Spring Security（Java Config）：将antmatchers用于具有不同HTTP方法的相同URL

我试图限制对一个角色的URL的GET访问，以及对另一个角色的相同URL的POST访问，如下所示。Spring Security（Java Config）：将antmatchers用于具有不同HTTP方法的相同URL

@Configuration 
@EnableWebSecurity 
public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 

    @Override 
    protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
     auth.inMemoryAuthentication() 
      .withUser("user").password("password").roles("USER").and() 
      .withUser("readuser").password("password").roles("USER", "READ").and() 
      .withUser("admin").password("password").roles("USER", "READ", "WRITE"); 
    } 

    protected void configure(HttpSecurity http) throws Exception { 
     http 
      .formLogin().permitAll().and() 
      .logout().permitAll().and() 
      .authorizeRequests() 
       .antMatchers(HttpMethod.GET, "/api/foo").hasRole("READ") 
       .antMatchers(HttpMethod.POST, "/api/foo").hasRole("WRITE") 
       .anyRequest().authenticated() 
       .and().csrf().disable() 
      .httpBasic();

当我使用我的readuser帐户尝试GET（或POST）时，出现访问被拒绝错误;但是当我尝试使用管理员帐户时，它可以同时执行这两个操作。

但是，当我删除行.antMatchers(HttpMethod.POST, "/api/foo").hasRole("WRITE")然后我的readuser帐户可以通过GET请求正确地命中/ api/foo。

我该如何让Spring Security允许这两个限制？

************************************************************ 

Request received for GET '/api/foo?id=foo': 

Request(GET //localhost:8089/api/foo?id=foo)@b4603eb 

servletPath:/api/foo 
pathInfo:null 
headers: 
Authorization: Basic cnVudXNlcjpwYXNzd29yZA== 
Cookie: JSESSIONID=node0fe3b0i44a5sbpohi6jq6dkkw0.node0 
Cache-Control: no-cache 
Accept: */* 
User-Agent: PostmanRuntime/3.0.11-hotfix.2 
Connection: keep-alive 
Postman-Token: 99a23213-6cf8-4686-9886-7f9c2de13c6f 
Host: localhost:8089 
Accept-Encoding: gzip, deflate 


Security filter chain: [ 
    WebAsyncManagerIntegrationFilter 
    SecurityContextPersistenceFilter 
    HeaderWriterFilter 
    LogoutFilter 
    UsernamePasswordAuthenticationFilter 
    DefaultLoginPageGeneratingFilter 
    BasicAuthenticationFilter 
    RequestCacheAwareFilter 
    SecurityContextHolderAwareRequestFilter 
    AnonymousAuthenticationFilter 
    SessionManagementFilter 
    ExceptionTranslationFilter 
    FilterSecurityInterceptor 
] 


************************************************************ 
. 
. 
. 
2017-05-08 11:31:27.817 DEBUG 5812 --- [p1731685294-106] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/foo'; against 'GET' 
2017-05-08 11:31:27.817 DEBUG 5812 --- [p1731685294-106] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/foo'; against '/api/foo' 
2017-05-08 11:31:27.817 DEBUG 5812 --- [p1731685294-106] o.s.s.w.a.i.FilterSecurityInterceptor : Secure object: FilterInvocation: URL: /api/foo?id=foo; Attributes: [hasRole('ROLE_WRITE')] 
2017-05-08 11:31:27.818 DEBUG 5812 --- [p1731685294-106] o.s.s.w.a.i.FilterSecurityInterceptor : Previously Authenticated: org.springframew[email protected]a38eb23d: Principal: [email protected]: Username: readuser; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_READ,ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.sprin[email protected]b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_READ, ROLE_USER 
2017-05-08 11:31:27.818 DEBUG 5812 --- [p1731685294-106] o.s.s.access.vote.AffirmativeBased  : Voter: org.sp[email protected]7b20c046, returned: -1 
2017-05-08 11:31:27.819 DEBUG 5812 --- [p1731685294-106] o.s.s.w.a.ExceptionTranslationFilter  : Access is denied (user is not anonymous); delegating to AccessDeniedHandler 

org.springframework.security.access.AccessDeniedException: Access is denied 
. 
. 
. 
2017-05-08 11:31:27.823 DEBUG 5812 --- [p1731685294-106] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed

来源

2017-05-05 TerekC

我刚刚用这个配置嘲弄了一个弹簧启动应用程序，似乎为我工作正常。我可以用readuser命中'GET'，但按预期拒绝POST的访问。与管理员，我能够击中两个。可能是控制器的东西？ – jmw5598

您使用了错误的HttpMethod类： -

更新与readuser当试图包括有关春天的安全调试日志信息

下面是相关的日志。

javax.ws.rs.HttpMethod#GET返回String，因此您在Spring安全配置中使用antMatchers(String... antPatterns)而不是antMatchers(HttpMethod method, String... antPatterns)。

随着对URL模式配置春季安全检查GET和/api/foo（包括所有的HTTP方法），看你的日志：

2017-05-08 11:31:27.817 DEBUG 5812 --- [p1731685294-106] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/foo'; against 'GET' 
2017-05-08 11:31:27.817 DEBUG 5812 --- [p1731685294-106] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/foo'; against '/api/foo'

你必须使用org.springframework.http.HttpMethod#GET，它返回一个HttpMethod目的。

来源

2017-05-08 20:28:44 dur

Spring Security（Java Config）：将antmatchers用于具有不同HTTP方法的相同URL

回答

相关问题