春季启动安全性 – 允许无需身份验证

huangapple
go评论117阅读模式
英文:

Spring Boot Security - allow without authentication

问题

Spring Boot安全性允许匿名用户

我正试图配置Spring Boot安全性以允许匿名用户访问除一个页面外的所有URL。默认情况下，使用Spring生成的用户和安全密码。

我只需要一个用于维护应用程序的页面。

我已经尝试了很多提示和教程。

链接1
链接2
链接3
链接4

还有其他的方法。

但是Spring仍然要求所有页面进行身份验证。

我的当前安全配置

  1. @EnableWebSecurity
  2. @Configuration
  3. public class SecurityConf extends WebSecurityConfigurerAdapter {
  4.     @Override
  5.     public void configure(HttpSecurity http) throws Exception {
  6.         http
  7.         .csrf()
  8.         .disable()
  9.         .authorizeRequests()
  10.         .anyRequest()
  11.         .anonymous()
  12.         .antMatchers("/secure")
  13.         .authenticated();
  14.     }
  15. }

Web配置

  1. @Configuration
  2. @EnableWebMvc
  3. @EnableAsync
  4. public class WebConf implements WebMvcConfigurer {
  5.     @Override
  6.     public void addResourceHandlers(ResourceHandlerRegistry registry) {
  7.         WebMvcConfigurer.super.addResourceHandlers(registry);
  8.         registry.addResourceHandler("/webjars/**").addResourceLocations("/webjars/");
  9.     }
  11.     @Bean
  12.     public Executor asyncExecutor() {
  13.         ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
  14.         executor.setCorePoolSize(5);
  15.         executor.setMaxPoolSize(5);
  16.         executor.setQueueCapacity(500);
  17.         executor.setThreadNamePrefix("Asynchronous Process-");
  18.         executor.initialize();
  19.         return executor;
  20.     }
  21. }

主方法

  1. @ComponentScan
  2. @SpringBootApplication
  3. @EnableScheduling
  4. public class MainServiceApplication {
  5.     public static void main(String[] args) {
  6.         SpringApplication.run(MainServiceApplication.class, args);
  7.     }
  8. }

我尝试了.permitAll()和.anonymous()但没有成功。

编辑1

项目结构

项目结构

编辑2

项目结构

  1. @ComponentScan()
  2. @SpringBootApplication
  3. @EnableScheduling
  4. public class MainServiceApplication {
  5.     public static void main(String[] args) {
  6.         SpringApplication.run(MainServiceApplication.class, args);
  7.     }
  8. }

登录页面

通过移动配置包解决。Spring没有扫描配置包。

英文:

Spring boot security allow anonymous user

I am trying configure Spring Boot Security to allow anonymous user reach all URLs except one. By default user and generated security password by Spring.
I need just one page for maintanance application
I already tried a lot tips and tutorials.

<a href="https://stackoverflow.com/questions/24696717/spring-security-permitall-not-allowing-anonymous-access">1</a>
<a href="https://www.baeldung.com/security-none-filters-none-access-permitAll">2</a>
<a href="https://stackoverflow.com/questions/57275361/how-to-allow-guest-to-access-home-page-without-login-in-spring-security">3</a>
<a href="https://stackoverflow.com/questions/36809561/spring-security-thymleaf-static-resources-dont-load">4</a>

And others.

But Spring still required authetification for all pages.
<br>
My current security config

  1. @EnableWebSecurity
  2. @Configuration
  3. public class SecurityConf extends WebSecurityConfigurerAdapter {
  4. 	@Override
  5. 	public void configure(HttpSecurity http) throws Exception {
  6. 		http
  7. 		.csrf()
  8. 		.disable()
  9. 		.authorizeRequests()
  10. 		.anyRequest()
  11. 		.anonymous()
  12. 		.antMatchers(&quot;/secure&quot;)
  13. 		.authenticated();
  14. 	}
  15. }

Web configuration

  1. @Configuration
  2. @EnableWebMvc
  3. @EnableAsync
  4. public class WebConf implements WebMvcConfigurer {
  5. 	@Override
  6. 	public void addResourceHandlers(ResourceHandlerRegistry registry) {
  7. 		WebMvcConfigurer.super.addResourceHandlers(registry);
  8. 		registry.addResourceHandler(&quot;/webjars/**&quot;).addResourceLocations(&quot;/webjars/**&quot;);
  9. 	}	
  10. 	@Bean
  11. 	public Executor asyncExecutor() {
  12. 	    ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
  13. 	    executor.setCorePoolSize(5);
  14. 	    executor.setMaxPoolSize(5);
  15. 	    executor.setQueueCapacity(500);
  16. 	    executor.setThreadNamePrefix(&quot;Asynchronous Process-&quot;);
  17. 	    executor.initialize();
  18. 	    return executor;
  19. 	}	
  20. }

