Spring安全性：即使允许使用URL，我的授权过滤器也会授权我的请求

Question

在我的安全配置类中，我已经允许对welcome url和任何其他url的请求遵循“welcome / **”格式。

这是我的安全配置类：

@EnableGlobalMethodSecurity(prePostEnabled = true)
//@Configuration
@EnableWebSecurity
public class JwtSecurityConfiguration extends WebSecurityConfigurerAdapter {


    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }


    private final CustomerDetailsService customerDetailsService;

    @Autowired
    private JwtAuthenticationEntryPoint unauthorizedHandler;

    @Autowired
    public JwtSecurityConfiguration(CustomerDetailsService customerDetailsService) {

        this.customerDetailsService = customerDetailsService;
    }


    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .userDetailsService(customerDetailsService)
                .passwordEncoder(passwordEncoderBean());
    }

    @Bean
    public PasswordEncoder passwordEncoderBean() {
        return new BCryptPasswordEncoder();
    }



    @Override
    public void configure(WebSecurity web) throws Exception {

        web.ignoring().antMatchers("**/resources/static/**")
                .and()
                .ignoring()
                .antMatchers(
                        HttpMethod.GET,
                        "/",
                        "/*.html",
                        "/favicon.ico",
                        "/**/*.html",
                        "/**/*.css",
                        "/**/*.js",
                        "/index_assets/**"
                );
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable()
                .authorizeRequests()
                .antMatchers("/welcome/login").permitAll()
                .antMatchers("/welcome").permitAll()
                .antMatchers("/welcome/signup").permitAll()
                .antMatchers("admin/rest/**").authenticated()
                .and()
                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler)
                .and()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        //http.addFilterBefore(new JWTAuthenticationFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class);

         http.addFilterBefore(new JWTAuthorizationFilter(authenticationManager(),customerDetailsService),UsernamePasswordAuthenticationFilter.class);

        // disable page caching
        http
                .headers()
                .frameOptions().sameOrigin()  // required to set for H2 else H2 Console will be blank.
                .cacheControl();

        //http.headers().cacheControl();

    }
}

但是我注意到在我的JWTAuthorizationFilter.class中，doFilterInternal（）方法获取了这个URL

public class JWTAuthorizationFilter  extends OncePerRequestFilter {

    private final CustomerDetailsService customerDetailsService;

    @Autowired
    DefaultCookieService defaultCookieService;


    public JWTAuthorizationFilter(AuthenticationManager authenticationManager, CustomerDetailsService customerDetailsService) {

       // super(authenticationManager);

        this.customerDetailsService = customerDetailsService;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {

        String header = request.getHeader(HEADER);

        if(Objects.isNull(header) || !header.startsWith(TOKEN_PREFIX)){


            return;


        }

        UsernamePasswordAuthenticationToken usernamePasswordAuth = getAuthenticationToken(request);

        SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuth);

        chain.doFilter(request,response);

    }

    private UsernamePasswordAuthenticationToken getAuthenticationToken(HttpServletRequest request){

        String token = request.getHeader(HEADER);

        if(Objects.isNull(token)) return null;

        String username = Jwts.parser().setSigningKey(SECRET)
                .parseClaimsJws(token.replace(TOKEN_PREFIX,""))
                .getBody()
                .getSubject();


        UserDetails userDetails = customerDetailsService.loadUserByUsername(username);

        return username != null ? new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities()) : null;
    }
}

这是什么原因？

Answer 1

过滤器假设接收每个请求。如果您允许或不允许安全配置，则无关紧要。

你有两个选择：

1. 如果您不希望welcome/**通过过滤器，则将其添加到Web忽略

   @Override
   public void configure(WebSecurity web) throws Exception {
   
       web.ignoring().antMatchers("**/resources/static/**")
               .and()
               .ignoring()
               .antMatchers(
                       HttpMethod.GET,
                       "/",
                       "/*.html",
                       "/favicon.ico",
                       "/**/*.html",
                       "/**/*.css",
                       "/**/*.js",
                       "/index_assets/**",
                       "/welcome/**"
               );
   }

但请注意，它会跳过所有过滤器，您可能不希望这样。

2. 在doFilterInternal方法中，当你找到welcome/**模式时跳过它。