获取后，Spring Security Access被拒绝403

Question

这个与邮差有效的网址http://localhost:8070/produits工作正常。它会返回：

添加spring security后，即使用正确的用户名和密码，此url也会拒绝403访问权限。

SecurityConfig.java

    import javax.sql.DataSource;


@Configuration

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter    {


    @Autowired
    private DataSource dataSource;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {


        /*auth.inMemoryAuthentication().withUser("admin").password("1234").roles("ADMIN","USER");
        auth.inMemoryAuthentication().withUser("user").password("1234").roles("USER");*/

        auth.jdbcAuthentication().dataSource(dataSource)
        .usersByUsernameQuery("select username as principal,password as credentials,active from users where username =?").
        authoritiesByUsernameQuery("select username as principal,roles as role from users_roles where username =?")
        .rolePrefix("ROLE_").passwordEncoder(new Md5PasswordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {


        http.authorizeRequests().antMatchers("/produits").hasRole("USER");


    }


}

宁静的服务

@Autowired
private ProduitRepository produitRepository;


@RequestMapping(value="/produits",method=RequestMethod.GET)
public List<Produit> listProduits()
{
    return produitRepository.findAll();
}

Answer 1

据我所见，您可以在截图中使用基本身份验证。如果是这样，你至少应该启用它。试试这个：

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.httpBasic();
    http.authorizeRequests().antMatchers("/produits").hasRole("USER");
}