Настройка весенней безопасности AntMatcher не работает весенняя загрузка версии 1.5.7 - PullRequest
Новая
       1

Настройка весенней безопасности AntMatcher не работает весенняя загрузка версии 1.5.7

0 голосов
/ 12 октября 2018

Я попытался настроить цепочку безопасности с помощью Spring Security.

Класс конфигурации: WebappSecurityConfig.java 

@Configuration
@Order(SecurityProperties.BASIC_AUTH_ORDER - 10)
//@EnableWebSecurity
public class WebappSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http

                .antMatcher("/demo/**")
                .authorizeRequests()
                .antMatchers("/", "/demo/hello/").hasAnyRole("TEST")
                .and()
                .httpBasic();


    }

    @Bean
    @Override
    public UserDetailsService userDetailsService() {
        UserDetails user =
                User.withUsername("user")
                        .password("password")
                        .roles("USER")
                        .build();

        return new InMemoryUserDetailsManager(Stream.of(user).collect(Collectors.toList()) );
    }
}

Класс контроллера: HelloController.java

@RestController
@RequestMapping("/demo")
public class HelloController {

    @RequestMapping("/hello")
//    @Secured("ROLE_TEST")
    public String helloUser(){
        return "hello";
    }
}

затем я использую почтальон для отправки запроса GET enter image description here

Я ожидаю, что запрос будет отклонен, так как я настроил роль "USERmsgstr "не должен иметь доступа к пути отображения запроса./demo/hello

Сведения о ведении журнала: 

2018-10-12 16:58:02.695 DEBUG 31380 --- [io-10088-exec-5] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/css/**']
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/demo/hello'; against '/css/**'
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/js/**']
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/demo/hello'; against '/js/**'
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/images/**']
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/demo/hello'; against '/images/**'
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/webjars/**']
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/demo/hello'; against '/webjars/**'
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/**/favicon.ico']
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/demo/hello'; against '/**/favicon.ico'
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/error']
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/demo/hello'; against '/error'
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.web.util.matcher.OrRequestMatcher  : No matches found
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/demo/hello'; against '/demo/**'
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello at position 1 of 12 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello at position 2 of 12 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2018-10-12 16:58:02.696 DEBUG 31380 --- [io-10088-exec-5] w.c.HttpSessionSecurityContextRepository : Obtained a valid SecurityContext from SPRING_SECURITY_CONTEXT: 'org.springframework.security.core.context.SecurityContextImpl@442b5a9f: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@442b5a9f: Principal: org.springframework.security.core.userdetails.User@36ebcb: Username: user; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_USER'
2018-10-12 16:58:02.697 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello at position 3 of 12 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2018-10-12 16:58:02.697 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.header.writers.HstsHeaderWriter  : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@5ea45a
2018-10-12 16:58:02.697 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello at position 4 of 12 in additional filter chain; firing Filter: 'CsrfFilter'
2018-10-12 16:58:02.697 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello at position 5 of 12 in additional filter chain; firing Filter: 'LogoutFilter'
2018-10-12 16:58:02.697 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /demo/hello' doesn't match 'POST /logout
2018-10-12 16:58:02.697 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello at position 6 of 12 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
2018-10-12 16:58:02.697 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.a.www.BasicAuthenticationFilter  : Basic Authentication Authorization header found for user 'user'
2018-10-12 16:58:02.697 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello at position 7 of 12 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
2018-10-12 16:58:02.697 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello at position 8 of 12 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2018-10-12 16:58:02.697 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello at position 9 of 12 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
2018-10-12 16:58:02.698 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.a.AnonymousAuthenticationFilter  : SecurityContextHolder not populated with anonymous token, as it already contained: 'org.springframework.security.authentication.UsernamePasswordAuthenticationToken@442b5a9f: Principal: org.springframework.security.core.userdetails.User@36ebcb: Username: user; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_USER'
2018-10-12 16:58:02.698 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello at position 10 of 12 in additional filter chain; firing Filter: 'SessionManagementFilter'
2018-10-12 16:58:02.698 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello at position 11 of 12 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
2018-10-12 16:58:02.698 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello at position 12 of 12 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
2018-10-12 16:58:02.698 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/demo/hello'; against '/'
2018-10-12 16:58:02.698 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/demo/hello'; against '/demo/hello/'
2018-10-12 16:58:02.698 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.a.i.FilterSecurityInterceptor    : Public object - authentication not attempted
2018-10-12 16:58:02.698 DEBUG 31380 --- [io-10088-exec-5] o.s.security.web.FilterChainProxy        : /demo/hello reached end of additional filter chain; proceeding with original chain
2018-10-12 16:58:02.700 DEBUG 31380 --- [io-10088-exec-5] o.s.s.w.a.ExceptionTranslationFilter     : Chain processed normally
2018-10-12 16:58:02.700 DEBUG 31380 --- [io-10088-exec-5] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed

Чтобы устранить эту проблему, я должен включить метод безопасности, чтобы указать, какую уполномоченную роль для каждого API.

Пожалуйстапосоветуете?

Ответы [ 2 ]

0 голосов
/ 29 октября 2018

Вы можете отредактировать класс WebappSecurityConfig и добавить @EnableWebSecurity, @EnableGlobalMethodSecurity (securedEnabled = true) в верхнюю часть этого класса.Вы заметили, что securedEnabled разрешает использование @Secured.Затем в методе настройки вы добавляете hasAnyRole ('ROLE_TEST') в antMatchers.Вы можете сослаться ниже: 

@Configuration
@Order(SecurityProperties.BASIC_AUTH_ORDER - 10)
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class WebappSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http

          .antMatcher("/demo/**")
          .authorizeRequests()
          .antMatchers("/", "/demo/hello/").access("hasAnyRole('ROLE_TEST')")
          .and()
          .httpBasic();
    }

    @Bean
    @Override
    public UserDetailsService userDetailsService() {
        UserDetails user =
                User.withUsername("user").password("password").roles("USER").build();
        return new InMemoryUserDetailsManager(Stream.of(user).collect(Collectors.toList()) );
    }
}

И при помощи метода hello вы добавляете @Secured ("ROLE_TEST") в метод helloUser: 

@RequestMapping("/hello")

@Secured("ROLE_TEST")

public String helloUser() {
  return "hello";
}
0 голосов
/ 12 октября 2018

Я нашел проблему.запрос в почтальоне отсутствует /, поэтому AnyMatcher не работает.

enter image description here

Добро пожаловать на сайт PullRequest, где вы можете задавать вопросы и получать ответы от других членов сообщества.

Нет похожих вопросов

...