java - Spring Boot 安全性无法正常工作

Question

我正在创建一个包含许多微服务的 Spring Boot 项目。我的项目由 Api 网关 (Zuul)、发现服务 (Eureka) 和其他两个微服务(用户和帐户)组成。

在网关服务上，我已经实现了 Spring Boot Security，如下所示:

WebSecurity.java

@Configuration
@EnableWebSecurity
public class WebSecurity extends WebSecurityConfigurerAdapter {

    @Autowired
    Environment environment;

    public WebSecurity(Environment environment) {
        this.environment = environment;
    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();
        http.headers().frameOptions().disable();
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        http.authorizeRequests()
                .antMatchers(HttpMethod.GET,"users-ws/users/status/check").permitAll()
                .antMatchers(HttpMethod.POST,"users-ws/users/h2-console/**").permitAll()
                .antMatchers(HttpMethod.POST,"users-ws/users/createUser").permitAll()
                .antMatchers(HttpMethod.POST,"users-ws/users/login").permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .addFilter(new AuthorizationFilter(authenticationManager(),environment));


    }
}

授权过滤器

public class AuthorizationFilter extends BasicAuthenticationFilter {

Environment environment;
AuthenticationManager authManager;


public AuthorizationFilter(AuthenticationManager authManager,Environment environment) {
    super(authManager);
    this.environment = environment;
}

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
    String authorizationHeader = request.getHeader("Authorization");

    if (authorizationHeader == null || !authorizationHeader.startsWith("Bearer")) {
        chain.doFilter(request,response);
        return;
    }

    UsernamePasswordAuthenticationToken authenticationToken = getAuthentication(request);

    SecurityContextHolder.getContext().setAuthentication(authenticationToken);
    chain.doFilter(request,response);
}

private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
    String authorizationHeader = request.getHeader("Authorization");

    if (authorizationHeader == null) {
        return null;
    }

    String token = authorizationHeader.replace("Bearer","");

    String userId = Jwts.parser()
            .setSigningKey(environment.getProperty("token.secret"))
            .parseClaimsJws(token)
            .getBody()
            .getSubject();

    if (userId == null) {
        return null;
    }

    return new UsernamePasswordAuthenticationToken(userId,null, new ArrayList<>());
}

}

因此，根据此，除了前四个网址之外，所有内容都应该经过身份验证，对吧？

因为现在它在所有网址上都给了我这个，根据我的配置，不需要身份验证

     2019-10-13 15:00:55.214 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/users-ws/users/status/check'; against 'users-ws/users/status/check'
2019-10-13 15:00:55.214 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /users-ws/users/status/check' doesn't match 'POST users-ws/users/h2-console/**'
2019-10-13 15:00:55.214 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /users-ws/users/status/check' doesn't match 'POST users-ws/users/createUser'
2019-10-13 15:00:55.214 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /users-ws/users/status/check' doesn't match 'POST users-ws/users/login'
2019-10-13 15:00:55.214 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /users-ws/users/status/check at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2019-10-13 15:00:55.214 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /users-ws/users/status/check at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2019-10-13 15:00:55.214 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /users-ws/users/status/check at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2019-10-13 15:00:55.214 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /users-ws/users/status/check at position 4 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
2019-10-13 15:00:55.214 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/logout', GET]
2019-10-13 15:00:55.214 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/users-ws/users/status/check'; against '/logout'
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/logout', POST]
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /users-ws/users/status/check' doesn't match 'POST /logout'
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/logout', PUT]
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /users-ws/users/status/check' doesn't match 'PUT /logout'
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/logout', DELETE]
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /users-ws/users/status/check' doesn't match 'DELETE /logout'
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.web.util.matcher.OrRequestMatcher  : No matches found
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /users-ws/users/status/check at position 5 of 11 in additional filter chain; firing Filter: 'AuthorizationFilter'
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /users-ws/users/status/check at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /users-ws/users/status/check at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /users-ws/users/status/check at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.a.AnonymousAuthenticationFilter  : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@6910dd88: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /users-ws/users/status/check at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /users-ws/users/status/check at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /users-ws/users/status/check at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.a.i.FilterSecurityInterceptor    : Secure object: FilterInvocation: URL: /users-ws/users/status/check; Attributes: [authenticated]
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.a.i.FilterSecurityInterceptor    : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@6910dd88: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
2019-10-13 15:00:55.215 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.access.vote.AffirmativeBased       : Voter: org.springframework.security.web.access.expression.WebExpressionVoter@603b97b3, returned: -1
2019-10-13 15:00:55.216 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.a.ExceptionTranslationFilter     : Access is denied (user is anonymous); redirecting to authentication entry point

org.springframework.security.access.AccessDeniedException: Access is denied
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124) ~[spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) ~[spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119) ~[spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at com.example.apigatewayservice.apigatewayservice.security.AuthorizationFilter.doFilterInternal(AuthorizationFilter.java:33) [classes/:na]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:74) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:94) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:114) [spring-boot-actuator-2.1.9.RELEASE.jar:2.1.9.RELEASE]
    at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:104) [spring-boot-actuator-2.1.9.RELEASE.jar:2.1.9.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:526) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1589) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_131]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_131]
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-9.0.26.jar:9.0.26]
    at java.lang.Thread.run(Thread.java:748) [na:1.8.0_131]

