Не удалось отключить цепочку фильтров Spring Security для некоторых URL - PullRequest
Новая
       14

Не удалось отключить цепочку фильтров Spring Security для некоторых URL

1 голос
/ 26 апреля 2020

Я недавно добавил токен CSRF в свой проект Spring MVC и работает довольно хорошо, но когда я попытался отключить цепочку фильтров Spring Security для всех URL, начиная с / apis / ничего не получалось. Я что-то пропустил? Заранее спасибо.

Версия безопасности Spring: 4.0.3.RELEASE

springWebSecurityContext. xml

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
  <security:authentication-manager/>
  <security:http create-session="stateless" auto-config="true" use-expressions="true">
    <security:headers>
      <security:cache-control />
      <security:content-type-options />
      <security:frame-options policy="SAMEORIGIN" />
      <security:hsts />
      <security:xss-protection />
    </security:headers>
    <security:csrf/>
    <security:intercept-url pattern="/apis/**" access="permitAll" />
    <security:http-basic/>
  </security:http>
</beans>

web. xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
         version="2.5">
    <filter>
        <filter-name>encoding-filter</filter-name>
        <filter-class>
            org.springframework.web.filter.CharacterEncodingFilter
        </filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>UTF-8</param-value>
        </init-param>
        <init-param>
            <param-name>forceEncoding</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    <filter>
        <description>
            Secures access to web resources using the Spring Security framework.
        </description>
        <display-name>springSecurityFilterChain</display-name>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>encoding-filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>ERROR</dispatcher>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
    </filter-mapping>
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/spring/root-context.xml /WEB-INF/springWebSecurityContext.xml</param-value>
    </context-param>
    <listener>
        <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
    </listener>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    <servlet>
        <servlet-name>appServlet</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>/WEB-INF/spring/appServlet/servlet-context.xml</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>appServlet</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>
    <session-config>
        <session-timeout>600</session-timeout>
    </session-config>
    <!--<error-page>
        <error-code>403</error-code>
        <location>/WEB-INF/views/error/error-403.jsp</location>
    </error-page>-->
    <error-page>
        <error-code>404</error-code>
        <location>/WEB-INF/views/error/error-404.jsp</location>
    </error-page>
    <!--<error-page>
      <error-code>500</error-code>
      <location>/WEB-INF/views/error/error-500.jsp</location>
    </error-page>-->

    <jsp-config>
        <jsp-property-group>
            <url-pattern>*.jsp</url-pattern>
            <page-encoding>UTF-8</page-encoding>
        </jsp-property-group>
    </jsp-config>

</web-app>

зависимости, связанные с пружинной безопасностью на пом. xml

<dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>${spring.security.version}</version>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>${spring.security.version}</version>
            <scope>runtime</scope>
        </dependency>

Ответ от сервера на почтальоне 

HTTP Status 403 – Forbidden
Type Status Report

Message Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'.

Description The server understood the request but refuses to authorize it.

Apache Tomcat/8.5.43

1 Ответ

1 голос
/ 27 апреля 2020

Я решил проблему, просто добавив одну строку в springWebSecurityContext. xml

<http pattern="/apis/**" create-session="never" xmlns="http://www.springframework.org/schema/security"
        security="none"/>

Полный исходный код springWebSecurityContext. xml

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

  <http pattern="/apis/**" create-session="never" xmlns="http://www.springframework.org/schema/security"
        security="none"/>

  <security:authentication-manager/>
    <security:http create-session="stateless" use-expressions="true">
        <security:headers>
            <security:cache-control/>
            <security:content-type-options/>
            <security:frame-options policy="SAMEORIGIN"/>
            <security:hsts/>
            <security:xss-protection/>
        </security:headers>
        <security:csrf/>
        <security:http-basic/>
    </security:http>
</beans>
...