Spring security要求URL登录，即使在Configure方法中不进行身份验证也是允许的

Question

我正在使用Spring Boot和Spring Security。我有多个URL，我希望其中一些可以通过身份验证访问，而其中一些可以在没有身份验证的情况下访问。我以这种方式编写了Configure方法。但浏览器会将我重定向到登录页面，即使是允许在没有身份验证的情况下访问的URL。例如，当我尝试访问localhost:8080/emailExists时，我被要求登录。我会做错什么？

我的控制器类：

@RestController
class AppController {

  @Autowired
  private ShopSearchRepository searchRepository;

  @Autowired
  private UserRepository userRepository;

  @GetMapping("/emailExists")
  public Boolean emailExists(@RequestParam String email) {
     User user = userRepository.findByEmail(email);
  
     if (user == null) return false;
     else return true;
  } 

  @GetMapping("/ShopsSearch")
      List<Shop> search(@RequestParam String name) {
      return searchRepository.findByName(name);
  }

}

我的配置方法：

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable().authorizeRequests()
    .antMatchers("/ShopsSearch/").authenticated()
    .anyRequest().permitAll()
    .and()
    .httpBasic();
}

Answer 1

你需要知道绕过哪个URL

 @Override
        public void configure(HttpSecurity http) throws Exception {
           http.csrf().disable().authorizeRequests()
            .antMatchers(HttpMethod.POST,"/emailExists").permitAll() // allow without authentication
            .antMatchers(HttpMethod.POST, "/login").permitAll() // allow without authentication
            .antMatchers(HttpMethod.POST,"/newuser/*").permitAll() // allow without authentication
            .antMatchers(HttpMethod.GET,"/master/*").permitAll() // allow without authentication
             .antMatchers(HttpMethod.GET,"/exploreCourse").permitAll() // allow without authentication
            .anyRequest().authenticated() //all other need auth
        }