来自 Jersey Web 服务的匿名访问方法，该服务由 Spring Security 和 oAuth2 保护

Question

我有一个 Jersey Rest Web 服务来处理个人帐户 CRUD。
我有 spring security+ oAuth2 来保护这个 api，我无法配置的是，我想让 Account create 方法匿名。我试图配置拦截 url，但它不起作用方法级别。所以我需要为此目的编写单独的类，否则我可以不用它来实现。

示例类代码

public class AccountResource{

createAccount() --- I want this method to be accessed by Anonymous uers so they can create account without generating tokens.
updateAccount() --
findAccount() --
deleteAccont()--

} 

使所有以'/services/rest/**'开始的调用安全的配置代码

<http pattern="/services/rest/**" create-session="never"
        entry-point-ref="oauthAuthenticationEntryPoint"
        xmlns="http://www.springframework.org/schema/security">
        <anonymous enabled="false" />
        <intercept-url pattern="/services/rest/**" method="GET" access="ROLE_USER" />
        <intercept-url pattern="/services/rest/**" method="POST" access="ROLE_USER" />
        <intercept-url pattern="/services/rest/**" method="PUT" access="ROLE_USER" />
        <intercept-url pattern="/services/rest/**" method="DELETE" access="ROLE_USER" />
        <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
        <http-basic entry-point-ref="oauthAuthenticationEntryPoint" />
        <access-denied-handler ref="oauthAccessDeniedHandler" />
    </http>

Answer 1

如何将安全配置中的 POST 请求配置更改为：

<intercept-url pattern="/services/rest/**" access="permitAll" method="POST" />