java - Spring Security 无法访问外部 JavaScript

Question

我正在使用 Spring Security，当我尝试使用外部 javascript 甚至 webjars 时，安全性会阻止访问。

我尝试向我的网页添加一些 javascript，如下所示： header.html

<script src="https://cdnjs.cloudflare.com/ajax/libs/sockjs-client/1.4.0/sockjs.min.js"></script>
<script src="/webjars/stomp-websocket/stomp.min.js"></script>

我的安全配置如下所示（注意“/webjars/ ”、“/*.js”、“/ .js”）.permitAll()）：

AppConfig.java

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class AppConfig extends WebSecurityConfigurerAdapter {

@Bean
public LogoutSuccessHandler logoutSuccessHandler() {
    return new LogoutController();
}

@Bean
public AuthenticationController authenticationController() throws UnsupportedEncodingException {
    JwkProvider jwkProvider = new JwkProviderBuilder(domain).build();
    return AuthenticationController.newBuilder(domain, clientId, clientSecret)
            .withJwkProvider(jwkProvider)
            .build();
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable();
    http
        .authorizeRequests()
        .antMatchers("/callback", "/login", "/", "/*.png", "/css/**", "/js/**", "/bibliographies", "/bibliographies/*", "/api/**", "/webjars/**", "/*.js", "/**.js").permitAll()
        .anyRequest().authenticated()
        .and()
        .logout().logoutSuccessHandler(logoutSuccessHandler()).permitAll();
}

在加载我想要访问 javascript 的网页时，我得到以下异常：

2020-01-18 16:38:39.941 DEBUG 7824 --- [nio-3000-exec-4] osswaExceptionTranslationFilter：访问被拒绝（用户是匿名的）；重定向到身份验证入口点

org.springframework.security.access.AccessDeniedException：访问在 org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) 被拒绝~[spring-security-core-4.2.12.RELEASE.jar: 4.2.12.RELEASE] 在 org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-4.2.12.RELEASE.jar:4.2.12.RELEASE] 在org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124) ~[spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] at org.springframework.security .web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) ~[spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] at org.springframework.security.web。FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter. java:114) ~[spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring- security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] 在 org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-4.2.12. RELEASE.jar:4.2.12.RELEASE] 在 org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12。发布]doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114) ~[spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web- 4.2.12.RELEASE.jar:4.2.12.RELEASE] 在 org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-4.2.12.RELEASE.jar: 4.2.12.RELEASE] 在 org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE]doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114) ~[spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web- 4.2.12.RELEASE.jar:4.2.12.RELEASE] 在 org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-4.2.12.RELEASE.jar: 4.2.12.RELEASE] 在 org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE]RELEASE] 在 org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114) ~[spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] 在 org.springframework。 security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] 在 org.springframework.security.web.session.SessionManagementFilter。 doFilter(SessionManagementFilter.java:137) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE]RELEASE] 在 org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114) ~[spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] 在 org.springframework。 security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] 在 org.springframework.security.web.session.SessionManagementFilter。 doFilter(SessionManagementFilter.java:137) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE]jar:4.2.12.RELEASE] 在 org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE]在 org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] 在 org.springframework.security.web .FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE]jar:4.2.12.RELEASE] 在 org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE]在 org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE] 在 org.springframework.security.web .FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2.12.RELEASE]12.RELEASE.jar:4.2.12.RELEASE] 在 org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2. 12.发布]12.RELEASE.jar:4.2.12.RELEASE] 在 org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.12.RELEASE.jar:4.2. 12.发布]

我声明的其他匹配器（例如“/api/**”）无需登录即可使用，但是我自己的安全性阻止我访问.js文件，即使我的匹配器看起来没问题。

我该如何解决这个问题？

标签： javaspringspring-bootspring-mvcspring-security

Answer 1

添加：

<security:intercept-url pattern="/resources/**" access="permitAll" />

在您的上下文文件中。这里的resources是所有JS文件所在的目录。

可以参考这个链接： Spring security 不允许加载 CSS 或 JS 资源