Spring Boot Security OAuth2: WebSecurityConfigurerAdapter: 302 Redirect to /error答案

【问题标题】：Spring Boot Security OAuth2: WebSecurityConfigurerAdapter: 302 Redirect to /errorSpring Boot Security OAuth2: WebSecurityConfigurerAdapter: 302 Redirect to /error
【发布时间】：2018-11-04 08:21:22
【问题描述】：

仅仅存在一个空的WebSecurityConfigurerAdapter 就会破坏我应用的 OAuth2。我明白了

$ curl -i -X POST -H "Content-Type: application/json" -H "Authorization: Bearer 27f9e2b7-4441-4c03-acdb-7e7dc358f783" -d '{"apiKey": "key", "tag": "tag"}' localhost:8080/isTagAvailable
HTTP/1.1 302
Location: http://localhost:8080/error

当我期待时

$ curl -i -X POST -H "Content-Type: application/json" -H "Authorization: Bearer 27f9e2b7-4441-4c03-acdb-7e7dc358f783" -d '{"apiKey": "key", "tag": "tag"}' localhost:8080/isTagAvailable
HTTP/1.1 401

{"error":"invalid_token","error_description":"Invalid access token: 27f9e2b7-4441-4c03-acdb-7e7dc358f783"}

我必须注释掉 ENTIRE 类才能使 Oauth2 工作。即使只是评论configure 方法也不起作用。为什么？

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            .antMatchers("/robots.txt").permitAll()
        .and()
            .authorizeRequests()
            .antMatchers("/isTagAvailable").hasRole("USER")
//          .anyRequest().authenticated()
        .and()
            .httpBasic().disable();
    }

}

I learned how to add security logging，但it didn't print out any useful information。

【问题讨论】：

标签： java spring-boot spring-security-oauth2

【解决方案1】：

我扔掉了@EnableWebSecurity 和WebSecurityConfigurerAdapter，这完全破坏了应用程序。我认为他们需要访问我认为我需要的HttpSecurity。我发现这个简单的新类可以解决问题。

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    String[] ignoredPaths = new String[]{...};

    @Override
    public void configure(HttpSecurity http) throws Exception{

        http.authorizeRequests()
            .antMatchers(ignoredPaths).permitAll()
            .anyRequest().authenticated()
        .and()
            .httpBasic();   
    }

【讨论】：