java - Spring Security 允许具有相同后缀的路径

Question

在我的 JWT 身份验证 API 中，我希望无需任何身份验证即可访问这些路径，并且禁止/禁用所有其他端点:

• 获取/apis/id/{id}
• POST/api
• 补丁/apis/id/{id}
• 删除/apis/id/{id}
• 获取/swagger-ui.html

正如您所看到的，上述大多数端点都以 /apis/id 开头，POST 有 /apis。这是我的配置:

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {


    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity.authorizeRequests()
           .mvcMatchers(HttpMethod.GET,"/apis/id/**").permitAll()
           .mvcMatchers(HttpMethod.PATCH,"/apis/id/**").permitAll()
           .mvcMatchers(HttpMethod.DELETE,"/apis/id/**").permitAll()
           .mvcMatchers(HttpMethod.POST,"/apis", "/apis/").permitAll()
           .antMatchers(HttpMethod.GET,"/csrf","/v2/api-docs","/swagger-resources/configuration/ui",  "/configuration/ui", "/swagger-resources", "/configuration/security", "/swagger-ui.html", "/webjars/**","/swagger-resources/configuration/ui","/swagger-resources/configuration/security", "/configuration/security").permitAll()// for Swagger UI
        .anyRequest().denyAll();
    }
}

仅 GET /apis/id/{id} 和 /swagger-ui.html 可以通过。具有相同配置(POST 除外)的其他端点均被拒绝 (403)。我添加了一个异常处理程序并打印出 AuthenticationException 消息，它显示:

Full authentication is required to access this resource path

如何公开这些端点？我感觉我缺少一些配置。

我正在使用的框架:

• Spring Boot 版本 2.0.4
• Spring 安全版本 5.1.0

Answer 1

您可以看看this answer对于您的问题的可能解释。

Invoking antMatcher(String) will override previous invocations of mvcMatcher(String), requestMatchers(), antMatcher(String), regexMatcher(String), and requestMatcher(RequestMatcher).

既然您了解了根本问题，您现在可以将代码更改为如下所示:

http
    .requestMatchers()
        .antMatchers("/apis/id/**", "/csrf","/v2/api-docs","/swagger-resources/configuration/ui",  "/configuration/ui", "/swagger-resources", "/configuration/security", "/swagger-ui.html", "/webjars/**","/swagger-resources/configuration/ui","/swagger-resources/configuration/security", "/configuration/security").permitAll()
        .anyRequest().authenticated();