WebSecurityConfigurerAdapter 覆盖 EnableResourceServer？答案

【问题标题】：WebSecurityConfigurerAdapter overrides EnableResourceServer?WebSecurityConfigurerAdapter 覆盖 EnableResourceServer？
【发布时间】：2018-02-12 03:05:29
【问题描述】：

我有完美的使用 spring oAuth2 的 spring boot 应用程序。当我在主类上使用@EnableResourceServer 时效果很好。但要为我在类下面实现的服务启用 CORS

   @Configuration
    public class CorsConfiguration extends WebSecurityConfigurerAdapter {
        @Override
        protected void configure(HttpSecurity http) throws Exception {

            http.csrf().disable();
            http.cors();

        }
        @Bean
        public CorsConfigurationSource corsConfigurationSource() {
            final org.springframework.web.cors.CorsConfiguration configuration = new org.springframework.web.cors.CorsConfiguration();
            configuration.setAllowedOrigins(ImmutableList.of("*"));
            configuration.setAllowedMethods(ImmutableList.of("HEAD",
                    "GET", "POST", "PUT", "DELETE", "PATCH"));
            configuration.setAllowCredentials(true);
   configuration.setAllowedHeaders(ImmutableList.of("Authorization", "Cache-Control", "Content-Type"));
            final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
            source.registerCorsConfiguration("/**", configuration);
            return source;
        }
    }

添加该类后，似乎请求未使用 oAuth 令牌进行验证。即使没有 oAuth 令牌，任何请求都可以访问服务。

我做错了什么？我不能同时使用吗？有什么特别的事情要做吗？有没有更好的方法来启用 CORS。（我试过@CrossOrigin注解没用）

【问题讨论】：

标签： spring spring-security oauth spring-security-oauth2

【解决方案1】：

我不知道你为什么要使用WebSecurityConfigurerAdapter 我认为您的问题是您没有将呼叫转发给 oAuth 以进行授权。试试这个对我有用

@Configuration
public class CorsConfiguration extends ResourceServerConfigurerAdapter {


    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.cors().and().csrf().disable().authorizeRequests().anyRequest().authenticated();
    }
    @Bean
    public CorsFilter corsFilter() {
        final org.springframework.web.cors.CorsConfiguration configuration = new org.springframework.web.cors.CorsConfiguration();
        configuration.setAllowedOrigins(ImmutableList.of("*"));
        configuration.setAllowedMethods(ImmutableList.of("HEAD",
                "GET", "POST", "PUT", "DELETE", "PATCH"));
        configuration.setAllowCredentials(true);

        configuration.setAllowedHeaders(ImmutableList.of("Authorization", "Cache-Control", "Content-Type"));
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return new CorsFilter(source);
    }
    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.resourceId("resource");
    }

}

这里resources.resourceId("resource"); 应该是您在 oAuth 服务器中使用的资源

类似的方法

@Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory().withClient("clinet").secret("secret").accessTokenValiditySeconds(3600).scopes("read", "write")
                .authorizedGrantTypes("password", "refresh_token").resourceIds("resource");
    }

【讨论】：