java - Spring Security，针对 REST 请求禁用 formLogin()

Question

我正在使用 Spring Boot、Spring Security、Spring Data REST、Hibernate。 我正在创建一个 REST API 服务器。

我将访问 REST API 的安全性配置为:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@CrossOrigin(origins = "*")
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsServiceImpl userDetailsService;

    @Autowired
    private TenantFilter tenantFilter;


    @Autowired
    public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder.userDetailsService(this.userDetailsService).passwordEncoder(User.PASSWORD_ENCODER);
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public JwtAuthenticationTokenFilter jwtTokenFilter() throws Exception {
        return new JwtAuthenticationTokenFilter();
    }

    @Bean
    public CookieAuthFilter cookieAuthFilter() throws Exception {
        return new CookieAuthFilter();
    }

    @Bean
    public CustomWebAuthenticationDetailsSource customWebAuthenticationDetailsSource() {
        return new CustomWebAuthenticationDetailsSource();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                //********************************************************************
                // PERMIT OPTIONS
                //********************************************************************
                .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()

                //********************************************************************
                //WEBSOCKET
                //********************************************************************
                .antMatchers("/socket/**").permitAll()

                .antMatchers("/images/**").permitAll()

                .antMatchers("/resources/templates/**").permitAll()

                .antMatchers("/api/v1/notifications/**").permitAll()

                //********************************************************************
                // SWAGGER
                //********************************************************************
                .antMatchers("/v2/api-docs", "/swagger-accounts/configuration/ui", "/swagger-accounts", "/swagger-accounts/configuration/security",
                        "/swagger-ui.html", "/webjars/**", "/swagger-resources/**").permitAll()


                .antMatchers("/api/v1/").permitAll()

                .antMatchers("/api/v1/auth/**").permitAll()
                .antMatchers("/api/v1/formLogin/**").permitAll()

                .antMatchers("/api/v1/logout").permitAll()

                .antMatchers("/api/v1/agents/verifyEmail").permitAll()

                .antMatchers("/api/v1/agents/**/verificationToken").permitAll()

                .antMatchers("/api/v1/agents/**/resetPassword").permitAll()

                .antMatchers("/api/v1/agents/**/verifyPasswordReset").permitAll()

                .antMatchers("/api/v1/agents/**/changePassword").permitAll()

                .antMatchers("/api/v1/errors/**").permitAll()

                .antMatchers("/api/v1/verifyCaptcha").permitAll()

                .antMatchers("/api/v1/ping").permitAll()

                .antMatchers("/api/v1/tenants/**").permitAll()

                // all other endpoints are authenticated
                .antMatchers("/**").authenticated()

                // global settings
                .and()
                .csrf()
                .disable();

       http.formLogin().loginPage("/login").permitAll();


        // Custom JWT based security filter
        http.addFilterBefore(tenantFilter, UsernamePasswordAuthenticationFilter.class);
        http.addFilterBefore(jwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);
        http.addFilterBefore(cookieAuthFilter(), UsernamePasswordAuthenticationFilter.class);

        http.headers().cacheControl().disable();
    }
}

我想要达到的目标是:

• 当用户尝试访问类似 http://myhost/swagger-ui.html#/ 的 URL 时显示表单登录信息为了能够轻松使用swagger

• 当使用 REST 调用(通过 Angular 或 Postman 或其他方式)调用服务器时，避免表单登录。事实上，否则如果认证失败，服务器会回复登录页面的html代码

有没有办法用Spring来完成这个任务，而不需要关闭formLogin()？

Answer 1

其他配置看起来不错

如果您注意到与 swagger 相关的 url 也被标记为 permitAll()。

只需删除 swagger 的 allowedAll 部分并将其添加到最后作为authentiated() 类似的东西

.antMatchers("/v2/api-docs", "/swagger-accounts/configuration/ui", "/swagger-accounts", "/swagger-accounts/configuration/security",
                        "/swagger-ui.html", "/webjars/**", "/swagger-resources/**").authenticated()

对于 REST 调用，只需查看它们是否添加到 permitAll()

另请注意:规则的顺序很重要，更具体的规则应该放在前面

例如

.antMatchers("/admin/**").authenticated()
.antMatchers("/admin/login").permitAll()

此处/admin/login也将进行身份验证。