java - 带和不带 token 的 Spring REST 相同端点

Question

以下端点:

@RequestMapping(value = "/activated",method = RequestMethod.GET)
    public GameHolder getAllGames(){
        return gameService.getActivatedGames();
    }

给我一​​些游戏，可以在没有 token 的情况下请求此路径(WebSecurityConifugurerAdapter):

@Override
    public void configure(WebSecurity web) throws Exception {
        //Add Paths which should be ignored by authentication
        web.ignoring().antMatchers("/games/activated");
}

但如果用户已登录，我会调用 userService 并加载一些额外的数据，但现在的问题是，由于 ignoring() 它完全忽略了身份验证，当提供 token 时我如何输入身份验证？

希望你明白我的意思

编辑1

我的“doFilterInternal”看起来像:

    @Override
        protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
        final String authorization = httpServletRequest.getHeader("Authorization");
                try{
                    if(authorization != null && !authorization.isEmpty() && authorization.toLowerCase().startsWith(tokenType.toLowerCase() + " ")){
                        String[] tokenTypeAndToken = authorization.split(" ");
                        final UserAuthentication tokenAuthentication = new UserAuthentication();
                        tokenAuthentication.setCredentials(tokenTypeAndToken[1]);
                        SecurityContextHolder.getContext().setAuthentication(authenticationManager.authenticate(tokenAuthentication));
                    }
                    else{
                        throw new HttpClientErrorException(HttpStatus.UNAUTHORIZED,"No token provided!");
                    }
                    filterChain.doFilter(httpServletRequest,httpServletResponse);
               

 }

Answer 1

尝试覆盖configure(HttpSecurity http)，而不是忽略它，尝试permitAll。对于与此类似的用例，我也使用相同的方法。

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .antMatchers("/games/activated").permitAll()
}