避免在 SecurityConfigurer 适配器中调用 swagger URL - Spring boot security答案

【问题标题】：Avoid swagger URL getting called in SecurityConfigurer adapter - Spring boot security避免在 SecurityConfigurer 适配器中调用 swagger URL - Spring boot security
【发布时间】：2021-11-19 17:26:03
【问题描述】：

我的整个配置看起来像这样，已尝试使用过滤器进行以下配置，但无法忽略始终发生的 swagger 身份验证。如何避免这种情况

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SeqConfiguration extends WebSecurityConfigurerAdapter {

private final SampleConfigurer sampleConfigurer;

  @Autowired
  public SecurityConfiguration(SampleConfigurer sampleConfigurer) {
    this.sampleConfigurer= sampleConfigurer;
  }

@Bean
  @Override
  public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
  }

@Override
  public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/api-docs/", "/swagger-ui/**");
  }

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable().sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().authorizeRequests()
        .anyRequest().authenticated().and().apply(sampleConfigurer);
  }

}



@Component
public class SampleConfigurer extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> {

    private final SampleTokenFilter sampleTokenFilter;

    public SampleConfigurer(SampleTokenFilter sampleTokenFilter) {
        this.sampleTokenFilter= sampleTokenFilter;
    }

    @Override
    public void configure(HttpSecurity builder) throws Exception {
        builder.addFilterBefore(sampleTokenFilter, UsernamePasswordAuthenticationFilter.class);
    }
}


@Component
public class SampleTokenFilter extends OncePerRequestFilter { 

@Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
      FilterChain filterChain) throws ServletException, IOException {
... this is getting called even for swagger.... How to avoid this.

}

}

问题：

SampleTokenFilter dofilter 方法被调用，即使是 swagger ui urls
如何仅针对 swagger** 跳过过滤器身份验证？

【问题讨论】：

标签： spring spring-boot spring-security swagger-ui

【解决方案1】：

只需在您的过滤器中添加一个检查

if(request.getServletPath().contains("/swagger-ui")){
  filterChain.doFilter(request, response);
}

【讨论】：