这是我第一次决定基于Spring Boot和Spring Security编写具有完整Java代码配置的应用程序时,我遇到了无法克服的怪异问题。我正在尝试使用Postman测试API,并且仅当我将content-type用作application / x-www-form-urlencoded时才接受我的请求。下面,我粘贴所有当前配置。

@SpringBootApplication
public class OpenIdApplication {
    public static void main(String[] args) {
        SpringApplication.run(OpenIdApplication.class, args);
    }
}

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    private UserService userService;

    @Autowired
    public SecurityConfig(UserService userService) {
        this.userService = userService;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(11);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/register/**").permitAll()
                .anyRequest().authenticated()
            .and()
                .formLogin()
            .and()
                .cors()
            .and()
                .csrf()
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
    }

}

@RestController
public class UserController {
    ...

    @PostMapping(value = "/register")
    public ResponseEntity<Object> registerUser(
            @RequestBody UserRegistrationDto newUser, BindingResult bindingResult) {
       ...
    }

@Data
@Builder
@NoArgsConstructor
@AllArgsConstructor
public class UserRegistrationDto {
    private String username;
    private String firstName;
    private String lastName;
    private String email;
    private String password;
    private String passwordRepeat;
}


如果要登录,则只能使用提到的content-type进行操作。对于application / json,我得到403响应状态。对于/ registration端点,如果我从方法参数中删除@RequestBody,那么它可以很好地与application / x-www-form-urlencoded请求一起使用,但是如果我保留它,那么对于此内容类型,我会得到415,但是如果我尝试使用application / json,然后我看到403。我还尝试在此端点上方添加@PreAutorize(“ permitAll()”)批注,并将httpBasic()添加到Spring Security配置中-这导致响应状态从403更改为401。

我尝试向该端点发送2个不同的JSON:

{
    "username":"test",
    "firstName":"Test",
    "lastName":"Test",
    "email":"test@test.com",
    "password":"test",
    "passwordRepeat":"test",
    "_csrf":"8b7d4680-5be4-482a-9138-b4eb92a358c1"
}

{
    "newUser": {
        "username":"test",
        "firstName":"Test",
        "lastName":"Test",
        "email":"test@test.com",
        "password":"test",
        "passwordRepeat":"test"
    },
    "_csrf":"8b7d4680-5be4-482a-9138-b4eb92a358c1"
}


当然,每次我都确保_csrf与我的API返回的匹配。

我正在使用Spring Boot 2.0.1.RELEASE和Spring Security 5.0.3.RELEASE。

最佳答案

我非常确定,当您发布到"/register/**"时,Ant模式/register/匹配以/registerSee examples here)开头的所有URL(末尾没有斜杠)。你应该尝试

.antMatchers("/register*").permitAll()


要么

.mvcMatchers(HttpMethod.POST, "/register").permitAll()


第一个与任何以/register开头的URL匹配,第二个与您的@PostMapping完全匹配。

09-10 03:20
查看更多