java - Controller 请求在 https 和 http 上工作正常。它应该只适用于 https

Question

我有一个关于来自 spring boot 应用程序的 Controller 请求的问题。

我已经制作了证书以便在 https 上运行该应用程序。证书工作正常，有效。

我的主要问题是当我通过 postman 从 Controller 测试我的方法时，它们(url 请求)在 https 和 http 上工作正常...它不应该在 http 上工作。有人可以帮忙吗？

这是我的 WebSecurityConfig 类:

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    public static final String AUTHENTICATED_HEADER_NAME = "Authenticated";
    public static final String AUTHENTICATED_TRUE = "true";
    public static final String AUTHENTICATED_FALSE = "false";

    @Autowired
    public void globalUserDetails(final AuthenticationManagerBuilder auth) throws Exception {
        PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();

        auth.userDetailsService(authenticationManager).passwordEncoder(passwordEncoder);
    }


    @Override
    @Bean(value = "authenticationManagerBean")
    public org.springframework.security.authentication.AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Configuration
    @Order(1)
    public static class HTTPBasicSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {

        //todo check how we can change the root url of swagger
        @Override
        public void configure(WebSecurity web) throws Exception {
            web.ignoring().antMatchers("/documentation**", "/configuration/**", "/v2/api-docs**", "/swagger-ui.html", "/webjars/**", "/swagger-resources/**");
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            //todo http basic allows access to all urls after login
            http
                    .httpBasic()
                    .and()
                    .csrf().disable()
                    .antMatcher("/api/**")
                    .authorizeRequests()
                    .antMatchers("/login").permitAll()
                    .anyRequest()
                    .authenticated();

        }
    }

    @Configuration
    @Order(2)
    public static class FormLoginSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf()
                    //todo more investigation is required to check if it is safe to ignore csrf for login
                    .ignoringAntMatchers("/login")
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                    .and()
                    .authorizeRequests()
                    .antMatchers("/login").permitAll()
                    .anyRequest().authenticated()
                    .and()
                    .formLogin()
                    .permitAll()
                    .successHandler((httpServletRequest, httpServletResponse, authentication) -> {
                        httpServletResponse.setHeader(AUTHENTICATED_HEADER_NAME, AUTHENTICATED_TRUE);
                    })
                    .failureHandler((httpServletRequest, httpServletResponse, e) -> {
                        httpServletResponse.setHeader(AUTHENTICATED_HEADER_NAME, AUTHENTICATED_FALSE);
                        httpServletResponse.setStatus(SC_UNAUTHORIZED);
                    })
                    .and()
                    .logout().permitAll()
                    .and()
                    .addFilterBefore(new CorsFilter(), ChannelProcessingFilter.class)
                    .addFilterBefore(new CsrfHeaderFilter(), CsrfFilter.class);
            http.exceptionHandling().authenticationEntryPoint((HttpServletRequest request, HttpServletResponse response,
                                                               AuthenticationException authException) -> {
                if (authException != null) {
                    response.setStatus(SC_UNAUTHORIZED);
                }
            });
        }
    }

    @Configuration
    @Order(3)
    public static class TestClass extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {

            http.headers()
                    .httpStrictTransportSecurity()
                    .includeSubDomains(true)
                    .maxAgeInSeconds(31536000);
        }
    }
}

这是我的spring boot版本

<parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>1.4.2.RELEASE</version>
        <relativePath></relativePath>
</parent>

Answer 1

你的问题涉及到几个方面:

• 您可以通过添加 security.require_ssl=true 配置属性来要求客户端要求安全通道(参见 the Spring Boot reference documentation about HTTPS )
• 或使用以下配置片段 http.requiresChannel().anyRequest().requiresSecure();
• 你可能还想用 HSTS in Spring Security 来强制执行它