端点是可以在生产中可见的。
直接从浏览器击中端点时,405错误表明服务器(或反向代理)可能不会配置为处理补丁请求。 STWAGGE中的404错误可能表明该请求未正确到达应用程序,或者是通过中间件或代理配置阻止/重定向的。 获取和发布端点在生产中正常工作的事实表明,该问题特定于处理补丁请求。
import lombok.RequiredArgsConstructor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.logout.LogoutFilter;
@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {
private final FilterChainExceptionHandler filterChainExceptionHandler;
@Bean
public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
http
.csrf(csrf -> csrf.disable())
.headers(headers -> headers
.contentSecurityPolicy(csp -> csp
.policyDirectives("default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none';")
) //CSP implementation
)
.headers(headers -> headers
.frameOptions(HeadersConfigurer.FrameOptionsConfig::deny) // Deny framing to prevent clickjacking
)
.addFilterBefore(filterChainExceptionHandler, LogoutFilter.class)
.authorizeHttpRequests(requests -> requests
.anyRequest().permitAll()
);
return http.build();
}
}