方法的Bean实例化失败；嵌套异常org.springframework.beans.BeanInstantiationException：无法实例化[javax.servlet.过滤器]：工厂方法“springSecurityFilterChain”抛出异常；嵌套异常java.lang.IllegalStateException：无法在任何请求之后配置antMatcher。

启动ApplicationContext时出错。要显示条件报告，请在启用“调试”的情况下重新运行应用程序。2022-06-10 17:39:30.074错误37089---[restartedMain]o.s.boot。SpringApplication:Application运行失败

已断开与目标VM的连接，地址：“127.0.0.1:64031”，传输：“socket”

进程完成，退出代码为0

Answer 1

我不同意停用任何endpoint的安全性，即使通知应该由授权应用程序完成。

要禁用特定终结点的安全性，请尝试以下操作：

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends VaadinWebSecurityConfigurerAdapter {
    @Override
    public void configure(HttpSecurity http) throws Exception{
        http.authorizeRequests().antMatchers("/notifications").permitAll();
        super.configure(http);
    }
}

Answer 2

添加这行代码：

 .antMatchers("/notifications").permitAll()

因此，在你的情况下，它将是这样的：

http.authorizeRequests()
      .antMatchers("/notifications")
      .permitAll()
      .anyRequest()
      .authenticated()
      .and()
      .oauth2Login()
      .loginPage(LOGIN_URL);