每次都拒绝403访问Spring Security

Question

每条具有模式/ admin的请求都会得到403 我只需要限制/ admin作为管理员角色。

方法失败：

1. 尝试在控制器上使用@PreAuthorize(hasRole('ADMIN'))和@PreAuthorize(hasRole('ROLE_ADMIN'))，但没有运气。
2. 尝试从控制器中删除@PreAuthorize并在下面的类中使用hasRole但没有运气添加模式

下面是该类的扩展WebSecurityConfigurerAdapter

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter{

    @Autowired
    AuthenticationEntryPoint authenticationEntryPoint;

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
            .exceptionHandling()
                .authenticationEntryPoint(authenticationEntryPoint)
                .and()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
            .authorizeRequests()

                .antMatchers(HttpMethod.OPTIONS).permitAll()
              .antMatchers(HttpMethod.GET,"/admin/**").hasAnyRole("ADMIN","ADMIN_TENANT")
                .anyRequest().authenticated()
                .and()
            .logout()
                .permitAll()
                .and()
            .csrf()
                .disable();
        httpSecurity.
            addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);

        httpSecurity.
            headers().cacheControl().disable();
    }

已经尝试过类似问题中提到的解决方案，但是没有运气。 因此，请不要将其标记为重复。

Answer 1

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter{

    @Autowired
    AuthenticationEntryPoint authenticationEntryPoint;

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
            .exceptionHandling()
                .authenticationEntryPoint(authenticationEntryPoint)
                .and()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
            .authorizeRequests()

                .antMatchers(HttpMethod.OPTIONS).permitAll()
              .antMatchers(HttpMethod.GET,"/admin/**").hasAnyRole("ADMIN","ADMIN_TENANT") // change hasAnyrole to hasAnyAuthority
                .anyRequest().authenticated()
                .and()
            .logout()
                .permitAll()
                .and()
            .csrf()
                .disable();
        httpSecurity.
            addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);

        httpSecurity.
            headers().cacheControl().disable();
    }

Answer 2

我类似的Git项目：here

    // Config to check if already active
    http.authorizeRequests()
    .and() 
    .rememberMe()
    .tokenRepository(new JdbcTokenRepositoryImpl().setDataSource(//datasource_name) )
     .tokenValiditySeconds(//TimeInterval in sec); 

}