Spring Boot Security - 匿名用户访问默认映射/

Question

我们有基于Spring启动的应用程序，并且我们希望给予匿名用户的默认/映射访问权限。 我们添加了默认的index.html（基本页面）。

在控制器

@RequestMapping("/") 
public ModelAndView defaultViewManager(HttpServletRequest request) { 
    logger.info("Default mapping."); 
    ModelAndView modelAndView = new ModelAndView("index"); 
    return modelAndView; 
} 

SecurityConfig

@Configuration 
@EnableWebSecurity 
public class SecurityConfig extends WebSecurityConfigurerAdapter { 

private static final String SSO_HEADER = "AUTH_USER"; 

public static final String ADMIN = "ROLE_ADMIN"; 
public static final String USER = "ROLE_USER"; 
public static final String ANONYMOUS = "ROLE_ANONYMOUS"; 

@Autowired 
private PreAuthUserDetailsService userDetailsService; 

@Autowired 
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
    auth.authenticationProvider(preAuthenticatedAuthProvider()); 
} 

@Bean 
public PreAuthenticatedAuthenticationProvider preAuthenticatedAuthProvider() { 
    UserDetailsByNameServiceWrapper<PreAuthenticatedAuthenticationToken> wrapper = 
      new UserDetailsByNameServiceWrapper<PreAuthenticatedAuthenticationToken> (userDetailsService); 

    PreAuthenticatedAuthenticationProvider authProvider = new PreAuthenticatedAuthenticationProvider(); 
    authProvider.setPreAuthenticatedUserDetailsService(wrapper); 
    return authProvider; 
} 

@Bean 
public RequestHeaderAuthenticationFilter headerAuthFilter() throws Exception { 
    RequestHeaderAuthenticationFilter filter = new RequestHeaderAuthenticationFilter(); 
    filter.setPrincipalRequestHeader(SSO_HEADER); 
    filter.setAuthenticationManager(authenticationManagerBean()); 
    return filter; 
} 

上面提到的代码可能没有必要，但对于背景下，我们使用的是PreAuthenticatedAuthentication提供商

@Override 
protected void configure(HttpSecurity http) throws Exception { 

    // @formatter:off 
    http.addFilter(headerAuthFilter()) 
     .authorizeRequests() 
      .antMatchers("/").permitAll() 
      .antMatchers("/admin/**").hasAuthority(ADMIN) 
      .antMatchers("/**").hasAuthority(USER) 

     .and() 
      .logout() 
       .deleteCookies("remove") 
       .invalidateHttpSession(true) 
       .logoutUrl("/logout") 
       .logoutSuccessUrl("/login?logout") 
     .and() 
      .csrf().disable() 
      .headers().frameOptions().disable(); 
    // @formatter:on 
} 
} 

仅供参考，我有也加入了拦截器。拦截器似乎被触发，即使有排除模式

public void addInterceptors(InterceptorRegistry registry) {  
     registry.addInterceptor(wikiRequestHandlerInterceptor()). 
excludePathPatterns("/").addPathPatterns("/**"); 

} 

在上述SecurityConfig代码。我试图允许使用.antMatchers("/").permitAll()并增加权限休息意味着所有/**和/admin/**。但是这不起作用。请帮助提及正确的antMatchers以提供对默认/映射的匿名访问。

在此先感谢。

Answer 1

看起来像antMatchers需要重新安排来修复优先级。为了允许“的所有请求”在"/"第一添加anyRequest().permitAll()，然后添加受限目录，最后是全捕获/**像这样：

http.addFilter(headerAuthFilter()) 
    .authorizeRequests() 
    .anyRequest().permitAll() 
    .antMatchers("/admin/**").hasAuthority(ADMIN) 
    .antMatchers("/**").hasAuthority(USER) 

视图控制器可以设置在直接映射到indexroot.html （假设ThymeLeaf）模板目录：

public void addViewControllers(ViewControllerRegistry registry) { 
    registry.addViewController("/").setViewName("indexroot"); 
} 

我相信拦截器仍然可以排除与简单的 “/”，以任何顺序：

public void addInterceptors(InterceptorRegistry registry) { 
    registry.addInterceptor(wikiRequestHandlerInterceptor()) 
      .addPathPatterns("/admin/**") 
      .excludePathPatterns("/"); 
}