java - Spring引导迁移后总是未经授权

Question

我正在努力将 Spring boot 1 升级到 Spring boot 2，但我已经卡住了 2 天。

身份验证过去在我的 React/Spring 启动应用程序上工作得很好，但是在迁移一切之后都很好，但在我的 api/authenticate 资源上总是得到 401（未经授权）。

这是我经过一些更改后的安全配置：

@Override
    public void configure(HttpSecurity http) throws Exception {
        http.httpBasic()
                //.authenticationEntryPoint(authenticationEntryPoint)
                .and()
                .authorizeRequests()
                .antMatchers(PERMIT_ALL_GET_URLS).permitAll()
                .antMatchers(HttpMethod.POST, PERMIT_ALL_POST_URLS).permitAll()
                .anyRequest().authenticated()
                .and()
                .logout().clearAuthentication(true)
                .logoutRequestMatcher(new AntPathRequestMatcher("/api/logout")).invalidateHttpSession(true).and().csrf()
                .requireCsrfProtectionMatcher(new RequestMatcher() {
                    private Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$");
                    @Override
                    public boolean matches(HttpServletRequest request) {
                        // No CSRF due to public requests
                        if (stringContainsItemFromList(request.getRequestURI(), PERMIT_ALL_POST_URLS_PATTERN_PREFIX))
                            return false;
                        if (Arrays.asList(PERMIT_ALL_POST_URLS).contains(request.getRequestURI()))
                            return false;
                        // No CSRF due to allowed methods
                        if (allowedMethods.matcher(request.getMethod()).matches())
                            return false;
                        // CSRF for everything else
                        return true;
                    }
                }).csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                .ignoringAntMatchers("/api/external/uploadBulkVerifications/*");
        http.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint);
        http.headers().xssProtection().xssProtectionEnabled(true);
        http.headers().xssProtection().block(false);
        http.headers().defaultsDisabled().contentTypeOptions();
        http.sessionManagement().maximumSessions(2).expiredUrl("/");
        http.addFilterBefore(authenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    }

我是否遗漏了什么或者我还需要查看该authenticate()方法

编辑：

我得到了错误的凭据：

2019-07-02 11:02:13.100 DEBUG 79640 --- [nio-8080-exec-7] o.s.s.w.a.www.BasicAuthenticationFilter : Authentication request for failed: org.springframework.security.authentication.BadCredentialsException: gaca.api.errors.authentication.0001 2019-07-02 11:02:13.100 DEBUG 79640 --- [nio-8080-exec-7] s.w.a.DelegatingAuthenticationEntryPoint : Trying to match using RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest] 2019-07-02 11:02:13.100 DEBUG 79640 --- [nio-8080-exec-7] s.w.a.DelegatingAuthenticationEntryPoint : Match found! Executing org.springframework.security.web.authentication.HttpStatusEntryPoint@17b900b4 2019-07-02 11:02:13.101 DEBUG 79640 --- [nio-8080-exec-7] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. 2019-07-02 11:02:13.101 DEBUG 79640 --- [nio-8080-exec-7] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed

我想知道哪个过滤器阻止了我

并使用正确的凭据，我得到：

2019-07-02 11:07:06.397 DEBUG 79640 --- [nio-8080-exec-3] e.g.c.S.LimitLoginAuthenticationProvider : User account credentials have expired

我没有处理任何类型的过期凭据

标签： javaspringrestspring-boot