Spring Config Server禁止加密 [英] spring config server encrypt forbidden

问题描述

我已经配置了 spring cloud配置服务器以使用oAuth2进行安全保护.除加密端点外，其他所有程序都运行良好.当我尝试访问/encrypt时，我收到403禁止访问.我在标题中包含了授权承载令牌.当使用oAuth保护服务器时，是否有一种方法可以允许调用加密端点，还是始终将其阻止?如果您要查看此服务器的任何配置文件，请告诉我.

I've configured a spring cloud config server to use oAuth2 for security. Everything is working well, except the encrypt end point. When I try to access /encrypt I get a 403 Forbidden. I am including the Authorization Bearer token in the header. Is there a way to allow the encrypt end point to be called when the server is secured with oAuth, or is it always blocked? Let me know if you would like to see any config files for this server.

仅供参考，以下是起作用的内容.

Just for reference, here are the things that are working.

• 调用/encrypt/status会产生{"status":"OK"}

由于我可以从服务器访问属性文件，因此git存储库已被拉出.

The git repository is being pulled because I can access a property file from the server.

oAuth身份验证与Google一起使用是因为它使我完成了登录过程.

oAuth authentication is working with Google because it takes me through the logon process.

这是弹簧安全设置.

    security: 
     require-ssl: true 
     auth2:  
       client:  
         clientId: PROVIDED BY GOOGLE  
         clientSecret: PROVIDED BY GOOGLE  
         accessTokenUri: https://www.googleapis.com/oauth2/v4/token  
         userAuthorizationUri: https://accounts.google.com/o/oauth2/v2/auth  
         scope:  
            - openid  
            - email  
            - profile  
      resource:  
         userInfoUri: https://www.googleapis.com/oauth2/v3/userinfo  
         preferTokenInfo: true  
       
    server:  
       port: 8443  
       ssl:  
         key-store-type: PKCS12  
         key-store: /spring-config-server/host/tomcat-keystore.p12  
         key-alias: tomcat  
         key-store-password: ${KEYSTORE_PASSWORD}

这是我对POM文件的依赖关系，因此您可以看到我正在使用的库的版本.

Here are my dependencies from the POM file so you can see the version of the libraries I'm using.

<parent>  
    <groupId>org.springframework.boot</groupId>  
    <artifactId>spring-boot-starter-parent</artifactId>  
    <version>2.0.0.RELEASE</version>  
    <relativePath/>  
    <!-- lookup parent from repository -->  
</parent>  
<properties>  
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>  
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>  
    <java.version>1.8</java.version>  
    <spring-cloud.version>Finchley.M8</spring-cloud.version>  
</properties>  
<dependencies>  
    <dependency>  
        <groupId>org.springframework.cloud</groupId>  
        <artifactId>spring-cloud-config-server</artifactId>  
    </dependency>  
    <dependency>  
        <groupId>org.springframework.boot</groupId>  
        <artifactId>spring-boot-starter-test</artifactId>  
    </dependency>  
    <dependency>  
        <groupId>org.springframework.cloud</groupId>  
        <artifactId>spring-cloud-security</artifactId>  
    </dependency>  
</dependencies>  
<dependencyManagement>  
    <dependencies>  
        <dependency>  
            <groupId>org.springframework.cloud</groupId>  
            <artifactId>spring-cloud-dependencies</artifactId>  
            <version>${spring-cloud.version}</version>  
            <type>pom</type>  
            <scope>import</scope>  
        </dependency>  
    </dependencies>  
</dependencyManagement>  

推荐答案

我解决了实现此WebSecurityConfigurer的问题.它会禁用CSRF并设置基本身份验证.在Spring Boot 2.0.0中，您无法使用属性强制禁用CSRF，它会强制您实现Java安全配置Bean.

I solve it implementing this WebSecurityConfigurer. It disables CSRF and set basic authentication.In Spring Boot 2.0.0 you cannot disable CSRF using properties it forces you to implement a java security config bean.

package my.package.config.server;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
@EnableWebSecurity
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests()
        .anyRequest().authenticated().and()
        .httpBasic();
;
    }


}

希望有帮助

这篇关于Spring Config Server禁止加密的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！