java - BasicAuth 与其余 Controller - 拒绝访问

Question

我正在尝试为我的新手项目实现基本身份验证(来自 Spring Security)。为了创建用户，我将 JSON 发送到 /register 处的 POST，然后创建用户并将其放入 H2 内存数据库中 - 这部分工作正常。然后我的 Controller 中有这个方法:

@RequestMapping(value = "/username", method = RequestMethod.GET)
public String currentUserName(Principal principal) {
    return principal.getName();
}

返回登录者的姓名。我正在使用 Postman 来完成此操作 - 只需从下拉列表中选择基本身份验证，输入此创建用户的用户名和密码(它在数据库中，我检查过)，然后我得到“访问被拒绝”响应 - 所以我想我没有登录正确还是我的 Spring 配置不正确？

我正在使用 Spring Boot 并有 3 个 Spring Security 配置:

UserAuthService.java

@Service
@Transactional
public class UserAuthService implements UserDetailsService {

    private UserRepository userRepository;

    @Autowired
    public UserAuthService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);

        if (user == null) {
            throw new UsernameNotFoundException("Could not find the user: " + username); 
        }

        return new org.springframework.security.core.userdetails.User(
            user.getUsername(),
            user.getPassword(),
            true,
            true,
            true,
            true,
            AuthorityUtils.createAuthorityList("USER"));
    }
}

AccountConfiguration.java

// Spring Security uses accounts from our database
@Configuration
public class AccountConfiguration extends GlobalAuthenticationConfigurerAdapter {


    private UserDetailsService userAuthService;

    @Autowired
    public AccountConfiguration(UserDetailsService userAuthService) {
        this.userAuthService = userAuthService;
    }

    @Override
    public void init(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userAuthService);
    }
}

最后一个选择什么是授权的，什么是不授权的:

WebConfiguration.java

@EnableWebSecurity
@Configuration
public class WebConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // allow everyone to register an account; /console is just for testing
        http
            .authorizeRequests()
                .antMatchers("/register", "/console/**").permitAll();

        http
            .authorizeRequests()
                .anyRequest().fullyAuthenticated();

        // making H2 console working
        http
            .headers()
                .frameOptions().disable();

        /*
        https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html#when-to-use-csrf-protection
        for non-browser APIs there is no need to use csrf protection
        */
        http
            .csrf().disable();
    }
}

如果有人想检查其他配置，这里是 GitHub 项目的链接 - 我对此很陌生，所以也许我没有在这篇文章中添加相关内容: https://github.com/doublemc/ToDoWebApp

Answer 1

您必须在 Spring Security 配置中配置 HTTP 基本身份验证，请参阅 Spring Security Reference :

5.2 HttpSecurity

Thus far our WebSecurityConfig only contains information about how to authenticate our users. How does Spring Security know that we want to require all users to be authenticated? How does Spring Security know we want to support form based authentication? The reason for this is that the WebSecurityConfigurerAdapter provides a default configuration in the configure(HttpSecurity http) method that looks like:

protected void configure(HttpSecurity http) throws Exception {
  http
      .authorizeRequests()
          .anyRequest().authenticated()
          .and()
      .formLogin()
          .and()
      .httpBasic();
}

The default configuration above:

• Ensures that any request to our application requires the user to be authenticated
• Allows users to authenticate with form based login
• Allows users to authenticate with HTTP Basic authentication

您修改(和简化)的代码:

@EnableWebSecurity
@Configuration
public class WebConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
            .authorizeRequests()
                .antMatchers("/register", "/console/**").permitAll();
                .anyRequest().authenticated()
                .and()
            .headers()
                .frameOptions().disable()
                .and()
            .csrf().disable();
    }
}