java - 防止 Spring Boot 注册 Spring Security 过滤器之一

Question

我想禁用安全链中的 Spring Security 过滤器之一。

我已经看到了Prevent Spring Boot from registering a servlet filter问题 - 并接受应该有效，但不幸的是不是。

附代码:

    @Bean
    public FilterRegistrationBean registration(AnonymousAuthenticationFilter filter) {
        FilterRegistrationBean registration = new FilterRegistrationBean(filter);
        registration.setEnabled(false);
        return registration;
    }

Spring Boot 会及时宣布没有符合条件的 bean，这很可悲:

Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.web.authentication.AnonymousAuthenticationFilter] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {}

创建另一个 bean 之后:

    @SuppressWarnings("deprecation") // Oh, there be dragons
    @Bean
    public AnonymousAuthenticationFilter anonymousAuthenticationFilter() {
        return new AnonymousAuthenticationFilter();
    }

我被攻击了

Caused by: java.lang.IllegalArgumentException: [Assertion failed] - this String argument must have length; it must not be null or empty

这是完全不稳定的； 在 afterPropertiesSet() 方法中断言 https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/authentication/AnonymousAuthenticationFilter.java阻止我使用默认构造函数。使用另一种方法:

    @Bean
    public AnonymousAuthenticationFilter anonymousAuthenticationFilter() {
        // it will be disabled anyway so...
        return new AnonymousAuthenticationFilter("_", new Object(), new ArrayList<GrantedAuthority>());
    }

一切都变得更好了:

INFO 4916 --- [ost-startStop-1] o.s.b.c.embedded.FilterRegistrationBean : Filter anonymousAuthenticationFilter was not registered (disabled)

DEBUG 4916 --- [ost-startStop-1] o.s.security.web.FilterChainProxy : Initializing filter 'springSecurityFilterChain'

DEBUG 4916 --- [ost-startStop-1] o.s.security.web.FilterChainProxy : Filter 'springSecurityFilterChain' configured successfully

但是在访问了一些资源之后我得到了:

DEBUG 4916 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy : /user at position 10 of 13 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'

DEBUG 4916 --- [nio-8080-exec-3] o.s.s.w.a.AnonymousAuthenticationFilter : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@90572420: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@255f8: RemoteIpAddress: 127.0.0.1; SessionId: 6B9D974A4634548750FE78C18F62A6B0; Granted Authorities: ROLE_ANONYMOUS'

出于某种原因，AnonymousAuthenticationFilter 仍在工作。问题:有没有办法在 Spring Boot 应用程序中禁用此类过滤器？

Answer 1

Spring Security 将所有过滤器捆绑在 HttpSecurity 配置中。要禁用匿名身份验证，请使用以下命令:

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .anonymous().disable()
            ...
    }
    ...
}

如果你想禁用 Spring Security 中的所有默认值，你可以将 true 传递给父类构造函数以禁用默认值。例如:

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    public SecurityConfig() {
        super(true);
    }
    ...
}