Spring security - 为什么我不能访问 WebSecurityConfigurerAdapter 中定义的静态资源？

Question

我正在重构一个 Spring-Boot 应用程序，但我遇到了

o.s.web.servlet.PageNotFound - No mapping found for HTTP request with URI [/rootProject/css/app.css]

适用于所有 CSS 和 JavaScript 文件。

项目的结构如下：

• 根项目

  • src

    • 主要

      • java

      • 资源

        • css

        • js

我的主要安全实现是：

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter { 

    // other methods

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // TODO: api must be protected but default alpaca connector does not support protected sources. We'll need to register a custom connector
        http
                .authorizeRequests()
                .antMatchers(
                        "/images/**",
                        "/css/**",
                        "/health/**",
                        "/js/**",
                        "/api/**",
                        "/reports/**",
                        "/h2-console/**",
                        "/oauth/authorize",
                        "/oauth/confirm_access",
                        "/oauth/token_key").permitAll()
                .antMatchers("/admin/**").hasAuthority(BaseRoleEnum.BASE_ADMIN.toString())
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                .logout()
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                .logoutSuccessUrl("/login")
                .and()
                .headers()
                .frameOptions()
                .sameOrigin()
                .and()
                .csrf()
                .disable();
    }
}

而我的主要配置类是：

@Configuration
@EnableWebMvc
@ComponentScan(basePackages = "basePackages")
// Enable caching for the application
//@EnableCaching
public class TouchConfiguration extends WebMvcConfigurerAdapter{

    // other beans and methods

    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/static/**").addResourceLocations("/static/");
    }
}

我在这里遗漏了什么，所以这可以按预期工作？

Answer 1

我已将所有静态资源路径安全性添加为无。这是一个全局配置。下面的例子是在 XML 中。你应该也可以在配置中做同样的事情。

<!-- Global Security Ignore for resources -->
    <security:http pattern="/resources/**" security="none" ></security:http>
    <security:http pattern="/*.css*" security="none" ></security:http>
    <security:http pattern="/*.js*" security="none" ></security:http>
    <security:http pattern="/*.gif*" security="none" ></security:http>
    <security:http pattern="/*.png*" security="none" ></security:http>
    <security:http pattern="/*.jpg*" security="none" ></security:http>
    <security:http pattern="/*.svg*" security="none" ></security:http>
    <security:http pattern="/*.ico*" security="none" ></security:http>

Answer 2

我认为您应该在 /resourses/static/** 路径下有 .css 和 .js 文件 project static resources structure in elipse

另外，请确保您以正确的方式正确链接