如何使用 WebFluxConfigurer 完全禁用 Swagger 3.0.0 的身份验证？

Question

如果我遗漏了一些重要信息，我深表歉意，因为我对这些库没有经验。随意问他们！ :)

我正在使用 Spring Boot 2.3.2.RELEASE 与 Spring Cloud Hoxton.SR6 和 Springfox 3.0.0。我使用的安全性是spring-boot-starter-security。以下是相关的pom.xml 依赖项：

pom.xml

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

<dependency>
    <groupId>io.springfox</groupId>
    <artifactId>springfox-boot-starter</artifactId>
    <version>3.0.0</version>
</dependency>

<dependency>
    <groupId>io.springfox</groupId>
    <artifactId>springfox-swagger-ui</artifactId>
    <version>${springfox.version}</version>
</dependency> 

我在Application 上使用了以下注解：

• @EnableWebFlux
• @EnableDiscoveryClient
• @SpringBootApplication

这是我的SwaggerResourceProvider 的示例：

return () -> Stream.of(
  swaggerResource("Commander", "/docs/commander", "1.0"),
  ...
  swaggerResource("Querier", "/docs/querier", "3.0")
).collect(Collectors.toList());

这是我的SwaggerResource：

private SwaggerResource swaggerResource(String name, String location, String serviceHighestVersion) {
  SwaggerResource swaggerResource = new SwaggerResource();
  swaggerResource.setName(name);
  swaggerResource.setLocation(location);
  swaggerResource.setSwaggerVersion(serviceHighestVersion);
  return swaggerResource;
}

这是我的SecurityConfig：

@EnableSwagger2
public class SecurityConfig {

  @Bean
  public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    ServerHttpSecurity http_ = http
        .csrf().disable()
        .cors().disable()
        .httpBasic().disable();

    http_
        .authorizeExchange()
        .pathMatchers(
            "/v2/api-docs",
            "/swagger-resources/**",
            "/swagger-ui.html**",
            "/webjars/**",
            "/swagger-ui/**",
            "favicon.ico"
        )
        .permitAll()
        .anyExchange()
        .permitAll();
    return http_.build();
  }

  @Bean
  public ReactiveAuthenticationManager authManager() {
    return (authentication) -> {
      authentication.setAuthenticated(false);
      return Mono.just(authentication);
    };
  }

最后（我认为）是WebFluxConfigurer：

public class SwaggerUiWebFluxConfigurer implements WebFluxConfigurer {

  @Override
  public void addResourceHandlers(ResourceHandlerRegistry registry) {

    registry.addResourceHandler("/swagger-ui.html**")
        .addResourceLocations("classpath:/META-INF/resources/");

    registry.addResourceHandler("/webjars/**")
        .addResourceLocations("classpath:/META-INF/resources/webjars/");
  }

  @Bean
  public Docket restApi() {
    return new Docket(DocumentationType.SWAGGER_2)
        .apiInfo(apiInfo())
        .genericModelSubstitutes(Optional.class)
        .select()
        .paths(PathSelectors.any())
        .apis(RequestHandlerSelectors.any())
        .build()
        .useDefaultResponseMessages(false);
  }

  @Bean
  UiConfiguration uiConfig() {
    return UiConfigurationBuilder.builder()
        .docExpansion(DocExpansion.LIST)
        .build();
  }

  private ApiInfo apiInfo() {
    return new ApiInfoBuilder()
        .title("Workflow Services")
        .description("Workflow Services API Description")
        .contact(
            new Contact(
                "My Team",
                "https://moo.com",
                "hello@there.com"))
        .version("1.0.0")
        .build();
  }
}

我去 http://localhost:8080/swagger-ui 并被转发到 http://localhost:8080/login

我想只为 swagger 禁用安全性。有什么帮助吗？

Answer 1

就用这个吧，

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/v2/api-docs",
            "/configuration/ui",
            "/swagger-resources/**",
            "/configuration/security",
            "/swagger-ui/**",
            "/swagger-ui",
            "/webjars/**");
}