Question

即使添加http.authorizeRequests().anyRequest().permitAll();，所有请求也是未经授权的。

这是我的 WebSecurityConfig ：

@Configuration
@EnableWebSecurity 
@EnableGlobalMethodSecurity(
        securedEnabled = true,
        jsr250Enabled = true,
        prePostEnabled = true)   
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
UserDetailsServiceImpl userDetailsService;

@Autowired
private AuthEntryPointJwt unauthorizedHandler;

@Bean
public AuthTokenFilter authenticationJwtTokenFilter() {
    return new AuthTokenFilter();
}

@Override
public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
    authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}

@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
}

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests().anyRequest().permitAll();
}

有什么我想念的吗？

编辑：我还将该配置添加到了application.properties

security.basic.enable: false security.ignored=/**

Answer 1

配置类看起来不错。在运行项目之前，请确保“构建” 。我复制了您的配置文件，它对我有用。

春季启动所有请求未经授权

1 个答案: