Question

我正在开发Spring应用程序，但是Swagger和Spring Security遇到了一些麻烦。我必须添加一个特定的配置以允许几乎所有访问（CORS），并且到目前为止效果很好，但是不知何故，它阻止了Swagger ....

这是我的SwaggerConfiguration.java

@Configuration
@EnableSwagger2
@SwaggerDefinition(
        info = @Info(
                description = "Web Service",
                version = "V0.0.1",
                title = "Web Service",
                contact = @Contact(
                        name = "Me",
                        email = "dev@me.com",
                        url = "https://www.me.com/"
                )
        ),
        consumes = {"application/json"},
        produces = {"application/json"},
        schemes = {SwaggerDefinition.Scheme.HTTP, SwaggerDefinition.Scheme.HTTPS}
)
public class SwaggerConfiguration {

    /** List of Swagger endpoints (used by {@code WebSecurityConfig}) */
    static final String[] SWAGGER_ENDPOINTS = {
            "/v2/api-docs",
            "/swagger-resources",
            "/swagger-resources/**",
            "/configuration/ui",
            "/configuration/security",
            "/swagger-ui.html",
            "/webjars/**"
    };

    @Bean
    public Docket swaggerSpringMvcPlugin() {
        return new Docket(DocumentationType.SWAGGER_2)
                .groupName("admin-api")
                .select()
                .paths(paths()) // and by paths
                .build();
    }

    private Predicate<String> paths() {
        return or(
                regex("/admin.*"),
                regex("/issuer.*"),
                regex("/validator.*"),
                regex("/data.*"));

    }
}

这是我的WebSecurityConfig.java：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private JwtTokenDecoder jwtTokenDecoder;


    @Bean
    // Mandatory to be able to have % in URL
    // FIXME Set it only for dev environment
    public HttpFirewall allowUrlEncodedPercentHttpFirewall() {
        StrictHttpFirewall firewall = new StrictHttpFirewall();
        firewall.setAllowUrlEncodedPercent(true);
        firewall.setAllowUrlEncodedSlash(true);

        return firewall;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .httpBasic().disable()
                .formLogin().disable()
                .logout().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        // Install the JWT authentication filter
        http.addFilterBefore(new JwtAuthenticationFilter(jwtTokenDecoder), BasicAuthenticationFilter.class);

        // Authorize only authenticated requests
        http.authorizeRequests()
                .anyRequest().authenticated();

       http.cors();
    }

    @Override
    public void configure(WebSecurity web) {
        // Allow access to /admin/login without authentication
        web.ignoring().mvcMatchers("/admin/login", "/admin/validate", "/campaigns", "/data/**", "/issuer/**", "/validator/**");
        web.ignoring().antMatchers(SwaggerConfiguration.SWAGGER_ENDPOINTS);
        web.httpFirewall(allowUrlEncodedPercentHttpFirewall());
    }
}

最后，我有一个WebConfig.java用于设置CORS授权。这是：

@Configuration
@EnableWebMvc
public class WebConfig implements WebMvcConfigurer {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                    .allowedOrigins("*")
                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE");
    }
}

非常简单。它应该授权几乎所有访问。当我删除它时，可从URL localhost：8080 / swagger-ui.html获得Swagger（但不能使用我的webservices ...）当我放回原位时，它被阻止，并显示403错误（禁止）

有什么想念我的东西吗？

Answer 1

所以解决方案是在WebConfig

中添加一些配置

我已经添加了此实现

@Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {

    registry
            .addResourceHandler("swagger-ui.html")
            .addResourceLocations("classpath:/META-INF/resources/");

    registry
            .addResourceHandler("/webjars/**")
            .addResourceLocations("classpath:/META-INF/resources/webjars/");
}

“ addCorsMapping”阻止Swagger UI

1 个答案: