Spring 安全：REST 与 MVC

Question

我是初学者在春季安全！我有在 Spring Boot 上编写的 MVC + REST 应用程序。我有一个用于保护我的应用程序的代码：

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(securedEnabled = true)
public class SecurityConfig {
    @Bean
    @Order(1)
    public SecurityFilterChain apiFilterChain(
            HttpSecurity httpSecurity) throws Exception {
        return httpSecurity.csrf().disable()
            .sessionManagement()
            .sessionCreationPolicy(
                SessionCreationPolicy.STATELESS).and()
            .securityMatcher("/api/**")
            .authorizeHttpRequests(authorize ->
                authorize.requestMatchers("/api/user/**").hasRole("ROOT")
                    .anyRequest().authenticated())
            .httpBasic(basic ->
                basic.authenticationEntryPoint(
                    (request, response, exp)->
                        response.setStatus(401)))
            .build();
    }

    @Bean
    public SecurityFilterChain formFilterChain(
            HttpSecurity httpSecurity) throws Exception {
        return httpSecurity
            .authorizeHttpRequests(authorize ->
                authorize.requestMatchers("/login*", "/web-res/**").permitAll()
                    .anyRequest().authenticated())
            .formLogin(form ->
                form.loginPage("/login")
                    .failureUrl("/login?error"))
            .logout(logout ->
                logout.logoutUrl("/logout")
                    .logoutSuccessUrl("/")
                    .invalidateHttpSession(true)
                    .clearAuthentication(true)
                    .deleteCookies("JSESSIONID"))
            .build();
    }
}

这很好用，但是当我尝试从 MVC（由 formFilterChain 授权）和 ajax 到 /api/**（由 apiFilterChain 控制）获取数据时 - 我需要使用基本身份验证。 我如何解决该问题以通过表单登录方法授权从 /api/** 获取数据？

Answer 1

阅读文档后我的方法：

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(securedEnabled = true)
public class SecurityConfig {
    private final Customizer<AuthorizeHttpRequestsConfigurer<HttpSecurity>
            .AuthorizationManagerRequestMatcherRegistry> securedRequests = authorize -> {
        authorize.requestMatchers("/login*", "/web-res/**").permitAll()
            .requestMatchers("/api/user/**").hasRole("ROOT")
            .anyRequest().authenticated();
    };

    @Bean
    @Order(1)
    public SecurityFilterChain apiFilterChain(
            HttpSecurity httpSecurity) throws Exception {
        return httpSecurity.csrf().disable()
            .sessionManagement()
            .sessionCreationPolicy(
                SessionCreationPolicy.NEVER).and()
            .authorizeHttpRequests(securedRequests)
            // checking for "Authorization" header
            .securityMatcher(request ->
                request.getHeader("Authorization") != null)
            .httpBasic(basic ->
                basic.authenticationEntryPoint(
                    (request, response, exp)->
                        response.setStatus(401)))
            .build();
    }

    @Bean
    public SecurityFilterChain formFilterChain(
            HttpSecurity httpSecurity) throws Exception {
        return httpSecurity
            .authorizeHttpRequests(securedRequests)
            .formLogin(form ->
                form.loginPage("/login")
                    .failureUrl("/login?error"))
            .logout(logout ->
                logout.logoutUrl("/logout")
                    .logoutSuccessUrl("/")
                    .invalidateHttpSession(true)
                    .clearAuthentication(true)
                    .deleteCookies("JSESSIONID"))
            .build();
    }
}

如果请求具有标头“授权”，则第一个过滤器将起作用

// checking for "Authorization" header
...
.securityMatcher(request ->
  request.getHeader("Authorization") != null)
...

如果未找到标头“授权”- 则执行formFilterChain。