Spring Security antMatcher不起作用 [英] Spring security antMatcher does not work
问题描述
我进一步深入研究了该问题,结果发现即使使用单一配置,问题仍然存在.如果我使用单一配置并保留
I further drilled down the problem and turns out issue persists even with single configuration. If I use single configuration and keep
http.antMatcher("/api/test/**")
网址不安全. 删除antMatcher和antMatchers会立即保护该URL. 即如果我使用:
urls don't get secured. Removing the antMatcher and antMatchers immediately secures the url. i.e if I use:
http.httpBasic()
.and()
.authorizeRequests()
.anyRequest()
.authenticated();
然后只有spring安全措施可以确保url的安全. antMatcher为什么不起作用?
then only spring security is securing url. Why isn't antMatcher functioning?
(已更新标题以包括实际问题.)
(Updated the title to include actual issue.)
原始帖子:
我已经提到了以下stackoverflow问题:
I have referred following stackoverflow questions:
将多个WebSecurityConfigurerAdapter与不同的AuthenticationProvider一起使用(API的基本auth和LDAP的LDAP网络应用程序)
和春季安全性文档:
但是我无法配置多个http安全元素. 当我遵循官方的spring文档时,由于第二个http安全元素是一个包罗万象的事实,因此在我的情况下它起作用,但是一旦我添加了特定的URL,就可以在不进行任何身份验证的情况下访问所有URL.
But I am not able to configure multiple http security elements. When I follow the official spring doc, it works in my case only becuase of the fact that the second http security element is a catch-all, but as soon as I add a specific url, all the urls can be accessed without any authentication.
这是我的代码:
@EnableWebSecurity
@Configuration
public class SecurityConfig {
@Bean
public UserDetailsService userDetailsService() throws Exception {
InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
manager.createUser(User.withUsername("user").password("userPass").roles("USER").build());
manager.createUser(User.withUsername("admin").password("adminPass").roles("ADMIN").build());
return manager;
}
@Configuration
@Order(1)
public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
@Override
public void configure(AuthenticationManagerBuilder auth)
throws Exception {
auth.inMemoryAuthentication().withUser("user").password("user").roles("USER");
auth.inMemoryAuthentication().withUser("admin").password("admin").roles("ADMIN");
}
protected void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/api/v1/**")
.authorizeRequests()
.antMatchers("/api/v1/**").authenticated()
.and()
.httpBasic();
}
}
@Configuration
@Order(2)
public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
@Override
public void configure(AuthenticationManagerBuilder auth)
throws Exception {
auth.inMemoryAuthentication().withUser("user1").password("user").roles("USER");
auth.inMemoryAuthentication().withUser("admin1").password("admin").roles("ADMIN");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/api/test/**")
.authorizeRequests()
.antMatchers("/api/test/**").authenticated()
.and()
.formLogin();
}
}
}
现在可以访问任何URL.如果我从第二个配置中删除antMatcher,则所有URL都将得到保护.
Now any url can be accessed. If I remove antMatcher from second configuration, all the urls become secured.
推荐答案
The pattern must not contain the context path, see AntPathRequestMatcher
:
匹配器,它将预定义的蚂蚁样式模式与
HttpServletRequest
的URL(servletPath
+pathInfo
)进行比较.
Matcher which compares a pre-defined ant-style pattern against the URL (
servletPath
+pathInfo
) of anHttpServletRequest
.
和 HttpServletRequest.html#getServletPath
:
返回此请求的URL中调用servlet的部分.该路径以"/"字符开头,包括servlet名称或servlet路径,但不包含任何额外的路径信息或查询字符串.与CGI变量SCRIPT_NAME的值相同.
Returns the part of this request's URL that calls the servlet. This path starts with a "/" character and includes either the servlet name or a path to the servlet, but does not include any extra path information or a query string. Same as the value of the CGI variable SCRIPT_NAME.
和 HttpServletRequest.html#getContextPath
:
返回请求URI中指示请求上下文的部分.上下文路径总是在请求URI中排在第一位.路径以"/"字符开头,但不以"/"字符结尾.对于默认(根)上下文中的servlet,此方法返回".容器不会解码此字符串.
Returns the portion of the request URI that indicates the context of the request. The context path always comes first in a request URI. The path starts with a "/" character but does not end with a "/" character. For servlets in the default (root) context, this method returns "". The container does not decode this string.
您修改和简化的代码:
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/test/**")
.authorizeRequests()
.anyRequest().authenticated()
.and()
.formLogin();
}
这篇关于Spring Security antMatcher不起作用的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!