我正在使用 spring-boot-starter-parent 版本 2.0.1.RELEASE 开发 Spring Cloud 项目。
我低于警告,看起来像
属性“security.basic.enabled”已弃用:安全自动配置不再可自定义。请提供您自己的 WebSecurityConfigurer bean。
安全: 基本的: enabled: false 在 Spring Security 最新版本中被禁用。
您能指导我应该用什么来代替吗?
application.yml
---
server:
port: 8888
security:
basic:
enabled: false
spring:
cloud:
config:
server:
git:
uri: https://github.com/rseroter/pluralsight-spring-cloudconfig-wa-tolls
search-paths:
- 'station*'
repos:
perf:
pattern:
- '*/perf'
uri: https://github.com/rseroter/pluralsight-spring-cloudconfig-wa-tolls-perf
search-paths:
- 'station*'
pom.xml
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.0.1.RELEASE</version>
<relativePath /> <!-- lookup parent from repository -->
</parent>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<java.version>1.8</java.version>
<spring-cloud.version>Finchley.BUILD-SNAPSHOT</spring-cloud.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-config-server</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-dependencies</artifactId>
<version>${spring-cloud.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
<repositories>
<repository>
<id>spring-snapshots</id>
<name>Spring Snapshots</name>
<url>https://repo.spring.io/snapshot</url>
<snapshots>
<enabled>true</enabled>
</snapshots>
</repository>
<repository>
<id>spring-milestones</id>
<name>Spring Milestones</name>
<url>https://repo.spring.io/milestone</url>
<snapshots>
<enabled>false</enabled>
</snapshots>
</repository>
</repositories>
这是我的测试课。
@RunWith(SpringRunner.class)
@SpringBootTest
public class PluralsightSpringcloudM2ConfigserverGitApplicationTests {
@Test
public void contextLoads() {
}
}
与其他问题无关
Spring Boot 2.0 更改了其自动配置(包括一些属性),现在有一个行为,一旦您添加自己的 WebSecurityConfigurerAdapter,该行为就会退出。默认配置看起来像
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.anyRequest().authenticated()
.and()
.formLogin()
.and()
.httpBasic();
}
默认配置具有生成密码的单个用户。要自定义此用户,请使用
spring.security.user
下的属性。
spring.security.user.name=user # Default user name.
spring.security.user.password= # Password for the default user name.
spring.security.user.roles= # Granted roles for the default user name.
从 Spring Boot 2 开始,以下属性已被删除:
security.basic.authorize-mode
security.basic.enabled
security.basic.path
security.basic.realm
security.enable-csrf
security.headers.cache
security.headers.content-security-policy
security.headers.content-security-policy-mode
security.headers.content-type
security.headers.frame
security.headers.hsts
security.headers.xss
security.ignored
security.require-ssl
security.sessions
替换件(如果存在)可以在此处找到:附录 A. 常见应用程序属性
需要明确的是:如果您创建自定义 WebSecurityConfigurerAdapter,则默认安全配置将替换为您的自定义配置:
@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
// For example: Use only Http Basic and not form login.
http
.authorizeRequests()
.anyRequest().authenticated()
.and()
.httpBasic();
}
}
有关更多信息,请访问 Spring 2.0 迁移指南。
这是因为当你写
security.basic.enabled = false
时,你基本上告诉应用程序我不关心安全性并允许所有请求。在 spring boot 2.0 之后,你不能只编写 1 个配置来使应用程序不安全。您需要编写一些代码来做到这一点。或者您可以直接复制以下内容。
package com.LockheedMartin.F22Simulator;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().anyRequest().permitAll();
}
}
顺便说一句,您应该从 application.properties 中删除
security.basic.enabled = false
,因为 spring 2.*.*
不再理解该属性,如果您有正确的 Intellij 设置,您应该看到一条警告,指出 'unsupported property'
。
如果您使用 Spring 反应式安全性,我们需要做这样的事情,
@Bean
public SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) {
http.authorizeExchange().anyExchange().permitAll();
return http.build();
}
还有另一篇关于此问题的 stackoverflow 帖子,Spring boot 2.0 禁用默认安全性
我会在你的测试课上尝试以下操作:
@SpringBootTest(properties="spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration")
这将在测试类的上下文中禁用 spring-security 的自动配置。
编辑:如果不限于测试类上下文,同样可以应用于:
@SpringBootApplication(排除=“org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration”)
否则,在您的 application.yaml 中,您可以执行以下操作:
spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration
这样我就能解决这个问题。但不确定。我刚刚更正了 application.yml
---
server:
port: 8888
spring:
cloud:
config:
server:
git:
uri: https://github.com/rseroter/pluralsight-spring-cloudconfig-wa-tolls
search-paths:
- 'station*'
repos:
perf:
pattern:
- '*/perf'
uri: https://github.com/rseroter/pluralsight-spring-cloudconfig-wa-tolls-perf
search-paths:
- 'station*'
security:
user:
name: test
password: test
当我访问网址:http://localhost:8888/s1rates/default时,它要求我输入用户名和密码,我得到以下结果。