2019-10-13 15:00:55.217 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.a.ExceptionTranslationFilter     : Calling Authentication entry point.
2019-10-13 15:00:55.217 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.a.Http403ForbiddenEntryPoint     : Pre-authenticated entry point called. Rejecting access
2019-10-13 15:00:55.217 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.header.writers.HstsHeaderWriter  : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@46c5ddf9
2019-10-13 15:00:55.217 DEBUG 34683 --- [nio-8011-exec-6] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
2019-10-13 15:00:55.217 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/error'; against 'users-ws/users/status/check'
2019-10-13 15:00:55.217 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /error' doesn't match 'POST users-ws/users/h2-console/**'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /error' doesn't match 'POST users-ws/users/createUser'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /error' doesn't match 'POST users-ws/users/login'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /error at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /error at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /error at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /error at position 4 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/logout', GET]
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/error'; against '/logout'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/logout', POST]
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /error' doesn't match 'POST /logout'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/logout', PUT]
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /error' doesn't match 'PUT /logout'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/logout', DELETE]
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /error' doesn't match 'DELETE /logout'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.web.util.matcher.OrRequestMatcher  : No matches found
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /error at position 5 of 11 in additional filter chain; firing Filter: 'AuthorizationFilter'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /error at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /error at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /error at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.a.AnonymousAuthenticationFilter  : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@6910dd88: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /error at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /error at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
2019-10-13 15:00:55.218 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /error at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
2019-10-13 15:00:55.219 DEBUG 34683 --- [nio-8011-exec-6] o.s.security.web.FilterChainProxy        : /error reached end of additional filter chain; proceeding with original chain
2019-10-13 15:00:55.222 DEBUG 34683 --- [nio-8011-exec-6] o.s.s.w.a.ExceptionTranslationFilter     : Chain processed normally
2019-10-13 15:00:55.222 DEBUG 34683 --- [nio-8011-exec-6] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
2019-10-13 15:00:55.895  INFO 34683 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient    : Disable delta property : false
2019-10-13 15:00:55.895  INFO 34683 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient    : Single vip registry refresh property : null
2019-10-13 15:00:55.895  INFO 34683 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient    : Force full registry fetch : false
2019-10-13 15:00:55.895  INFO 34683 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient    : Application is null : false
2019-10-13 15:00:55.895  INFO 34683 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient    : Registered Applications size is zero : true
2019-10-13 15:00:55.895  INFO 34683 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient    : Application version is -1: false
2019-10-13 15:00:55.895  INFO 34683 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient    : Getting all instance registry info from the eureka server
2019-10-13 15:00:55.916  INFO 34683 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient    : The response status is 200

Answer 1

您可以在 configure(WebSecurity web) 中添加端点，无需对用户进行身份验证。

@Override
    public void configure(WebSecurity web) throws Exception {
        web
          .ignoring()
          .antMatchers(HttpMethod.GET,"users-ws/users/status/check")
          .antMatchers(HttpMethod.POST,"users-ws/users/h2-console/**")
          .antMatchers(HttpMethod.POST,"users-ws/users/createUser")
          .antMatchers(HttpMethod.POST,"users-ws/users/login");

        //completely bypass the Spring Security Filter Chain.
    }

WebSecurity.java

@Configuration
@EnableWebSecurity
public class WebSecurity extends WebSecurityConfigurerAdapter {

    @Autowired
    Environment environment;

    public WebSecurity(Environment environment) {
        this.environment = environment;
    }

    @Override
        public void configure(WebSecurity web) throws Exception {
            web
              .ignoring()
              .antMatchers(HttpMethod.GET,"users-ws/users/status/check")
              .antMatchers(HttpMethod.POST,"users-ws/users/h2-console/**")
              .antMatchers(HttpMethod.POST,"users-ws/users/createUser")
              .antMatchers(HttpMethod.POST,"users-ws/users/login");

            //completely bypass the Spring Security Filter Chain.
        }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();
        http.headers().frameOptions().disable();
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        http.authorizeRequests()
                .anyRequest()
                .authenticated()
                .and()
                .addFilter(new AuthorizationFilter(authenticationManager(),environment));
    }
}