java - 在spring boot中需要认证才能获取公共资源

Question

我需要经过身份验证才能获取公共资源。

这种结构对我有用，即使我经过身份验证，我也只能获得我的公共资源。当我在通过身份验证后尝试例如发布请求时，我得到 403 禁止。

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .cors()
            .and()
            .authorizeRequests()
            .antMatchers("/public/**").permitAll()
            .antMatchers("/private/**").authenticated()
            .antMatchers("/private-scoped").hasAuthority("read:posts");
}

使用此配置，我需要经过身份验证才能访问这些资源中的任何一个，甚至是公共资源。当我通过身份验证时，一切正常。

  @Override
protected void configure(HttpSecurity http) throws Exception {
    JwtWebSecurityConfigurer
            .forRS256(audience, issuer)
            .configure(http)
            .cors()
            .and()
            .authorizeRequests()
            .antMatchers("/public/**").permitAll()
            .antMatchers("/private/**").authenticated()
            .antMatchers("/private-scoped").hasAuthority("read:posts");
}

有没有可能将这两种配置合二为一的方法？

我从我的前端发送 jwt 令牌。

这是我的配置文件：

import com.auth0.spring.security.api.JwtWebSecurityConfigurer;
import java.util.Arrays;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

/**
 *
 * @author Kamil
 */
@Configuration
@EnableWebSecurity
public class AuthConfig extends WebSecurityConfigurerAdapter {

    @Value(value = "${auth0.apiAudience}")
    private String audience;
    @Value(value = "${auth0.issuer}")
    private String issuer;
    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.applyPermitDefaultValues();
        configuration.setAllowedMethods(Arrays.asList("*"));
        configuration.setAllowedOrigins(Arrays.asList("*"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        JwtWebSecurityConfigurer
                .forRS256(audience, issuer)
                .configure(http)
                .cors()
                .and()
                .authorizeRequests()
                .antMatchers("/public/**").permitAll()
                .antMatchers("/private/**").authenticated()
                .antMatchers("/private-scoped").hasAuthority("read:posts");
    }
}

标签： javaspringspring-bootsecurityjakarta-ee

Answer 1

试试这个方法：

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .antMatchers("/public/**").permitAll()
            .antMatchers("/private-scoped").hasAuthority("read:posts")
            .anyRequest().authenticated()
            .and()
            .cors(); 
}