java - 'springSecurityFilterChain' 的重复过滤器注册

Question

所以我环顾四周，到处都说我需要检查我的配置，但对我来说没有意义的是我的应用程序将在另一台计算机上运行，​​而不是我用于开发的计算机。只是为了提供一些上下文，这个应用程序纯粹是通过 token 身份验证来实现的。这是我的配置:

安全初始化:

@Order(1)
public class SecurityWebappInitializer extends AbstractSecurityWebApplicationInitializer
{

}

应用初始化:

@Order(2)
public class ApplicationInitializer extends AbstractAnnotationConfigDispatcherServletInitializer
{   
    @Override
    protected Class<?>[] getRootConfigClasses()
    {
        return new Class[]{RootConfiguration.class, SecurityConfig.class};
    }

    @Override
    protected Class<?>[] getServletConfigClasses()
    {
        return new Class<?>[]{WebConfiguration.class};
    }

    @Override
    protected String[] getServletMappings()
    {
        return new String[]{"/", "/rest/*"};
    }


    @Override
    protected Filter[] getServletFilters()
    {
        CharacterEncodingFilter characterEncodingFilter = new CharacterEncodingFilter();
        characterEncodingFilter.setEncoding("UTF-8");
        return new Filter[] {characterEncodingFilter};
    }
}

安全配置:

@EnableWebSecurity
@EnableGlobalMethodSecurity(jsr250Enabled=true)
public class SecurityConfig extends WebSecurityConfigurerAdapter
{       
    @Autowired
    private NoOpAuthProvider noOpAuthenticationProvider;

    @Autowired
    private TokenFilter tokenFilter;

    public SecurityConfig()
    {
        super(true);
    } 

    @Override
    public void configure(WebSecurity web) throws Exception
    {
        web
        .ignoring()
        .antMatchers("/rest/authentication/login")
        .antMatchers("/services/**")
        .antMatchers("/resources/**");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        http
        .authorizeRequests()
        .antMatchers("**").hasRole("RUN").and()
        .addFilterAfter(tokenFilter, UsernamePasswordAuthenticationFilter.class)
        .exceptionHandling().and()
        .logout();
    }

    @Bean
    public AuthenticationManager authenticationManager() throws Exception
    {
        List<AuthenticationProvider> authenticationProviders = new ArrayList<AuthenticationProvider>();
        authenticationProviders.add(noOpAuthenticationProvider);
        return new ProviderManager(authenticationProviders);
    }
}

网络配置:

@Configuration
@EnableWebMvc
@ComponentScan(basePackages = "com.example.tinker.web")
public class WebConfiguration extends WebMvcConfigurerAdapter
{
    @Autowired
    private PrincipalRetrievalService principalRetrievalService;

    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry)
    {
        registry.addResourceHandler("/resources/**").addResourceLocations("resources/").setCachePeriod(31556926);
        registry.setOrder(Ordered.HIGHEST_PRECEDENCE);
    }

    @Override
    public void addArgumentResolvers(List<HandlerMethodArgumentResolver> argumentResolvers)
    {
        argumentResolvers.add(new WebArgumentResolver(principalRetrievalService));
        super.addArgumentResolvers(argumentResolvers);
    }
}

知道什么会导致我的问题吗？

Answer 1

无需实现 AbstractSecurityWebApplicationInitializer。安全性通过 ApplicationInitializer/RootConfiguration/@ComponentScan/SecurityConfig 进行初始化。此外，无需在 getRootConfigClasses 中添加 SecurityConfig。