java - 在 spring security 中禁用浏览器身份验证对话框

Question

我正在使用 spring security 4，出于某种原因，在我完成登录页面的身份验证后，我得到了浏览器身份验证对话框，这迫使我再次进行身份验证。

这是我的安全配置:

    http.antMatcher("/test")
            .httpBasic()
            .and()
            .authorizeRequests()
            .antMatchers("/index.html", "/login.html", "/", "/scripts/**",
                    "/bower_components/**", "/styles/**", "/views/**",
                    "/login", "/api/user/*").permitAll().anyRequest()
            .authenticated().and().logout().logoutUrl("/api/logout").and()
            .csrf().csrfTokenRepository(csrfTokenRepository()).and()
            .addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);

Answer 1

身份验证弹出窗口是由响应头 WWW-Authenticate: Basic 引起的，它由 BasicAuthenticationEntryPoint 设置.

使用未设置 WWW-Authenticate: Basic 的自定义 AuthenticationEntryPoint:

public class NoPopupBasicAuthenticationEntryPoint implements AuthenticationEntryPoint {

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response,
        AuthenticationException authException) throws IOException, ServletException {
    
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, authException.getMessage());
    }

}

将自定义身份验证入口点添加到安全配置(顺序很重要):

http
    .httpBasic()
    .authenticationEntryPoint(new NoPopupBasicAuthenticationEntryPoint())