Angular 2 + CORS + 带有 Spring Security 的 Spring Boot Rest Controller答案

【问题标题】：Angular 2 + CORS + Spring Boot Rest Controller with Spring SecurityAngular 2 + CORS + 带有 Spring Security 的 Spring Boot Rest Controller
【发布时间】：2018-03-06 17:54:46
【问题描述】：

我将 angular2 用于前端和弹簧靴休息控制器。在添加弹簧安全性之前，我的应用程序运行良好。添加安全后，在spring boot rest控制器中不会调用带参数的函数。下面是代码

Rest Controller:
----------------
@RestController
public class JobCleanupServiceController {

    private static final Logger logger = LoggerFactory.getLogger(JobCleanupServiceController.class);
   @Autowired
   JobCleanupDAO dao;

    @CrossOrigin(origins = "http://localhost:4200")
    @RequestMapping("/jobcleanup")

    public Collection<JobCleanup> index(@RequestBody String owner) {

        logger.info("Display All Jobs"+ owner);
        return dao.findAll(owner);

    }


    @CrossOrigin(origins = "http://localhost:4200")
    @RequestMapping("/jobcleanupclosedtickets")

    public JobCleanupMetrics getJobCleanupClosedTickets()
    {
        logger.info("JobCleanupMetrics getJobCleanupClosedTickets ");
        return dao.getJobCleanupClosedTickets();
    }



    @CrossOrigin(origins = "http://localhost:4200")
    @RequestMapping("/jobcleanuplinechartdata")
    public JobCleanupChart getJobCleanupLineChartData(@RequestBody String  owner){
        return dao.getJobCleanupLineChartData(owner);
    }

WebConfig.java
-------------

@Configuration
public class WebConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**");
    }
}

SecurityConfig.java

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors();
        http.authorizeRequests()
                    .antMatchers(
                            "/jobcleanup",
                            "/jobcleanupclosedtickets",
                            "/jobcleanuplinechartdata"
                    ).permitAll();
    }

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        final CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("*"));
        configuration.setAllowedMethods(Arrays.asList("*"));
        configuration.setAllowCredentials(true);
        configuration.setAllowedHeaders(Arrays.asList("*"));
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

在我输入 http://localhost:4200 时添加 spring security 之前，所有这些都被称为“/jobcleanup”， "/jobcleanupclosedtickets", “/jobcleanuplinechartdata”。添加弹簧安全后，仅调用“/jobcleanupclosedtickets”，其他方法不会被调用。除了 "/jobcleanupclosedtickets" 其他方法都有请求体。

有人可以帮我解决这个问题吗？

【问题讨论】：

标签： spring angular spring-mvc spring-security cors

【解决方案1】：

更新了 SecurityConfig.java，如下所示。默认情况下，在 Spring Security 中启用了 csrf。

 @Configuration
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
        @Override
        protected void configure(HttpSecurity http) throws Exception {

    http.csrf().disable();
    http.cors();

        }

        @Bean
        public CorsConfigurationSource corsConfigurationSource() {
            final CorsConfiguration configuration = new CorsConfiguration();
            configuration.setAllowedOrigins(Arrays.asList("*"));
            configuration.setAllowedMethods(Arrays.asList("*"));
            configuration.setAllowCredentials(true);
            configuration.setAllowedHeaders(Arrays.asList("*"));
            final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
            source.registerCorsConfiguration("/**", configuration);
            return source;
        }
    }

【讨论】：