Question

我有这个Spring Boot应用程序，带有一个用于Login端点的控制器。我已经设置了以下网络配置：

    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(securedEnabled = true, jsr250Enabled = true, prePostEnabled = true)
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter {


        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.cors().and().csrf().disable().authorizeRequests()
                    .antMatchers(HttpMethod.POST, PathConstants.USER_AUTH +"/**", PathConstants.HELIOS+"/dashboard/**").permitAll()
                    .antMatchers(HttpMethod.GET, "/"+PathConstants.PROCESS_DEFINITION+"/**").permitAll()
                    .antMatchers(HttpMethod.POST, "/"+PathConstants.PROCESS_DEFINITION+"/**").permitAll()
                    .antMatchers(HttpMethod.GET, "/"+PathConstants.PROCESS_INSTANCE+"/**").permitAll()
                    //.antMatchers(HttpMethod.POST,  PathConstants.LOGIN_ACTION).permitAll()
                    //.anyRequest().authenticated()
                    .anyRequest().permitAll()
                    .and()
                    .exceptionHandling().authenticationEntryPoint(jwtAuthEntryPoint).and()
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
            // custom jwt filter.
            http.addFilterBefore(jwtAuthFilter(), UsernamePasswordAuthenticationFilter.class);
        }

和Web MVC配置：

    @Configuration
    @EnableWebMvc
    public class WebMvcConfiguration implements WebMvcConfigurer {
    private final long MAX_AGE = 3600;



    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**")
                .allowedOrigins("*")
                .allowedMethods("HEAD", "OPTIONS", "GET", "POST", "PUT", "PATCH", "DELETE")
                .allowedHeaders("Content-Type", "X-Requested-With", "accept", "Origin", "Access-Control-Request-Method",
                        "Access-Control-Request-Headers")
                .exposedHeaders("Access-Control-Allow-Origin", "Access-Control-Allow-Credentials")
                .maxAge(MAX_AGE);
    }

我也尝试添加.allowCredentials(true)，但是当我执行登录操作时，它给了我跨源错误，并且我的请求被阻止了。
这是我的控制器类：

    @RestController
    @RequestMapping
    @CrossOrigin
    public class AuthenticationControllerImpl implements AuthenticationController {





        @PostMapping(PathConstants.LOGIN_ACTION)
        @Override
        public SysdataUser autenticate(@Valid @RequestBody LoginRequest request) {

            Authentication auth = authManager
                    .authenticate(new UsernamePasswordAuthenticationToken(request.getUsername(), request.getPassword()));
            SecurityContextHolder.getContext().setAuthentication(auth);
            String token = jwtProvider.generateToken(auth);
            SysdataUser user = sysdataUserService.getUserProfile(request.getUsername());
            user.setToken(token);
            return user;
        }

配置中缺少什么？

Answer 1

我不知道您的配置为什么不覆盖默认行为。这就是我的工作，并且对我一直有效，请将AuthenticationControllerImpl类中的@CrossOrigin更改为@CrossOrigin(origins = "*")。让我知道它是否对您有用。

Spring Boot Cross源阻止请求

1 个答案: