Spring Security-身份验证问题

Question

我正在开发一个Web应用程序

然而，我在尝试允许用户通过注册链接注册时遇到了一个问题。如果用户未经身份验证，则无法访问注册表的链接（“showRegistrationForm”）

有人能洞察为什么会发生这种情况吗？我在下面包含了我的安全配置中的代码片段

    @Override
protected void configure(HttpSecurity http) throws Exception {

    //Restrict Access based on the Intercepted Servlet Request 

    http.authorizeRequests()
    .antMatchers("/resources/**", "/register").permitAll()
    .anyRequest().authenticated()
    .antMatchers("/").hasRole("EMPLOYEE")
    .antMatchers("/showForm/**").hasAnyRole("EMPLOYEE","MANAGER", "ADMIN")
    .antMatchers("/save/**").hasAnyRole("MANAGER", "ADMIN")
    .antMatchers("/delete/**").hasRole("ADMIN")
    .and()
    .formLogin()
// Show the custom form created for the below request mappings
        .loginPage("/showSonyaLoginPage")
        .loginProcessingUrl("/authenticateTheUser")
// No need to be logged in to see the login page
        .permitAll()
    .and()
// No need to be logged in to see the logout button.
    .logout().permitAll()
    .and()
    .exceptionHandling().accessDeniedPage("/access-denied");    
}

Answer 1

更改代码如下：

@Override
protected void configure(HttpSecurity http) throws Exception {


    // Restrict Access based on the Intercepted Servlet Request 

    http.authorizeRequests()
        .antMatchers("/showRegistrationForm/").permitAll()
        .anyRequest().authenticated()
        .antMatchers("/").hasRole("EMPLOYEE")
        .antMatchers("/resources/").permitAll()
        .antMatchers("/showForm/**").hasAnyRole("EMPLOYEE","MANAGER", "ADMIN")
        .antMatchers("/save/**").hasAnyRole("MANAGER", "ADMIN")
        .antMatchers("/delete/**").hasRole("ADMIN")
        .and()
        .formLogin()
    // Show the custom form created for the below request mappings
            .loginPage("/showSonyaLoginPage")
            .loginProcessingUrl("/authenticateTheUser")
    // No need to be logged in to see the login page
            .permitAll()
        .and()
    // No need to be logged in to see the logout button.
        .logout().permitAll()
        .and()
        .exceptionHandling().accessDeniedPage("/access-denied");    
}

向下移动以下代码：

anyRequest().authenticated()