Spring Boot 安全性 - 未经授权的 URL

Question

我有这个 SpringBoot 安全配置：

  @Override
        protected void configure(HttpSecurity http) throws Exception {


            http
                    .authorizeRequests()
                    .antMatchers(HttpMethod.PUT, "/api/**").permitAll()
                    .antMatchers(publicMatchers()).permitAll()
                    .anyRequest().authenticated()
                    .and()
                    .formLogin().loginPage("/login").defaultSuccessUrl("/book/list")
                    .failureUrl("/login?error").permitAll()
                    .and()
                    .logout().permitAll();
        }

 private String[] publicMatchers() {

         /** Public URLs. */
        final String[] PUBLIC_MATCHERS = {
                "/webjars/**",
                serverContextPath + "/css/**",
                serverContextPath + "/js/**",
                serverContextPath + "/fonts/**",
                serverContextPath + "/images/**",                
                "/api/**",
                serverContextPath ,
                "/",
                "/error/**/*",
                "/console/**",
                ForgotMyPasswordController.FORGOT_PASSWORD_URL_MAPPING,
                ForgotMyPasswordController.CHANGE_PASSWORD_PATH,
                SignupController.SIGNUP_URL_MAPPING
        };

        return PUBLIC_MATCHERS;

    }

期待这个 URL http://localhost:5678/pradera/api/users/fcm（使用 PUT 方法）将是公开的，但是当我在 Postman 上测试它时，Ii 将我重定向到登录页面

在 publicMatchers() 方法上，我也有 "/api/**",，它似乎适用于调用 http://localhost:5678/pradera/api/deviceevent/list (GET)

Answer 1

添加这个：http.csrf().disable();