Question

我正在尝试通过Spring Security的@Secured注释保护REST端点。我的主应用程序（带有安全配置的Spring Boot App）和其余控制器位于不同的程序包和项目中。

主应用程序包：com.myapp.api.web

其他控制器包：com.myapp.api.rest

Mainapp：

@SpringBootApplication
@ComponentScan(basePackages = "com.myapp.api")
@EntityScan("com.myapp.api")
@RestController
public class ApiApplication extends SpringBootServletInitializer
{
public static void main(String[] args)
{
    SpringApplication.run(ApiApplication.class, args);
}

@Override
protected SpringApplicationBuilder configure(SpringApplicationBuilder application)
{
    return application.sources(ApiApplication.class);
}

}

安全配置：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true, 
securedEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter
{
private static final String USERS_CONFIG_FILE_NAME = "users.yml";

@Override
protected void configure(HttpSecurity http) throws Exception
{
    http
        .httpBasic()
        .and()
        .csrf().disable();

    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}

@Bean
public PasswordEncoder passwordEncoder()
{
    return new BCryptPasswordEncoder();
}

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth,
    InMemoryUserDetailsManager inMemoryUserDetailsManager, PasswordEncoder passwordEncoder) throws Exception
{
    auth.userDetailsService(inMemoryUserDetailsManager).passwordEncoder(passwordEncoder);
}

@Bean
public InMemoryUserDetailsManager inMemoryUserDetailsManager() throws IOException
{
    return new InMemoryUserDetailsManager(
        PropertiesLoaderUtils.loadAllProperties(USERS_CONFIG_FILE_NAME, getClass().getClassLoader()));
}

}

其他控制器：

@RestController
public class RestController
{

private final RestService service;

@PostMapping("/rest/v1")
@Secured({"ROLE_ADMIN"})
public List<String> getStates(@RequestBody List<String> Ids)
{
    ...
}

只要我未设置 securedEnabled = true ，我的其余端点都可以正常工作。将其设置为 true 后，我收到404 Not Found作为响应消息。我已经调试了它，发现Spring Security有时会在过滤器链中停止，并且请求永远不会到达控制器。

据我测试，只要其余控制器在另一个项目中，就会发生此错误。将其移至同一项目后，它应能正常工作。

我的Securityconfig中是否缺少某些东西？问题可能是什么？

Answer 1

我能够通过您的代码获取值，我只将密码编码器更改为默认值，并更改了MemoryAuthentication。我这样做是因为我没有您的文件“ users.yml”。如果您可以共享一个示例，我们将在其中进行查找，但是下面是我的代码。我将所有逻辑都保存在2个文件中，只是为了进行验证。

配置类

package com.myapp.api.web.Api;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true, 
securedEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter
{
private static final String USERS_CONFIG_FILE_NAME = "users.yml";

@Override
protected void configure(HttpSecurity http) throws Exception
{
    http
        .httpBasic()
        .and()
        .csrf().disable();

    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
@Bean
public PasswordEncoder passwordEncoder() {
    return new PasswordEncoder() {
        @Override
        public String encode(CharSequence rawPassword) {
            return rawPassword.toString();
        }
        @Override
        public boolean matches(CharSequence rawPassword, String encodedPassword) {
            return rawPassword.toString().equals(encodedPassword);
        }
    };
}

@Override
protected void configure(AuthenticationManagerBuilder builder) throws Exception {
    builder.inMemoryAuthentication()
      .withUser("user").password("user").roles("USER")
      .and().withUser("admin").password("admin").roles("ADMIN");
}
/*
@Bean
public InMemoryUserDetailsManager inMemoryUserDetailsManager() throws IOException
{


    return new InMemoryUserDetailsManager(
        PropertiesLoaderUtils.loadAllProperties(USERS_CONFIG_FILE_NAME, getClass().getClassLoader()));
}*/
}

主班

package com.myapp.api.web.Api;

import java.util.List;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.security.access.annotation.Secured;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;

@ComponentScan(basePackages = "com.myapp.api")
@RestController
@SpringBootApplication
public class ApiApplication {

    public static void main(String[] args) {
        SpringApplication.run(ApiApplication.class, args);
    }
    @PostMapping("/rest/v1")
    @Secured({"ROLE_ADMIN"})
    public List<String> getStates(@RequestBody List<String> Ids)
    {
        return Ids;
       // ...
    }

}

Spring Security：使用@Secured进行安全保护后，找不到剩余端点

1 个答案: