如何在 Spring Boot 上使用 Spring Security 测试 Rest 服务？

Question

我正在开展一个项目，该项目涉及在 Spring Boot 上创建一个 rest 服务，该服务最终将与 Angular Web App 和 Discord Bot 一起使用。

我目前正在处理后端并尝试对端点进行单元测试。由于最终未登录的用户只能发出 GET 请求。但是，由于某种原因，当我对端点进行单元测试时，它会以错误 403 的形式返回。即使我告诉 Spring Security 允许任何请求。

安全配置

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {

    //http.authorizeRequests().antMatchers("/api/*").permitAll();
    http.authorizeRequests().anyRequest().permitAll();
    //      .authorizeRequests()
    //          .antMatchers("/api/**/rule","/api/**/rules" )
    //              .permitAll()
    //              .anyRequest()
    //              .permitAll()
    //      .and()
    //          .formLogin()
    //              .loginPage("/login")
    //              .permitAll()
    //      .and()
    //          .logout()
    //              .permitAll();
}

@Autowired
public void configureAuth(AuthenticationManagerBuilder auth) throws Exception{
    auth
        .inMemoryAuthentication()
            .withUser("admin").password("password").roles("ADMIN", "USER", "EDITOR").and()
            .withUser("user").password("password").roles("USER", "EDITOR");
}



    }

JUnit 测试

@RunWith(SpringRunner.class)
@SpringBootTest()
@AutoConfigureMockMvc
public class TestSFRuleController {

ObjectMapper mapper = new ObjectMapper();


@Autowired
MockMvc mvc;

@Autowired
SFRuleRepo repo;

@Before
public void setUp(){
    repo.deleteAll();

}

@Test
@WithMockUser(username = "admin")
public void testInsertNewRule() throws Exception {
    SFRule rule = new SFRule("test insert rule", "test desc");
    String json = mapper.writeValueAsString(rule);
    mvc.perform(
            post(StarfinderController.PREFIX_URL + StarfinderController.RULE_URL)
            .content(json))
            .andExpect(status()
                    .isOk())
            .andExpect(jsonPath("$.id").isNotEmpty())
            .andExpect(jsonPath("$.name").value("test insert rule"));

}

}

控制器

@RestController
@RequestMapping("/api/sf")
public class StarfinderController {


@Autowired
SFRuleRepo ruleRepo;

public static final String PREFIX_URL = "/api/sf";

public static final String RULE_URL = "/rule";
public static final String RULES_URL = "/rules";

public static final String RULE_REPO = "RULE";


public static final String PAGE = "page";
public static final String COUNT = "count";

@GetMapping(RULE_URL)
public Rule getRule(@RequestParam(value = "name", required = true) String name) {

    return ruleRepo.findByName(name);

}

@GetMapping(RULES_URL)
public List<Rule> getRules(@RequestParam(value = "tag", required = false, defaultValue = "") String tagName,
        @RequestParam(value = "page", required = false) int page,
        @RequestParam(value = "count", required = false) int count) {

    if (!tagName.isEmpty()) {
        // noop

    } else {
        //TODO: add support for page and count

        List<Rule> list = new LinkedList<Rule>();
        list.addAll(ruleRepo.findAll());
        return list;
    }

    return null;

}

@PostMapping(RULE_URL)
public Rule addRule(SFRule rule) {
    return ruleRepo.save(rule);
}

@PutMapping(RULE_URL)
public Rule updateRule(SFRule rule) {
    Optional<SFRule> savedRule = ruleRepo.findById(rule.getId());

    if (savedRule.isPresent()) {
        SFRule sv = savedRule.get();
        sv.setName(rule.getName());
        sv.setDesc(rule.getDesc());
        return ruleRepo.save(sv);
    } else {
        return null;
    }

}

@DeleteMapping(RULE_URL)
public void deleteRule(SFRule rule) {
    ruleRepo.delete(rule);
}

}

Answer 1

这应该可以，只需将网址放入.antMatcher().permitAll()

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
        .antMatchers("/targetURL/**").permitAll()     
}