在anyRequest之后无法配置antMatchers(多个antMatcher) [英] Can't configure antMatchers after anyRequest (Multiple antMatcher)

问题描述

我正在尝试配置Spring Security并出现以下错误:

I am trying to configure Spring Security and get this following error:

原因:java.lang.IllegalStateException:在anyRequest之后无法配置antMatchers

Caused by: java.lang.IllegalStateException: Can't configure antMatchers after anyRequest

这是我的 SecurityConfig 类:

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter{

    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

            auth.userDetailsService(userDetailsService).passwordEncoder(encodePWD());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception{

        http
            .csrf().disable();
        http
            .httpBasic()
                .and()
            .authorizeRequests()
                .antMatchers("/rest/**").permitAll()
                .anyRequest().authenticated()
                .and()
            .authorizeRequests()
                .antMatchers("/secure/**").hasAnyRole("ADMIN")
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .permitAll();

        http
            .authorizeRequests()
                .antMatchers("/login").permitAll();
    }

    @Bean
    public BCryptPasswordEncoder encodePWD(){
        return new BCryptPasswordEncoder();
    }
}

我已经尝试调用 httpSecurityauthorizeRequests().anyRequest().authenticated()，如提到的

I already tried call httpSecurityauthorizeRequests().anyRequest().authenticated() as mentioned here, still didn't work ...any suggestion would be helpfull.

推荐答案

按如下所示修改规则. .anyRequest().authenticated()只能使用一次.

Modify the rule as follows . .anyRequest().authenticated() to be used only once .

    http
        .httpBasic()
            .and()
        .authorizeRequests()
            .antMatchers("/rest/**").permitAll()
            .and()
        .authorizeRequests()
            .antMatchers("/secure/**").hasAnyRole("ADMIN")
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .permitAll();

这篇关于在anyRequest之后无法配置antMatchers(多个antMatcher)的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！