Spring Security - 只允许带有前缀的请求

Question

除了以/unsecured 开头的端点外，我需要保护资源服务器中的所有其余端点。因此，应该允许所有人提出以下请求：

• /unsecured/foo/bar
• /unsecured
• ...

但是这样的请求：

• /foo/unsecured/bar
• /foo/bar
• ...

应该需要身份验证。

@Configuration
@EnableResourceServer
public class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity security) throws Exception {
        security
            .authorizeRequests(authorizeRequests -> {
                authorizeRequests.antMatchers("unsecured/**").permitAll();
                authorizeRequests.anyRequest().authenticated();
            });
    }
}

但在上面的配置中，所有端点都需要身份验证。

这是我尝试访问不安全端点时收到的响应：

代码 401

{
    "error": "unauthorized",
    "error_description": "Full authentication is required to access this resource"
}

Answer 1

premitAll() 是您正在寻找的。看起来您只是缺少 URL 之前的 /

@Configuration
@EnableResourceServer
public class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter {
    @Override
    public void configure(HttpSecurity security) throws Exception {
        security
            .authorizeRequests(authorizeRequests - > {
                authorizeRequests.antMatchers("/unsecured/**").permitAll();
                authorizeRequests.anyRequest().authenticated();
            });
    }
}