java - 将 Spring Security(双向 SSL)配置为仅在 CORS 预检选项请求上不需要身份验证

Question

我一直在寻找为什么跨域请求只在 Firefox 中失败的原因。事实证明，Firefox 不会在跨源 XHR 上发送 SSL/TLS 凭证，这显然是由 W3 CORS Spec 定义的。 。我能够大部分通过向客户端代码中的 XHR 实例添加 withCredentials: true 来解决此问题(它适用于 GET、PUT、POST、DELETE 等) .

但是，尽管我在 XHR 中明确告知，Firefox 仍然拒绝向飞行前 OPTIONS 请求添加凭据。除非有某种方法可以在客户端代码中执行此操作，否则我只能将服务器配置为允许未经身份验证的 OPTIONS 请求(在 2 路 SSL 配置中，这对我来说似乎很疯狂)。这里有安全隐患吗？

我们的服务器是一个使用 Spring Security 的 Spring Boot 项目，并配置为使用 X509 安全证书的 2 路 SSL。我将提供所有相关代码，让您了解如何配置应用程序。

主类:

@EnableAutoConfiguration
@SpringBootApplication
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class OurApp extends WebSecurityConfigurerAdapter {

    @Autowired
    OurUserDetailsService ourUserDetailsService;

    public static void main(String[] args) throws Exception {
        ConfigurableApplicationContext ctx = SpringApplication.run(OurApp.class, args);
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
      web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // X509Configurer<HttpSecurity> x509Configurer = http.authorizeRequests().anyRequest().authenticated().and().x509();

        http.authorizeRequests().antMatchers(HttpMethod.OPTIONS, "/**").permitAll().
            .anyRequest().authenticated()
            .and()
            .x509().subjectPrincipalRegex("(.*)").authenticationUserDetailsService(ourUserDetailsService)
            .and()
            .cors()
            .and()
            .csrf().disable();
    }
}

具有 CORS 设置的配置类:

@Configuration
public class OurConfig {
    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("https://client-origin"));
        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"));
        configuration.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type", "Access-Control-Allow-Origin",
            "Access-Control-Allow-Headers", "X-Requested-With", "requestId", "Correlation-Id"));
        configuration.setAllowCredentials(true);
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }

    @Bean
    public IgnoredRequestCustomizer optionsIgnoredRequestsCustomizer() {
      return configurer -> {
        List<RequestMatcher> matchers = new ArrayList<>();
        matchers.add(new AntPathRequestMatcher("/**", "OPTIONS"));
        configurer.requestMatchers(new OrRequestMatcher(matchers));
      };
    }
}

这适用于所有 GET 请求，以及当我在浏览器中手动执行其他动词的请求时——除了 OPTIONS。预检请求在 TLS 握手期间继续失败，并被 Firefox 中止。我很困惑，是否有可能通过(双向 SSL)HTTPS 发送未经身份验证(无凭据)的请求？

如何配置 Spring Security 或 Spring Boot 以允许使用启用双向 SSL(通过 HTTPS)的配置进行未经身份验证的 OPTIONS 请求？

Answer 1

预检请求应排除凭据，请参阅 CORS specification :

7.1.5 Cross-Origin Request with Preflight

To protect resources against cross-origin requests that could not originate from certain user agents before this specification existed a preflight request is made to ensure that the resource is aware of this specification. The result of this request is stored in a preflight result cache.

The steps below describe what user agents must do for a cross-origin request with preflight. This is a request to a non same-origin URL that first needs to be authorized using either a preflight result cache entry or a preflight request.

[...]

• Exclude user credentials.

要处理没有凭据(SSL 客户端证书)的预检请求，您必须更改服务器的 SSL 配置。

例如，请参阅 Spring Boot Reference Guide :

server.ssl.client-auth= # Whether client authentication is wanted ("want") or needed ("need"). Requires a trust store.