And main method

  1. @ComponentScan
  2. @SpringBootApplication
  3. @EnableScheduling
  4. public class MainServiceApplication {
  5. 	public static void main(String[] args) {
  6. 		SpringApplication.run(MainServiceApplication.class, args);
  7. 	}
  8. }

I tried

  1. .permitAll()
  2. .anonymous()

without success.

Edit 1

Project structure

Project structure

Edit 2

Project structure

  1. @ComponentScan()
  2. @SpringBootApplication
  3. @EnableScheduling
  4. public class MainServiceApplication {
  6. 	public static void main(String[] args) {
  7. 		SpringApplication.run(MainServiceApplication.class, args);
  8. 	}
  10. }

Login page

Solved by move config package. Spring did not scan configuration package.

答案1

得分: 1

以下是翻译好的内容：

你可能需要调整顺序。可能的问题是 antMatchers("/secure").authenticated() 没有效果，因为 /secure 端点将在 anyRequest() 中被考虑。还要确保 SecurityConf 在正确的包中，以便进行扫描。

  1. @EnableWebSecurity
  2. @Configuration
  3. public class SecurityConf extends WebSecurityConfigurerAdapter {
  4.     @Override
  5.     public void configure(HttpSecurity http) throws Exception {
  6.         http
  7.             .csrf()
  8.             .disable()
  9.             .authorizeRequests()
  10.             .antMatchers("/secure").authenticated()
  11.             .anyRequest().anonymous();
  12.     }
  13. }

或者

  1. @EnableWebSecurity
  2. @Configuration
  3. public class SecurityConf extends WebSecurityConfigurerAdapter {
  4.     @Override
  5.     public void configure(HttpSecurity http) throws Exception {
  6.         http
  7.             .csrf()
  8.             .disable()
  9.             .authorizeRequests()
  10.             .antMatchers("/secure").authenticated()
  11.             .anyRequest().permitAll();
  12.     }
  13. }

更新

你需要在 cz.lh.main_service 内部创建一个 configs 包，而且 SecurityConf 和 WebConf 应该属于 cz.lh.main_service.configs 包。

或者

你可以使用 @ComponentScan，并且可以在其中指定你拥有 SecurityConf 和 WebConf 的当前包。

  1. @ComponentScan("your-config-package")
英文:

You may need to change the order. Possible issue is antMatchers(&quot;/secure&quot;).authenticated() has no effect due to /secure endpoint will be considerd in the anyRequest(). Also make sure SecurityConf is in correct package as required for scanning.

  1. @EnableWebSecurity
  2. @Configuration
  3. public class SecurityConf extends WebSecurityConfigurerAdapter {
  4.     @Override
  5.     public void configure(HttpSecurity http) throws Exception {
  6.         http
  7.             .csrf()
  8.             .disable()
  9.             .authorizeRequests()
  10.             .antMatchers(&quot;/secure&quot;).authenticated()
  11.             .anyRequest().anonymous();
  12.     }
  13. }

OR

  1. @EnableWebSecurity
  2. @Configuration
  3. public class SecurityConf extends WebSecurityConfigurerAdapter {
  4.     @Override
  5.     public void configure(HttpSecurity http) throws Exception {
  6.         http
  7.             .csrf()
  8.             .disable()
  9.             .authorizeRequests()
  10.             .antMatchers(&quot;/secure&quot;).authenticated()
  11.             .anyRequest().permitAll();
  12.     }
  13. }

UPDATE

You need to create a configs package inside cz.lh.main_service and SecurityConf and WebConf should be part of the cz.lh.main_service.configs

OR

You can use @ComponentScan and can specify the current package in which you have SecurityConf and WebConf

  1. @ComponentScan(“your-config-package”)

huangapple
  • 本文由 发表于 2020年9月17日 18:41:11
  • 转载请务必保留本文链接：https://go.coder-hub.com/63936316.html
  • java
  • spring
  • spring-boot
  • spring-security
  • web
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定