我无法使用 Spring Security 访问 swagger url

Question

我在我的项目中使用 Spring Security，现在我尝试使用 Swagger OpenAPI 创建文档，但我一直遭受由此引起的冲突的困扰。我不知道我必须更改什么，因为没有教程允许我解决该错误。我所有的访问尝试都会发送错误 403。

这是我的 Spring 安全配置

package com.mariojunior.todo.config;

import com.mariojunior.todo.security.JWTAuthenticationFilter;
import com.mariojunior.todo.security.JWTAuthorizationFilter;
import com.mariojunior.todo.security.JWTUtil;
import com.mariojunior.todo.service.UserDetailsService;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

import java.util.Arrays;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(securedEnabled = true)
public class SecurityConfig {

    private AuthenticationManager authenticationManager;

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private JWTUtil jwtUtil;

    private static final String[] PUBLIC_MATCHERS_POST = {
            "/users/",
            "/login"
    };

    private static final String[] AUTH_WHITELIST ={
            "/v3/api-docs/**",
            "/swagger-ui/**"
    };


    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception{
        http.csrf(AbstractHttpConfigurer::disable)
                .cors(AbstractHttpConfigurer::disable);

        AuthenticationManagerBuilder authenticationManagerBuilder = http.getSharedObject(AuthenticationManagerBuilder.class);
        authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());

        this.authenticationManager = authenticationManagerBuilder.build();



        http.authorizeHttpRequests(request -> {
            request.requestMatchers(AUTH_WHITELIST).permitAll();
            request.requestMatchers(HttpMethod.POST, PUBLIC_MATCHERS_POST).permitAll();
            request.anyRequest().authenticated().and().authenticationManager(authenticationManager);

        });

        http.addFilter(new JWTAuthorizationFilter(this.authenticationManager, jwtUtil, userDetailsService));
        http.addFilter(new JWTAuthenticationFilter(this.authenticationManager, jwtUtil));

        http.sessionManagement((session) -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

        return http.build();
    }

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration().applyPermitDefaultValues();
        configuration.setAllowedMethods(Arrays.asList("POST", "GET", "PUT", "DELETE"));
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }

    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder() {
        return new BCryptPasswordEncoder();
    }



}

我尝试使用白名单中的新链接进行解决，并使用我发现的有关此错误的所有内容进行重构，但没有任何效果

Answer 1

您想在安全过滤器链中设置 http 的标头选项吗？我怀疑这是 CORS 问题。

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

        return http
                .authorizeHttpRequests(authorize -> authorize
                        .requestMatchers(AUTH_WHITELIST).permitAll()
                        .anyRequest().authenticated()
                )
                // this option!
                .headers(header -> header
                        .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)
                )
...... blah blah