spring-security - 如何解决Spring安全配置错误: incorrect request matcher type?

Question

我有这个 Spring 安全配置:

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
       xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
  http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
  http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.1.xsd ">

    <http pattern="/api/swagger-ui.html" security="none" xmlns="http://www.springframework.org/schema/security"/>
    <http pattern="/api/webjars/**" security="none" xmlns="http://www.springframework.org/schema/security"/>
    <http pattern="/api/swagger-resources/**" security="none" xmlns="http://www.springframework.org/schema/security"/>
    <http pattern="/api/v2/api-docs" security="none" xmlns="http://www.springframework.org/schema/security"/>

   <http pattern="/api/**" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint"
         access-decision-manager-ref="accessDecisionManager" xmlns="http://www.springframework.org/schema/security">
     <anonymous enabled="false"/>
        <intercept-url pattern="/api/**" access="IS_AUTHENTICATED_FULLY"/>
        <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER"/>
        <access-denied-handler ref="oauthAccessDeniedHandler"/>
    </http>

    <bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
          xmlns="http://www.springframework.org/schema/beans">
        <constructor-arg>
            <list>
                <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter"/>
                <bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
            </list>
        </constructor-arg>
    </bean>

    <bean id="oauthAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
        <property name="realmName" value="sample"/>
    </bean>

    <bean id="oauthAccessDeniedHandler"
          class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/>


    <oauth:resource-server id="resourceServerFilter" resource-id="sample" token-services-ref="remoteTokenServices"/>

    <bean id="remoteTokenServices" class="org.springframework.security.oauth2.provider.token.RemoteTokenServices">
        <property name="checkTokenEndpointUrl" value="${oauth.check.token.url}"/>
        <property name="clientId" value="${oauth.client:crdb}"/>
        <property name="clientSecret" value="${oauth.secret:secret}"/>
    </bean>

    <authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
    </authentication-manager>


    <oauth:expression-handler id="oauthExpressionHandler"/>
    <oauth:web-expression-handler id="oauthWebExpressionHandler"/>
</beans>

Fortify 返回给我 Spring security misconfiguration: wrong request matcher type on line 9, 10, 11, 15. 有人可以告诉我如何解决这个问题吗？好像有一些路径问题，但我对fortify不太熟悉，所以我不知道如何解决这个问题。

Answer 1

您似乎在使用 <http/> 时遇到问题用于配置的标签。仔细查看您是否使用了与该标签相关的有效属性。您可以通过单击标签来简单地识别可用的属性/属性。
好像xmlns="http://www.springframework.org/schema/security"这是错误，因为 <http>没有xmlns属性(property)。
您也不需要在每个 http 中定义它.
尝试删除 xmlns属性(property)来自 <http>标签，它应该可以工作。
供引用:Spring Security XML Configuration
可用 <http>配置属性:

<http pattern=""
    name=""
    access-decision-manager-ref=""
    authentication-manager-ref=""
    auto-config=""
    create-session=""
    disable-url-rewriting=""
    entry-point-ref=""
    jaas-api-provision=""
    once-per-request=""
    realm=""
    request-matcher=""
    request-matcher-ref=""
    security=""
    security-context-repository-ref=""
    servlet-api-provision=""
    use-expressions=""/>