Spring-Security 5 总是 302答案

【问题标题】：Spring-Security 5 always 302Spring-Security 5 总是 302
【发布时间】：2019-01-07 22:28:48
【问题描述】：

我正在尝试使用标准 Spring Security API 测试我的 web api，但是每当我登录到我的应用程序时，/test.html api 都会不断返回 302 重定向。 用户名：admin / 密码：管理员

package com.example.demo;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@SpringBootApplication
public class DemoApplication {

    public static void main(String[] args) {
        SpringApplication.run(DemoApplication.class, args);
    }

    @RequestMapping("/hello")
    public String hello() {
        return "hello";
    }
}

package com.example.demo;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableWebSecurity
public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin()
                .loginPage("/test.html").permitAll()
                .loginProcessingUrl("/user/login")
                .and()
                .authorizeRequests()
                .antMatchers("/test.html").permitAll()
                .anyRequest()
                .authenticated();
    }
}

package com.example.demo;

import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Component;

@Component
public class UserDetailsServiceImpl implements UserDetailsService {

    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
        return new User("admin",
           "$2a$10$vs7veyVUaqeGyVlxXpp94O7BcmzcF2HGUmH2va6XDVCj2mK8uFzRi",
           AuthorityUtils.commaSeparatedStringToAuthorityList("admin"));
    }
}

https://github.com/woshituotuo/demo.git

【问题讨论】：

重定向 (302) 的位置是什么？
您尚未登录。因此您将被重定向到登录页面 (/test.html)。

标签： java spring spring-boot spring-security

【解决方案1】：

从我的 Spring Boot 应用程序的主类中排除 SecurityAutoConfiguration.class 和 ManagementWebSecurityAutoConfiguration.class 对我有用。

  import org.springframework.boot.SpringApplication;
  import org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration;
  import org.springframework.boot.autoconfigure.SpringBootApplication;
  import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;

  @SpringBootApplication(exclude = {SecurityAutoConfiguration.class, 
   ManagementWebSecurityAutoConfiguration.class})
  public class MainApplication implements WebMvcConfigurer {
  public static void main(String[] args) {
  SpringApplication.run(MainApplication.class, args);
    }
   }

【讨论】：

【解决方案2】：

你需要在.hasAnyRole之后加上用户的角色放完这些你需要放.anyRequest().authenticated() 就是这样

【讨论】：

【解决方案3】：

完成

跨站请求伪造

@覆盖受保护的无效配置（HttpSecurity http）抛出异常{ http.formLogin() .loginPage("/test.html").permitAll() .loginProcessingUrl("/user/login") 。和（） .authorizeRequests() .antMatchers("/test.html").permitAll() .anyRequest() .authenticated() .and() + .csrf() + .disable(); + }

【讨论】：