spring-security - Spring 安全(Java 配置): Using antmatchers for same URL with differing HTTP methods

Question

我正在尝试限制一个角色对 URL 的 GET 访问，以及另一个角色对同一 URL 的 POST 访问，如下所示。

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("user").password("password").roles("USER").and()
            .withUser("readuser").password("password").roles("USER", "READ").and()
            .withUser("admin").password("password").roles("USER", "READ", "WRITE");
    }

    protected void configure(HttpSecurity http) throws Exception {
        http
            .formLogin().permitAll().and()
            .logout().permitAll().and()
            .authorizeRequests()
                .antMatchers(HttpMethod.GET, "/api/foo").hasRole("READ")
                .antMatchers(HttpMethod.POST, "/api/foo").hasRole("WRITE")
                .anyRequest().authenticated()
                .and().csrf().disable()
            .httpBasic();

当我尝试使用我的 readuser 帐户执行 GET(或 POST)操作时，我收到拒绝访问错误；但是当我尝试使用管理员帐户时，两者都可以。

但是，当我删除 .antMatchers(HttpMethod.POST, "/api/foo").hasRole("WRITE") 行时，我的 readuser 帐户可以正确地点击/api/foo GET 请求。

如何让 Spring Security 允许这两个限制？

更新 - 包括相关的 spring security 调试日志信息

以下是尝试使用 readuser 时的相关日志:

************************************************************

Request received for GET '/api/foo?id=foo':

Request(GET //localhost:8089/api/foo?id=foo)@b4603eb

servletPath:/api/foo
pathInfo:null
headers:
Authorization: Basic cnVudXNlcjpwYXNzd29yZA==
Cookie: JSESSIONID=node0fe3b0i44a5sbpohi6jq6dkkw0.node0
Cache-Control: no-cache
Accept: */*
User-Agent: PostmanRuntime/3.0.11-hotfix.2
Connection: keep-alive
Postman-Token: 99a23213-6cf8-4686-9886-7f9c2de13c6f
Host: localhost:8089
Accept-Encoding: gzip, deflate


Security filter chain: [
  WebAsyncManagerIntegrationFilter
  SecurityContextPersistenceFilter
  HeaderWriterFilter
  LogoutFilter
  UsernamePasswordAuthenticationFilter
  DefaultLoginPageGeneratingFilter
  BasicAuthenticationFilter
  RequestCacheAwareFilter
  SecurityContextHolderAwareRequestFilter
  AnonymousAuthenticationFilter
  SessionManagementFilter
  ExceptionTranslationFilter
  FilterSecurityInterceptor
]


************************************************************
.
.
.
2017-05-08 11:31:27.817 DEBUG 5812 --- [p1731685294-106] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/api/foo'; against 'GET'
2017-05-08 11:31:27.817 DEBUG 5812 --- [p1731685294-106] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/api/foo'; against '/api/foo'
2017-05-08 11:31:27.817 DEBUG 5812 --- [p1731685294-106] o.s.s.w.a.i.FilterSecurityInterceptor    : Secure object: FilterInvocation: URL: /api/foo?id=foo; Attributes: [hasRole('ROLE_WRITE')]
2017-05-08 11:31:27.818 DEBUG 5812 --- [p1731685294-106] o.s.s.w.a.i.FilterSecurityInterceptor    : Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@a38eb23d: Principal: org.springframework.security.core.userdetails.User@5c7268d6: Username: readuser; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_READ,ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_READ, ROLE_USER
2017-05-08 11:31:27.818 DEBUG 5812 --- [p1731685294-106] o.s.s.access.vote.AffirmativeBased       : Voter: org.springframework.security.web.access.expression.WebExpressionVoter@7b20c046, returned: -1
2017-05-08 11:31:27.819 DEBUG 5812 --- [p1731685294-106] o.s.s.w.a.ExceptionTranslationFilter     : Access is denied (user is not anonymous); delegating to AccessDeniedHandler

org.springframework.security.access.AccessDeniedException: Access is denied
.
.
.
2017-05-08 11:31:27.823 DEBUG 5812 --- [p1731685294-106] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed

Answer 1

您使用了错误的 HttpMethod 类。

javax.ws.rs.HttpMethod#GET返回一个 String，因此您使用 antMatchers(String... antPatterns)而不是 antMatchers(HttpMethod method, String... antPatterns)在您的 Spring Security 配置中。

使用该配置，Spring Security 检查 URL 模式 GET 和 /api/foo(均适用于所有 HTTP 方法)，查看您的日志:

2017-05-08 11:31:27.817 DEBUG 5812 --- [p1731685294-106] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/api/foo'; against 'GET' 
2017-05-08 11:31:27.817 DEBUG 5812 --- [p1731685294-106] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/api/foo'; against '/api/foo'

你必须使用 org.springframework.http.HttpMethod#GET , 它返回一个 HttpMethod 对象。