Spring security - 如何为不同的域使用基于角色的身份验证？

Question

有一个项目在 localhost:8080 上运行 Spring boot 后端，在 localhost:4200（用户网站）和 localhost:4201（管理网站）上运行 2 个前端 Angular 应用程序。我该如何配置 spring 安全性它只允许用户网站中具有角色 - ROLE_USER,ROLE_ADMIN 的用户和角色 -ROLE_ADMIN 的用户可以访问管理网站。

目前两个用户都可以访问两个 wesbite。有没有办法限制某些域而不是限制用户的路径（URL）。

当前配置 -

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter{
    
    @Autowired
    Environment env; 

    @Autowired
    UserSecurityService useSecurityService;
    
    private BCryptPasswordEncoder passwordEncoder() {
        return SecurityUtility.passwordEncoder();
    }
    
    private static final String[] PUBLIC_MATHCES= {
            "/css/**",
            "/js/**",
            "/images/**",
            "/book/**",
            "/user/**",
            "/media/**"
    };

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(useSecurityService).passwordEncoder(passwordEncoder());
        
        
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers(PUBLIC_MATHCES).permitAll()
            .anyRequest().authenticated()
            .and();
        http.csrf().disable()
            .cors()
            .and()
            .httpBasic();
        
    }
     
      @Bean
      public HttpSessionIdResolver httpSessionStrategy() {
          return  HeaderHttpSessionIdResolver.xAuthToken();
      }
      
        
    
}

Answer 1

假设你的所有配置都配置正确，那么你就可以使用角色限制机制，如下示例：

@Override
protected void configure(HttpSecurity http) throws Exception {

    http
        .authorizeRequests(authorize - > {
            authorize
            .antMatchers("/h2-console/**").permitAll() //do not use in production!
            .antMatchers("/css/**", "/js/**", "/images/**", "/book/**", "/user/**", "/media/**").permitAll()
            .antMatchers("/website/find", "/main*").permitAll()
            .antMatchers(HttpMethod.GET, "/userweb/v1/data/**").permitAll()
            .mvcMatchers(HttpMethod.DELETE, "/userweb/v1/info/**").hasRole("ADMIN")
            .mvcMatchers(HttpMethod.GET, "/userweb/v1/item/{upc}").permitAll()
            .mvcMatchers("/admin/main").hasAnyRole("USER", "ADMIN")
            .mvcMatchers(HttpMethod.GET, "/user/api/v1/normal")
            .hasAnyRole("USER", "ADMIN", "FOO");
        })
        .authorizeRequests()
        .anyRequest().authenticated()
        .and()
        .cors()
        .and()
        .httpBasic()
        .and().csrf().disable();
}