java - Spring 安全 AngularJS 禁止 403

Question

我正在尝试将 Spring Security 添加到 AngularJS 应用程序中。我正在遵循有关使用 Spring Security 保护单页应用程序的教程:

https://spring.io/blog/2015/01/12/the-login-page-angular-js-and-spring-security-part-ii

不同之处在于我没有使用 spring boot 而是使用 spring mvc 来实现此目的。我想我添加了我需要的一切，但由于某种原因，在输入 inMemory 凭据后，我收到 403 禁止。

这是我的 Spring 安全配置:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    System.out.println("initTT");
    auth
        .inMemoryAuthentication()
            .withUser("user").password("password").roles("USER");
}

@Override
protected void configure(HttpSecurity http) throws Exception {

  http
    .httpBasic()
  .and()
    .authorizeRequests()
      .antMatchers("/user").hasRole("USER")
      .anyRequest().authenticated()
   .and()
   .csrf().disable();
}


 @Override
  public void configure(WebSecurity web) throws Exception {
    web
      .ignoring()
         .antMatchers("/app/**"); 
  }

private CsrfTokenRepository csrfTokenRepository() {
      HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
      repository.setHeaderName("X-XSRF-TOKEN");
      return repository;
    }

}

我使用了教程中的 authenicate() 函数并将其添加到我的 app.js 文件中:

coursesApp.controller('loginController', function($rootScope, $scope, $http, $location) {


      var authenticate = function(credentials, callback) {
        var headers = credentials ? {authorization : "Basic "
            + btoa(credentials.username + ":" + credentials.password)
        } : {};


       console.log(headers);
        $http.get('/basic-web-app/user', {headers : headers}).success(function(data) {
          if (data.name) {
            $rootScope.authenticated = true;
          } else {
            $rootScope.authenticated = false;
          }
          callback && callback();
        }).error(function() {
          $rootScope.authenticated = false;
          callback && callback();
        });

      }

      authenticate();
      $scope.credentials = {};
      $scope.login = function() {
          console.log("login clicked!!!!!!!");
          authenticate($scope.credentials, function() {
            if ($rootScope.authenticated) {
              console.log("authenticated");
              $location.path("/");
              $scope.error = false;
            } else {
              console.log("not authenticated");
              $location.path("/login");
              $scope.error = true;
            }
          });
      };
    });

我有 UserController 和 /用户端点如教程中所述。我正在用这个扫描包裹

 <context:component-scan base-package="com.courses.portal.controllers"/>

我还附上了 chrome 控制台的屏幕截图，以便清楚地表明我在做什么:

web.xml 文件:

<web-app xmlns="http://java.sun.com/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="
        http://java.sun.com/xml/ns/javaee
        http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
         version="3.0">

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring/business-config.xml</param-value>
    </context-param>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>


    <servlet>
        <servlet-name>mvc-dispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    </servlet>

    <servlet-mapping>
        <servlet-name>mvc-dispatcher</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

</web-app>

mvc-dispatcher-servlet.xml

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:mvc="http://www.springframework.org/schema/mvc"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"
       xsi:schemaLocation="
        http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/mvc
        http://www.springframework.org/schema/mvc/spring-mvc.xsd
        http://www.springframework.org/schema/context
        http://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">
    <context:component-scan base-package="com.courses.portal.controllers"/>

    <mvc:resources mapping="/app/**" location="/app/build/"/>

    <mvc:annotation-driven/>

    <bean id="jspViewResolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver">
        <property name="prefix" value="/WEB-INF/jsp/"/>
        <property name="suffix" value=".jsp"/>
    </bean>

    <security:global-method-security pre-post-annotations="enabled">
        <security:protect-pointcut expression="execution(* com.courses.portal.controllers.*.*(..))"
                                   access="ROLE_USER"/>
    </security:global-method-security>


</beans>

很抱歉，如果这是一个常见问题，但我在发布之前尝试在网络上找到任何有用的内容。谢谢!

Answer 1

我的猜测(你还没有真正发布所有代码)是/basic-web-app 是一个上下文根，它是一个 servlet API 构造 - 如果你要创建绝对路径，你在客户端中需要它，但是它不知道 servlet，但是 Spring Security 是基于 servlet 的，因此它不需要前缀(我注意到您从静态资源的 /app/** 配置中删除了该前缀)。尝试从安全配置路径中删除前缀。