spring 配置服务器加密禁止

Question

我已经配置了一个 spring cloud config server使用 oAuth2 来保证安全。除了加密端点外，一切都运行良好。当我尝试访问 /encrypt我得到一个 403 Forbidden。我在标题中包含了 Authorization Bearer token 。有没有办法允许在使用 oAuth 保护服务器时调用加密端点，或者它总是被阻止？如果您想查看此服务器的任何配置文件，请告诉我。
仅供引用，以下是有效的方法。

调用 /encrypt/status生产 {"status":"OK"}

git 存储库正在被拉取，因为我可以从服务器访问属性文件。

oAuth 身份验证正在与 Google 合作，因为它会引导我完成登录过程。
这是 spring 安全设置。

    security:      require-ssl: true      auth2:         client:           clientId: PROVIDED BY GOOGLE           clientSecret: PROVIDED BY GOOGLE           accessTokenUri: https://www.googleapis.com/oauth2/v4/token           userAuthorizationUri: https://accounts.google.com/o/oauth2/v2/auth           scope:              - openid              - email              - profile        resource:           userInfoUri: https://www.googleapis.com/oauth2/v3/userinfo           preferTokenInfo: true             server:         port: 8443         ssl:           key-store-type: PKCS12           key-store: /spring-config-server/host/tomcat-keystore.p12           key-alias: tomcat           key-store-password: ${KEYSTORE_PASSWORD}

Here are my dependencies from the POM file so you can see the version of the libraries I'm using.

<parent>  
    <groupId>org.springframework.boot</groupId>  
    <artifactId>spring-boot-starter-parent</artifactId>  
    <version>2.0.0.RELEASE</version>  
    <relativePath/>  
    <!-- lookup parent from repository -->  
</parent>  
<properties>  
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>  
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>  
    <java.version>1.8</java.version>  
    <spring-cloud.version>Finchley.M8</spring-cloud.version>  
</properties>  
<dependencies>  
    <dependency>  
        <groupId>org.springframework.cloud</groupId>  
        <artifactId>spring-cloud-config-server</artifactId>  
    </dependency>  
    <dependency>  
        <groupId>org.springframework.boot</groupId>  
        <artifactId>spring-boot-starter-test</artifactId>  
    </dependency>  
    <dependency>  
        <groupId>org.springframework.cloud</groupId>  
        <artifactId>spring-cloud-security</artifactId>  
    </dependency>  
</dependencies>  
<dependencyManagement>  
    <dependencies>  
        <dependency>  
            <groupId>org.springframework.cloud</groupId>  
            <artifactId>spring-cloud-dependencies</artifactId>  
            <version>${spring-cloud.version}</version>  
            <type>pom</type>  
            <scope>import</scope>  
        </dependency>  
    </dependencies>  
</dependencyManagement>  

Answer 1

我解决了它实现这个 WebSecurityConfigurer。它禁用 CSRF 并设置基本身份验证。在 Spring Boot 2.0.0 中，您无法使用属性禁用 CSRF，它会强制您实现 java 安全配置 bean。

package my.package.config.server;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
@EnableWebSecurity
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests()
        .anyRequest().authenticated().and()
        .httpBasic();
;
    }


}

希望能帮助到你