spring-security - Spring Security 响应注册我收到 403 错误

Question

我正在尝试在 Spring Boot 应用程序中配置 Spring Security。另一方面，Angular 正在运行。联系地址时

POST
localhost:15001/auth/api/v1/user/register

我收到错误 403我重读了一堆类似的问题。答案在任何地方都是一样的。通过添加处理错误

http.csrf().disable()

csrf 在我的配置中被禁用，它是写在 SecurityConfig 类中的。

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(
         securedEnabled = true,
         jsr250Enabled = true,
        prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final JwtTokenProvider jwtTokenProvider;

    @Autowired
    public SecurityConfig(JwtTokenProvider jwtTokenProvider) {
        this.jwtTokenProvider = jwtTokenProvider;
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring()
                .antMatchers(
                        "/authentication/api/v1/**",
                        "/auth/api/v1/user/register",
                        "/swagger-ui/**",
                        "/swagger-ui.html");
    }


    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("http://localhost:4200"));
        configuration.setAllowCredentials(true);
        configuration.setAllowedHeaders(Arrays.asList("Access-Control-Allow-Headers", "Access-Control-Allow-Origin", "Access-Control-Request-Method", "Access-Control-Request-Headers", "Origin", "Cache-Control", "Content-Type", "Authorization"));
        configuration.setAllowedMethods(Arrays.asList("DELETE", "GET", "POST", "PATCH", "PUT"));

        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .httpBasic().disable()
                .cors().and().csrf().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .authorizeRequests()
                .antMatchers("/auth/api/v1/user/register").permitAll()
                .anyRequest().authenticated()
                .and()
                .apply(new JwtConfigurer(jwtTokenProvider));
    }
}

还有什么问题？链接到这里的存储库 project

日志文件很大，所以我抛出一个链接 logs

记录 Spring 安全

08-03-2022 18:13:00.323 [http-nio-15001-exec-1] DEBUG org.springframework.security.web.FilterChainProxy.doFilterInternal - Securing OPTIONS /api/v1/user/register
08-03-2022 18:13:00.328 [http-nio-15001-exec-1] DEBUG org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter - Set SecurityContextHolder to empty SecurityContext
08-03-2022 18:13:00.373 [http-nio-15001-exec-1] DEBUG org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter - Cleared SecurityContextHolder to complete request
08-03-2022 18:13:00.373 [http-nio-15001-exec-2] DEBUG org.springframework.security.web.FilterChainProxy.doFilterInternal - Securing POST /api/v1/user/register
08-03-2022 18:13:00.373 [http-nio-15001-exec-2] DEBUG org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter - Set SecurityContextHolder to empty SecurityContext
08-03-2022 18:13:00.389 [http-nio-15001-exec-2] DEBUG org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter - Set SecurityContextHolder to anonymous SecurityContext
08-03-2022 18:13:00.389 [http-nio-15001-exec-2] DEBUG org.springframework.security.web.access.intercept.FilterSecurityInterceptor.attemptAuthorization - Failed to authorize filter invocation [POST /api/v1/user/register] with attributes [authenticated]
08-03-2022 18:13:00.404 [http-nio-15001-exec-2] DEBUG org.springframework.security.web.authentication.Http403ForbiddenEntryPoint.commence - Pre-authenticated entry point called. Rejecting access
08-03-2022 18:13:00.404 [http-nio-15001-exec-2] DEBUG org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter - Cleared SecurityContextHolder to complete request
08-03-2022 18:13:00.404 [http-nio-15001-exec-2] DEBUG org.springframework.security.web.FilterChainProxy.doFilterInternal - Securing POST /error
08-03-2022 18:13:00.404 [http-nio-15001-exec-2] DEBUG org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter - Set SecurityContextHolder to empty SecurityContext
08-03-2022 18:13:00.404 [http-nio-15001-exec-2] DEBUG org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter - Set SecurityContextHolder to anonymous SecurityContext
08-03-2022 18:13:00.404 [http-nio-15001-exec-2] DEBUG org.springframework.security.web.FilterChainProxy.doFilter - Secured POST /error
08-03-2022 18:13:00.498 [http-nio-15001-exec-2] DEBUG org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter - Cleared SecurityContextHolder to complete request

如果我改变了 corsConfigurationSource 方法

// configuration.setAllowedOrigins(Arrays.asList("http://localhost:4200"));
   configuration.setAllowedOrigins(Arrays.asList("http://localhost:15001"));

然后出现错误:

Access to XMLHttpRequest at 'http://localhost:15001/auth/api/v1/user/register' from origin 'http://localhost:4200' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

这是我在这个问题中处理的错误 has been blocked by CORS policy

Answer 1

问题不在于 cors 或 csrf。它已被禁用。这是您的 antMatchers 绕过注册 api 的配置。它应该只是 /api/v1/user/register 而不是 /auth/api/v1/user/register。我们不应该在 web 安全配置中的 application.yml 中添加 servlet.context-path 设置为 auth。更新您的 SecurityConfig 如下:

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .httpBasic().disable()
                .cors().and().csrf().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .authorizeRequests()
                .antMatchers("/api/v1/user/register").permitAll() // update this
                .anyRequest().authenticated()
                .and()
                .apply(new JwtConfigurer(jwtTokenProvider));
    }