spring - 匹配任何路径开头的 antMatchers

Question

我有将用于身份验证的 REST 服务。身份验证端点将类似于 /api/v.1/authentication . API 版本是一个可以更改以反射(reflect)更新版本的变量。一个例子是 /api/v.2/authentication .我喜欢有一个 antMatcher可以处理这两种情况，所以我尝试了 .antMatchers(HttpMethod.POST,"**/authenticate").permitAll()使用 **匹配端点的任何开头，但这不起作用。完整设置如下。

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
        .csrf().disable()
        .authorizeRequests()
             .antMatchers(HttpMethod.POST, "**/authenticate").permitAll()
             .antMatchers(HttpMethod.GET, "**/get-public-key").permitAll()
             .and()
        .authorizeRequests()
             .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
             .anyRequest().authenticated();
}

任何建议我如何解决这个问题？

Answer 1

你必须使用绝对模式，见 AntPathMatcher :

Note: a pattern and a path must both be absolute or must both be relative in order for the two to match. Therefore it is recommended that users of this implementation to sanitize patterns in order to prefix them with "/" as it makes sense in the context in which they're used.

您修改和简化的配置:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
        .csrf().disable()
        .authorizeRequests()
            .antMatchers(HttpMethod.POST, "/**/authenticate").permitAll()
            .antMatchers(HttpMethod.GET, "/**/get-public-key").permitAll()
            .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
            .anyRequest().authenticated();
}