spring-security - 启用 Spring Security 使 Swagger 输出文本/纯文本而不是 HTML

Question

Swagger 的作品!我可以与http://localhost:8090/sdoc.jsp互动一切都很好。

我将以下内容添加到 pom.xml...

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

我还添加了以下两个文件:

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        String name = authentication.getName();
        String password = authentication.getCredentials().toString();

        if( !Authenticate.authenticate(name, password) )
            return null;

        List<GrantedAuthority> grantedAuths = new ArrayList<>();
        grantedAuths.add(new SimpleGrantedAuthority("ROLE_USER"));
        Authentication auth = new UsernamePasswordAuthenticationToken(name, password, grantedAuths);
        return auth;
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}

和

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
                .disable()

            .authorizeRequests()
                .anyRequest().permitAll()
                .antMatchers("/**").authenticated().and()
                .formLogin().loginPage("/login").permitAll().and()
                .httpBasic()
                ;
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(new CustomAuthenticationProvider());
    }
}

此时，如果我访问之前有效的同一 URL，我现在会得到“text/plain”响应类型，并且看到源代码，而不是漂亮的 HTML 浏览器。

如果我恢复更改并从项目中删除这两个文件并删除 JAR 文件，它会再次工作。

如何让 Spring Security 和 Swagger 和谐相处？我做错了什么。

Answer 1

我怀疑这是由于 Spring-Security 对内容类型 header ( http://docs.spring.io/spring-security/site/docs/3.2.0.CI-SNAPSHOT/reference/html/headers.html#headers-content-type-options ) 的影响。

来自文档 -

Historically browsers, including Internet Explorer, would try to guess the content type of a request using content sniffing. This allowed browsers to improve the user experience by guessing the content type on resources that had not specified the content type. For example, if a browser encountered a JavaScript file that did not have the content type specified, it would be able to guess the content type and then execute it.

The problem with content sniffing is that this allowed malicious users to use polyglots (i.e. a file that is valid as multiple content types) to execute XSS attacks. For example, some sites may allow users to submit a valid postscript document to a website and view it. A malicious user might create a postscript document that is also a valid JavaScript file and execute a XSS attack with it.

再次，从文档中，为了覆盖默认值 -

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends
   WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
      // ...
      .headers()
        .contentTypeOptions();
  }
}