Question

我遇到有关Spring启动应用程序的控制器请求的问题。

我已经制作了证书，以便在https上运行该应用。证书工作正常，有效。

我的主要问题是，当我通过邮递员从控制器测试我的方法时，他们（网址请求）在https和http上工作正常...... 它不适用于http 。有人可以为此提供帮助吗？

这是我的WebSecurityConfig类：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    public static final String AUTHENTICATED_HEADER_NAME = "Authenticated";
    public static final String AUTHENTICATED_TRUE = "true";
    public static final String AUTHENTICATED_FALSE = "false";

    @Autowired
    public void globalUserDetails(final AuthenticationManagerBuilder auth) throws Exception {
        PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();

        auth.userDetailsService(authenticationManager).passwordEncoder(passwordEncoder);
    }


    @Override
    @Bean(value = "authenticationManagerBean")
    public org.springframework.security.authentication.AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Configuration
    @Order(1)
    public static class HTTPBasicSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {

        //todo check how we can change the root url of swagger
        @Override
        public void configure(WebSecurity web) throws Exception {
            web.ignoring().antMatchers("/documentation**", "/configuration/**", "/v2/api-docs**", "/swagger-ui.html", "/webjars/**", "/swagger-resources/**");
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            //todo http basic allows access to all urls after login
            http
                    .httpBasic()
                    .and()
                    .csrf().disable()
                    .antMatcher("/api/**")
                    .authorizeRequests()
                    .antMatchers("/login").permitAll()
                    .anyRequest()
                    .authenticated();

        }
    }

    @Configuration
    @Order(2)
    public static class FormLoginSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf()
                    //todo more investigation is required to check if it is safe to ignore csrf for login
                    .ignoringAntMatchers("/login")
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                    .and()
                    .authorizeRequests()
                    .antMatchers("/login").permitAll()
                    .anyRequest().authenticated()
                    .and()
                    .formLogin()
                    .permitAll()
                    .successHandler((httpServletRequest, httpServletResponse, authentication) -> {
                        httpServletResponse.setHeader(AUTHENTICATED_HEADER_NAME, AUTHENTICATED_TRUE);
                    })
                    .failureHandler((httpServletRequest, httpServletResponse, e) -> {
                        httpServletResponse.setHeader(AUTHENTICATED_HEADER_NAME, AUTHENTICATED_FALSE);
                        httpServletResponse.setStatus(SC_UNAUTHORIZED);
                    })
                    .and()
                    .logout().permitAll()
                    .and()
                    .addFilterBefore(new CorsFilter(), ChannelProcessingFilter.class)
                    .addFilterBefore(new CsrfHeaderFilter(), CsrfFilter.class);
            http.exceptionHandling().authenticationEntryPoint((HttpServletRequest request, HttpServletResponse response,
                                                               AuthenticationException authException) -> {
                if (authException != null) {
                    response.setStatus(SC_UNAUTHORIZED);
                }
            });
        }
    }

    @Configuration
    @Order(3)
    public static class TestClass extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {

            http.headers()
                    .httpStrictTransportSecurity()
                    .includeSubDomains(true)
                    .maxAgeInSeconds(31536000);
        }
    }
}

这是我的春季启动版

<parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>1.4.2.RELEASE</version>
        <relativePath></relativePath>
</parent>

Answer 1

您的问题涉及以下几点：

您可以通过添加security.require_ssl=true配置属性（请参阅the Spring Boot reference documentation about HTTPS）
或使用以下配置代码段http.requiresChannel().anyRequest().requiresSecure();
您可能希望使用HSTS in Spring Security

Answer 2

以上都没有帮助我的情况。我发现chrome（postman）会自动将我的http请求转换为https。在其他浏览器上，http请求无效。

控制器请求在https和http上正常工作。它应该只适用于https

2 个答案: