如何在开发时禁用 Spring 安全性？ [复制]答案

【问题标题】：How do i disable Spring security while developing? [duplicate]如何在开发时禁用 Spring 安全性？ [复制]
【发布时间】：2020-12-06 23:15:26
【问题描述】：

我正在使用 Spring Boot 开发服务器。我有所有的弹簧安全设置，但为了测试，我想停用它，以便更容易测试。我只是继续在课堂上评论了@Configuration 注释，最终所有 3 个我都使用我为 Spring 安全性构建的注释。

//@Configuration
//@EnableWebSecurity
//@EnableGlobalMethodSecurity(securedEnabled = true, jsr250Enabled = true, prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserService service;
    
    @Autowired
    private LogRepository logs;
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
            .authorizeRequests()
            .antMatchers(HttpMethod.POST, "/rest/user/register").permitAll()
            .antMatchers(HttpMethod.PUT, "/rest/user/login").permitAll()
            .antMatchers(HttpMethod.DELETE, "/rest/user/logout").permitAll()
            .antMatchers("/rest/").authenticated()
            .anyRequest().permitAll().and()
            .addFilterBefore(new LoginFilter("/rest/user/login", super.authenticationManagerBean(), service, logs), BasicAuthenticationFilter.class)
            .addFilterBefore(new RegisterFilter("/rest/user/register", super.authenticationManagerBean(), service), BasicAuthenticationFilter.class)
            .addFilterBefore(new LogoutFilter("/rest/user/logout", logs), BasicAuthenticationFilter.class)
            .addFilterBefore(new ValidationFilter(service), BasicAuthenticationFilter.class);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(service).passwordEncoder(new SHA512PasswordEncoder());
    }
    
    class SHA512PasswordEncoder implements PasswordEncoder {

        @Override
        public String encode(CharSequence rawPassword) {
            return DigestUtils.sha512Hex(rawPassword.toString());
        }

        @Override
        public boolean matches(CharSequence rawPassword, String encodedPassword) {
            return DigestUtils.sha512Hex(rawPassword.toString()).equals(encodedPassword);
        }
        
    }
}

然而，由于某种原因，当我这样做时，它会显示在 spring 控制台中：

==========================
CONDITION EVALUATION DELTA
==========================


Positive matches:
-----------------

   ManagementWebSecurityAutoConfiguration matched:
      - @ConditionalOnClass found required class 'org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter' (OnClassCondition)
      - found 'session' scope (OnWebApplicationCondition)
      - @ConditionalOnMissingBean (types: org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; SearchStrategy: all) did not find any beans (OnBeanCondition)

有没有一种方法可以让我“关闭”spring security 进行测试，然后为实时版本重新激活它？

【问题讨论】：

标签： java spring spring-boot spring-security

【解决方案1】：

有很多方法可以做到这一点，以下是少数：

在你的测试类中使用注解@AutoConfigureMockMvc(addFilters = false)。示例：

@EnableWebMvc
@AutoConfigureMockMvc(addFilters = false)
public class DummyControllerTest {
    //your tests
}

在您的配置中使用配置文件，即：

i) 将注解@Profile(value = {"development", "production"}) 添加到WebSecurityConfigurerAdapter 的实现中，然后在test/resources 中，创建application-test.yml 以定义测试配置文件的属性并添加此
```
security:basic:enabled: false
```
ii) 将此添加到您的测试文件@ActiveProfiles(value = "test")

【讨论】：