Question

当我启用spring-boot-starter-security依赖项时。 CORS支持不起作用。

这是我的SecurityConfiguration类：

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected AuthenticationManager authenticationManager() throws Exception {

        return authentication -> {

          // ...
        };
    }

    @Override
    protected void configure(final HttpSecurity http) throws Exception {

        http.csrf()

            // Disabling CSRF
            .disable()

            // Disabling Session Management
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.NEVER)
            .and()

            // Adding custom REST Authentication filter
            .addFilterBefore(new RestAuthenticationFilter(authenticationManager()), LogoutFilter.class)

            // Authorizing requests
            .authorizeRequests()
            .antMatchers("/", "/frontend/login")
            .permitAll()
            .antMatchers("/api/**", "/frontend/**")
            .authenticated()
            .antMatchers("/**")
            .permitAll();
    }
}

我的控制器类有一个CrossOrigin注释：

@CrossOrigin
@RequestMapping("/frontend")
@RestController
public class FrontEndController extends BaseController {

我可以使用自定义CORS过滤器处理CORS，但我只想使用一个Annoation。

Answer 1

我找到了两种方法，可以为启用spring-security的spring-boot项目添加CORS支持。我们可以将spring-web CorsFilter添加到安全过滤器链中。以下示例属于基于令牌的身份验证项目。所以我们使用了自定义的RestAuthenticationFilter。

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(final HttpSecurity http) throws Exception {

        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        final CorsConfiguration               config = new CorsConfiguration();

        config.addAllowedOrigin("*");
        config.addAllowedHeader("*");
        config.addAllowedMethod("GET");
        config.addAllowedMethod("PUT");
        config.addAllowedMethod("POST");
        source.registerCorsConfiguration("/**", config);

        http.csrf()

            // Disabling CSRF
            .disable()

            // Disabling Session Management
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.NEVER)
            .and()

            // Adding spring-web CORS filter
            .addFilterBefore(new CorsFilter(source), LogoutFilter.class)

            // Adding custom REST Authentication filter
            .addFilterBefore(new RestAuthenticationFilter(authenticationManager()), LogoutFilter.class)

            // Authorizing requests
            .authorizeRequests()
            .antMatchers("/", "/frontend/login")
            .permitAll()
            .antMatchers("/api/**", "/frontend/**")
            .authenticated()
            .antMatchers("/**")
            .permitAll();
    }
}

但在上面的示例中，控制器中的CrossOrigin注释是多余的。所以我们应该能够控制弹簧网络层的CORS请求。因此，我们可以允许CORS pre-flight（OPTIONS HTTP方法）。

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {


    @Override
    protected void configure(final HttpSecurity http) throws Exception {

        http.csrf()

            // Disabling CSRF
            .disable()

            // Disabling Session Management
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.NEVER)
            .and()

            // Adding custom REST Authentication filter
            .addFilterBefore(new RestAuthenticationFilter(authenticationManager()), LogoutFilter.class)

            // Authorizing requests
            .authorizeRequests()
            .antMatchers(HttpMethod.OPTIONS, "/**")
            .permitAll()
            .antMatchers("/", "/frontend/login")
            .permitAll()
            .antMatchers("/api/**", "/frontend/**")
            .authenticated()
            .antMatchers("/**")
            .permitAll();
    }
}

在上述配置的帮助下，我们可以同时使用@CrossOrigin注释和spring-security配置。

CrossOrigin注释不适用于spring安全性

1 个答案: