Question

我没有使用Spring Security，但它要求我进行身份验证。

网址（http://localhost:8080/SpringJob/ExecuteJob）的例外情况：

{
    "timestamp": 1500622875056,
    "status": 401,
    "error": "Unauthorized",
    "message": "Bad credentials",
    "path": "/SPPA/ExecuteSPPAJob"
}
----below log details
2017-07-21 13:15:35.210  INFO 19828 --- [nio-8080-exec-1] o.a.c.c.C.[Tomcat].[localhost].[/SpringJob]   : Initializing Spring FrameworkServlet 'dispatcherServlet'
2017-07-21 13:15:35.210 [http-nio-8080-exec-1] INFO 
                    o.a.c.c.C.[.[localhost].[/SpringJob]-Initializing Spring FrameworkServlet 'dispatcherServlet' 
2017-07-21 13:15:35.211  INFO 19828 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : FrameworkServlet 'dispatcherServlet': initialization started
2017-07-21 13:15:35.211 [http-nio-8080-exec-1] INFO 
                    o.s.web.servlet.DispatcherServlet-FrameworkServlet 'dispatcherServlet': initialization started 
2017-07-21 13:15:35.494  INFO 19828 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : FrameworkServlet 'dispatcherServlet': initialization completed in 282 ms
2017-07-21 13:15:35.494 [http-nio-8080-exec-1] INFO 
                    o.s.web.servlet.DispatcherServlet-FrameworkServlet 'dispatcherServlet': initialization completed in 282 ms

应用dev.xml

#Spring Boot based configurations
management.security.enabled: "false"
spring.autoconfigure.exclude:  "org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration"
spring.batch.job.enabled: false
server.contextPath: /SpringJob

build.gradle片段

plugins {
    id 'jacoco'
    id 'org.sonarqube' version '2.5'
}

apply plugin: 'java'
apply plugin: 'eclipse'
apply plugin: 'idea'
apply plugin: 'org.springframework.boot'
apply plugin: "no.nils.wsdl2java"
apply plugin: 'jacoco'
apply plugin: "org.sonarqube"
dependencies {
    compile("org.springframework.boot:spring-boot-starter-web")
    compile("org.springframework.boot:spring-boot-starter-batch")
    compile("org.springframework.boot:spring-boot-starter-mail")
    //compile("org.springframework.boot:spring-boot-devtools")
    compile group: 'org.apache.commons', name: 'commons-lang3', version: '3.5'
    compile group: 'org.apache.cxf', name: 'cxf-spring-boot-starter-jaxws', version: '3.1.10'
    compile group: 'org.apache.cxf', name: 'cxf-rt-ws-security', version: '3.1.10'
    compile("org.springframework.boot:spring-boot-starter-actuator")
    testCompile('org.springframework.boot:spring-boot-starter-test')
}

控制器

@Controller
@EnableAutoConfiguration
@EnableBatchProcessing
public class MyController {
    @Autowired
    JobLauncher jobLauncher;

    @RequestMapping("/ExecuteJob")
    @ResponseBody
    public String callPrelegalJob(@RequestParam("user") String userName, @RequestParam("password") String password) {
        log.info("Job is to be launched from controller...");
}
}

Answer 1

尝试在application.properties文件中添加以下行

security.basic.enable: false
security.ignored=/**

根据spring doc，请使用security.ignored=

要从默认安全中排除的以逗号分隔的路径列表路径

Answer 2

在当前版本的Spring Boot（v2.1.0.RELEASE）中，解决安全问题的最简单方法是将“ WebSecurityConfig.java”添加到项目中，如下所示：

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();
    }

}

当然请注意，这消除了针对跨站点请求伪造的保护，因此，这实际上仅适用于简单的只读端点。

Answer 3

    if we use CXF security & Spring boot security it gives this issues.
    Comment out dependency i.e disable the spring boot security then it allows.

     <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-security</artifactId>      
     </dependency>

    to enable this we have to write custom security


Or add below config

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().permitAll();
    }
}

Answer 4

只需从pom.xml文件中删除spring安全性依赖项即可。为我工作：）..

Answer 5

您可以将springSecurityFilterChain配置为忽略所有请求，从而允许通过以下方式未经授权访问所有端点：

@Configuration
@EnableWebSecurity
public class WebConfiguration extends WebSecurityConfigurerAdapter {


    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/**");
    }

}

Answer 6

我无法找到禁用身份验证的确切方法。但是通过删除正在工作的执行器依赖性。

compile("org.springframework.boot:spring-boot-starter-actuator")

Answer 7

我解决了从pom.xml删除此依赖项的问题

 <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
 </dependency>

Answer 8

@ harshit-sharma的解决方案对我有用；我在主要的Application类中添加了排除项：

@SpringBootApplication（exclude = {SecurityAutoConfiguration.class}）

Answer 9

Spring Security可能仍通过传递依赖项位于项目库中。在Spring Boot中仍然应该运行以下内容：

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/**")
                .permitAll();
    }

注意：http是一个org.springframework.security.config.annotation.web.builders.HttpSecurity，它位于一个@Component中，可能已经被应用程序框架中的某些org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter implementation注入并被其调用。这应该覆盖任何内置的包罗万象子句，即http.authorizeRequests().anyRequest().denyAll()用于测试等。

SpringBoot 401 UnAuthorized即使没有安全性

9 个答案: