spring security permitAll 仍在考虑在 Authorization 标头中传递的令牌，如果令牌无效则返回 401 [英] spring security permitAll still considering token passed in Authorization header and returns 401 if token is invalid

问题描述

我在我的项目中使用 spring security oauth.我通过在 spring 安全性 ResourceServerConfigurerAdapter 中配置来从身份验证中排除一些 url.我添加了 http.authorizeRequests().antMatchers(url).permitAll().

I am using spring security oauth in my project. I am excluding some urls from authentication by configuring in spring security ResourceServerConfigurerAdapter. I added http.authorizeRequests().antMatchers(url).permitAll().

现在，我看到的是，如果我不将 Authorization 标头传递给这些 url，则它不会通过身份验证.并且 API 被正确调用.

Now, what I am seeing is that, if I don't pass the Authorization header to these urls, it is not authenticated. And the API is called properly.

如果调用带有 Authorization 标头，则它会验证令牌，如果令牌未经过验证，则调用失败.

If the call is made with an Authorization header, then it validates the token and fails the call if the token is not validated.

我的问题是我需要做什么才能在我拥有 permitAll 的请求中忽略令牌.

My question is what do I need to do so that the token is ignored in the request for which I have permitAll.

推荐答案

Spring OAuth2 将拦截所有带有 header: Authorization Bearer xxx. 的 url.

Spring OAuth2 will intercept all url with header: Authorization Bearer xxx.

为了避免 Spring OAuth2 拦截 url.我创建了一个比 Spring OAuth2 配置更高阶的 SecurityConfiguration.

To avoid Spring OAuth2 from intercept the url. I have created a SecurityConfiguration which has higher order than Spring OAuth2 configuration.

@Configuration
@EnableWebSecurity
@Order(1) // this is important to run this before Spring OAuth2 
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        List<RequestMatcher> requestMatchers = new ArrayList<RequestMatcher>();
        // allow /api/public/product/** and /api/public/content/** not intercepted by Spring OAuth2
        requestMatchers.add(new AntPathRequestMatcher("/api/public/product/**"));
        requestMatchers.add(new AntPathRequestMatcher("/api/public/content/**"));

    http
        .requestMatcher(new OrRequestMatcher(requestMatchers))
    .authorizeRequests()
      .antMatchers("/api/public/product/**", "/api/public/content/**").permitAll()
    }
}

上面的配置允许/api/public/product/**和/api/public/content/**由这个配置处理，而不是Spring OAuth2，因为这个配置有更高的@Order.

The above configuration allows /api/public/product/** and /api/public/content/** to be handled by this configuration, not by Spring OAuth2 because this configuration has higher @Order.

因此，即使将无效令牌设置为上述 api 调用也不会导致访问令牌无效.

Therefore, even setting invalid token to above api call will not result in invalid access token.

这篇关于spring security permitAll 仍在考虑在 Authorization 标头中传递的令牌，如果令牌无效则返回 401的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！