springboot安全招摇springfox-boot-starter

Question

pom.xml

<!-- swagger -->
<dependency>
    <groupId>io.springfox</groupId>
    <artifactId>springfox-boot-starter</artifactId>
    <version>3.0.0</version>
</dependency>

Spring Security配置

protected void configure(HttpSecurity httpSecurity) throws Exception {

        String[] SWAGGERS = {
                "/swagger/**",
                "/v3/**"
        };

        httpSecurity
                .authorizeRequests(expressionInterceptUrlRegistry ->
                        expressionInterceptUrlRegistry
                                // 放行 druid 页面
                                .antMatchers("/zhy-druid/**").permitAll()
                                .antMatchers(SWAGGERS).anonymous()
                                .anyRequest().authenticated()
                );

        httpSecurity
                .formLogin(httpSecurityFormLoginConfigurer ->
                        httpSecurityFormLoginConfigurer
                                .loginPage("/authentication")
                                .successHandler(accountAuthenticationSuccessHandler)
                                .failureHandler(accountAuthenticationFailureHandler)
                );

        httpSecurity
                .logout(httpSecurityLogoutConfigurer ->
                        httpSecurityLogoutConfigurer
                                .logoutUrl("/cancellation")
                                .logoutSuccessHandler(accountLogoutSuccessHandler)
                );

        httpSecurity
                .exceptionHandling(httpSecurityExceptionHandlingConfigurer ->
                        httpSecurityExceptionHandlingConfigurer
                                .authenticationEntryPoint(accountAuthenticationEntryPointHandler)
                                .accessDeniedHandler(accountAccessDeniedHandler)
                );

        httpSecurity
                .cors();

        httpSecurity
                .csrf()
                .disable();
    }

application-local.yml

springfox:
  documentation:
    enabled: true
    swagger-ui:
      base-url: /swagger

我得到这个结果。

无法呈现此定义提供的定义未指定有效的版本字段。

请注明有效的Swagger或OpenAPI版本字段。支持的版本字段是swagger： 2.0和与openapi： 3.0. n匹配的版本字段（例如，openapi： 3.0.0）。

Answer 1

Openapi是最新的库，建议用于spring boot应用程序。这是下一个版本的招摇。

在您的应用程序中为workopenapi添加以下代码。

pom.xml

<dependency>
    <groupId>org.springdoc</groupId>
    <artifactId>springdoc-openapi-ui</artifactId>
    <version>1.2.32</version>
</dependency>

Spring Security性配置为允许打开api url。

@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    
    @Autowired
    private UserServiceImpl userServiceImpl;
    
    @Bean
    BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and().csrf().disable()
                .authorizeRequests()
                    .antMatchers(SecurityConstants.SIGN_UP_URL).permitAll()
                    .antMatchers("/swagger-ui/**").permitAll()
                    .antMatchers("/v3/**").permitAll()
                    .antMatchers("/api-docs.html").permitAll()
                .anyRequest().authenticated()
                .and()
                .addFilter(new AuthorizationFilter(authenticationManager()))
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }
}

应用yml公司

springdoc:
  swagger-ui.path: /api-docs.html