Question

我正在使用Spring Security。默认情况下，它不允许在iframe中加载页面。

Spring Security设置标头X-Frame-Options值'DENY'。我不希望这个标题包含在我的应用程序中。

这是我的配置文件。

package com.some.package.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

import com.some.package.crm.enums.Role;
import com.some.package.security.AuthSuccessHandler;
import com.some.package.security.AuthenticationProvider;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private AuthenticationProvider authenticationProvider;

    @Autowired
    private AuthSuccessHandler authSuccessHandler;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider);

    }
    @Bean
    public PasswordEncoder getPasswordEncoder(){
        PasswordEncoder encoder = new BCryptPasswordEncoder();
        return encoder;
    }

    @Override
    public void configure(WebSecurity webSecurity) throws Exception
    {
        webSecurity
            .ignoring()
                // All of Spring Security will ignore the requests
                .antMatchers("/resources/**", "/","/site/**","/affLinkCount", "/forgotPassword","/thirdPartyLogin", "/resetPassword", "/notifyCallbackToRecurring");

    }
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        /*
         * Security Headers added by default
         *      Cache Control
         *      Content Type Options
         *      HTTP Strict Transport Security
         *      X-Frame-Options
         *      X-XSS-Protection 
         *  csrf added by default
         */

      http
        .authorizeRequests()
             .antMatchers("/crm/**").hasRole(Role.CUSTOMER.name())
             .antMatchers("/analyst/**").hasRole(Role.ANALYST.name())

             .anyRequest().authenticated() 

        .and()
        .formLogin()
             .loginPage("/login")
             .failureUrl("/login?failed=true")
             .successHandler(authSuccessHandler)
             .usernameParameter("username")
             .passwordParameter("password").loginProcessingUrl("/j_spring_security_check")
             .permitAll()
        .and()
             .sessionManagement().sessionFixation().newSession()
             .sessionAuthenticationErrorUrl("/login")
             .invalidSessionUrl("/login")
             .maximumSessions(1)
             .expiredUrl("/login").and()

        .and()
             .exceptionHandling().accessDeniedPage("/login")
        .and()
             .logout()
             .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
             .logoutSuccessUrl("/login")
             .permitAll();
       // .and().headers().frameOptions().disable();
       // addFilterAfter(new IFrameEnableFilter(), HeaderWriterFilter.class);
            //.headers().frameOptions().addHeaderWriter(new XFrameOptionsHeaderWriter(new WhiteListedAllowFromStrategy(Arrays.asList("localhost"))));
        //  .headers().addHeaderWriter(new XFrameOptionsHeaderWriter(new WhiteListedAllowFromStrategy(Arrays.asList("localhost"))));




    }

}

Answer 1

如果您使用的是Spring Security 4，那么您可以使用以下内容执行此操作：

http
    .headers()
        .frameOptions().disable()
        .and()
    // ...

您可以在the 4.0.x reference中找到更多详细信息。

在Spring Security 3.2.x中，如果要继续使用其他HTTP标头，情况会有所不同。你需要做这样的事情：

http
    .headers()
        .contentTypeOptions();
        .xssProtection()
        .cacheControl()
        .httpStrictTransportSecurity()
        .frameOptions()
        .and()
    // ...

其他详情可在the 3.2.x reference。

中找到

Answer 2

谢谢@Rob Winch的回答，这使我从同一来源找到了一个简单的解决方案，可以在xml配置文件中将其禁用，如下所示：

doPost()

我刚刚分享了此内容，因为其他人可能会使用它，以便不进行代码更改，因此只需要配置更新

使用Spring Security时，允许所有域使用Iframe

2 个答案: