java - Spring Security，安全和非安全访问

Question

我正在做一个需要先登录的小应用程序。但是对于某些第 3 方工具，我想提供一个不需要登录的 API。登录本身工作正常，API 本身工作，但我不知道如何告诉 Spring Security，API 可以在不需要身份验证的情况下访问。我在这里和其他网站上检查了几个主题并尝试了不同的版本，但都没有用。每次我尝试访问 API 时，我都会被转到登录表单并且必须先登录。

到目前为止，我的代码在我的 Spring Security 配置中看起来像这样:

/**
 * configuration of spring security, defining access to the website
 * 
 * @param http
 * @throws Exception 
 */
@Override
protected void configure(HttpSecurity http) throws Exception {        
    http.authorizeRequests()                
            .antMatchers("/rest/open**").permitAll()
            .antMatchers("/login**").permitAll()
            .and()
        .authorizeRequests()
            .anyRequest()
            .authenticated()
            .and()
        .formLogin()
            .loginPage("/login")
            .failureUrl("/login?error")
            .defaultSuccessUrl("/dashboard")
            .loginProcessingUrl("/j_spring_security_check")
            .usernameParameter("username")
            .passwordParameter("password")
            .and()
        .logout()
            .logoutUrl("/j_spring_security_logout")
            .logoutSuccessUrl("/login?logout")
            .and()
        .csrf();
}

还有我的 Controller :

import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class PredictionOpenRestController {

    @RequestMapping("/rest/open/prediction")
    public String getPrediction() {
        return "First Try!";
    }
}

不知何故，我总觉得错过了什么。

Answer 1

参见 Spring Security Reference :

Our examples have only required users to be authenticated and have done so for every URL in our application. We can specify custom requirements for our URLs by adding multiple children to our http.authorizeRequests() method. For example:

protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()                                                                
            .antMatchers("/resources/**", "/signup", "/about").permitAll()
            .antMatchers("/admin/**").hasRole("ADMIN")
            .antMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')")  
            .anyRequest().authenticated()
            .and()
        // ...
        .formLogin();
}

1 There are multiple children to the http.authorizeRequests() method each matcher is considered in the order they were declared.

2 We specified multiple URL patterns that any user can access. Specifically, any user can access a request if the URL starts with "/resources/", equals "/signup", or equals "/about".

3 Any URL that starts with "/admin/" will be resticted to users who have the role "ROLE_ADMIN". You will notice that since we are invoking the hasRole method we do not need to specify the "ROLE_" prefix.

4 Any URL that starts with "/db/" requires the user to have both "ROLE_ADMIN" and "ROLE_DBA". You will notice that since we are using the hasRole expression we do not need to specify the "ROLE_" prefix.

5 Any URL that has not already been matched on only requires that the user be authenticated

第二次使用 .authorizeRequests() 会覆盖第一次。

另见 AntPathMatcher :

The mapping matches URLs using the following rules:

? matches one character

* matches zero or more characters

** matches zero or more directories in a path

Examples

com/t?st.jsp — matches com/test.jsp but also com/tast.jsp or com/txst.jsp

com/*.jsp — matches all .jsp files in the com directory

com/**/test.jsp — matches all test.jsp files underneath the com path

org/springframework/**/*.jsp — matches all .jsp files underneath the org/springframework path

org/**/servlet/bla.jsp — matches org/springframework/servlet/bla.jsp but also org/springframework/testing/servlet/bla.jsp and org/servlet/bla.jsp

您修改后的代码:

protected void configure(HttpSecurity http) throws Exception {        
    http.authorizeRequests()                
            .antMatchers("/rest/open/**").permitAll()
            .antMatchers("/login/**").permitAll()
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login")
            .failureUrl("/login?error")
            .defaultSuccessUrl("/dashboard")
            .loginProcessingUrl("/j_spring_security_check")
            .usernameParameter("username")
            .passwordParameter("password")
            .and()
        .logout()
            .logoutUrl("/j_spring_security_logout")
            .logoutSuccessUrl("/login?logout")
            .and()
        .csrf();
}