控制器请求在 https 和 http 上运行良好。它应该只适用于 https

Question

我对来自 Spring Boot 应用程序的控制器请求有疑问。

我已制作证书以便在 https 上运行应用程序。证书工作正常，有效。

我的主要问题是当我通过邮递员从控制器测试我的方法时，它们（url 请求）在 https 和 http 上工作正常......它不应该在 http 上工作。有人可以帮忙吗？

这是我的 WebSecurityConfig 类：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    public static final String AUTHENTICATED_HEADER_NAME = "Authenticated";
    public static final String AUTHENTICATED_TRUE = "true";
    public static final String AUTHENTICATED_FALSE = "false";

    @Autowired
    public void globalUserDetails(final AuthenticationManagerBuilder auth) throws Exception {
        PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();

        auth.userDetailsService(authenticationManager).passwordEncoder(passwordEncoder);
    }


    @Override
    @Bean(value = "authenticationManagerBean")
    public org.springframework.security.authentication.AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Configuration
    @Order(1)
    public static class HTTPBasicSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {

        //todo check how we can change the root url of swagger
        @Override
        public void configure(WebSecurity web) throws Exception {
            web.ignoring().antMatchers("/documentation**", "/configuration/**", "/v2/api-docs**", "/swagger-ui.html", "/webjars/**", "/swagger-resources/**");
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            //todo http basic allows access to all urls after login
            http
                    .httpBasic()
                    .and()
                    .csrf().disable()
                    .antMatcher("/api/**")
                    .authorizeRequests()
                    .antMatchers("/login").permitAll()
                    .anyRequest()
                    .authenticated();

        }
    }

    @Configuration
    @Order(2)
    public static class FormLoginSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf()
                    //todo more investigation is required to check if it is safe to ignore csrf for login
                    .ignoringAntMatchers("/login")
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                    .and()
                    .authorizeRequests()
                    .antMatchers("/login").permitAll()
                    .anyRequest().authenticated()
                    .and()
                    .formLogin()
                    .permitAll()
                    .successHandler((httpServletRequest, httpServletResponse, authentication) -> {
                        httpServletResponse.setHeader(AUTHENTICATED_HEADER_NAME, AUTHENTICATED_TRUE);
                    })
                    .failureHandler((httpServletRequest, httpServletResponse, e) -> {
                        httpServletResponse.setHeader(AUTHENTICATED_HEADER_NAME, AUTHENTICATED_FALSE);
                        httpServletResponse.setStatus(SC_UNAUTHORIZED);
                    })
                    .and()
                    .logout().permitAll()
                    .and()
                    .addFilterBefore(new CorsFilter(), ChannelProcessingFilter.class)
                    .addFilterBefore(new CsrfHeaderFilter(), CsrfFilter.class);
            http.exceptionHandling().authenticationEntryPoint((HttpServletRequest request, HttpServletResponse response,
                                                               AuthenticationException authException) -> {
                if (authException != null) {
                    response.setStatus(SC_UNAUTHORIZED);
                }
            });
        }
    }

    @Configuration
    @Order(3)
    public static class TestClass extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {

            http.headers()
                    .httpStrictTransportSecurity()
                    .includeSubDomains(true)
                    .maxAgeInSeconds(31536000);
        }
    }
}

这是我的 Spring Boot 版本

<parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>1.4.2.RELEASE</version>
        <relativePath></relativePath>
</parent>

Answer 1

你的问题涉及到几点：

• 您可以通过添加security.require_ssl=true 配置属性来要求客户端要求安全通道（请参阅the Spring Boot reference documentation about HTTPS）
• 或者使用如下配置sn -p http.requiresChannel().anyRequest().requiresSecure();
• 您可能还想通过HSTS in Spring Security 强制执行该操作

Answer 2

以上都没有帮助解决我所处的情况。 我发现 chrome（邮递员）正在自动将我的 http 请求转换为 https。 在其他浏览器上，http 请求不起作用。