用Spring Boot 2代替403而不是403 [英] 401 instead of 403 with Spring Boot 2

问题描述

使用 Spring Boot 1.5.6.RELEASE I能够发送HTTP状态代码 401 而不是 403 ，如如果没有认证请求uri，如何让Spring安全响应未经授权（http 401代码），通过这样做：

With Spring Boot 1.5.6.RELEASE I was able to send HTTP Status code 401 instead of 403 as described in How let spring security response unauthorized(http 401 code) if requesting uri without authentication, by doing this:

public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //...
        http.exceptionHandling()
                .authenticationEntryPoint(new Http401AuthenticationEntryPoint("myHeader"));
        //...
    }
}

使用 org.springframework.boot.autoconfigure.security.Http401AuthenticationEntryPoint class。

我刚升级到 Spring Boot 2.0.0.RELEASE 并且发现不再有这样的课程（至少在那个课程中）。

I just upgraded to Spring Boot 2.0.0.RELEASE and found there is not such class any more (at least in that package).

问：
这是否Spring Boot中是否存在class（ Http401AuthenticationEntryPoint ）？如果不是，那么在现有项目中保持相同行为以保持与依赖于此状态代码的其他实现（ 401 ）的一致性可能是一个很好的替代方案，而不是 403 ？

Q: Does this class (Http401AuthenticationEntryPoint) exist yet in Spring Boot? If no, what could be a good alternative for keeping the same behavior in an existing project in order to keep consistency with other implementations which depend on this status code (401) instead of 403?

推荐答案

班级组织。 springframework.boot.autoconfigure.security.Http401AuthenticationEntryPoint 已被删除，转而使用 org.springframework.security.web.authentication.HttpStatusEntryPoint 。

The class org.springframework.boot.autoconfigure.security.Http401AuthenticationEntryPoint was removed in favor of org.springframework.security.web.authentication.HttpStatusEntryPoint.

在我的情况下，代码将如下所示：

In my case the code would go like this:

public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //...
        http.exceptionHandling()
                .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED));
        //...
    }
}

这篇关于用Spring Boot 2代替403而不是403的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！