Spring Security 的 permitAll 不适用于某些端点

Question

我有@Configuration@EnableWebSecuritypublic class WebSecurityConfig extends WebSecurityConfigurerAdapter {    @Override    protected void configure(final HttpSecurity http) throws Exception {        http            .csrf().disable()            .authorizeRequests()                .antMatchers(HttpMethod.POST, "/api/v1/account/import").permitAll()                .anyRequest().authenticated()                .and()            .addFilterBefore(new JWTAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);    }我希望所有用户都可以在/api/v1/account/import没有任何 JWT 令牌检查的情况下访问。对于所有其他端点，我希望在 class 中进行 JWT 令牌检查JWTAuthenticationFilter。我尝试了许多不同的场景，但都失败了。我总是得到JWTAuthenticationFilter。JWTAuthenticationFilter如果我去，我不想去/api/v1/account/import。我的控制器：@RestController@RequestMapping(value = "/api/v1/account")public class AccountController {    private final AccountService accountService;    public AccountController(final AccountService accountService) {        this.accountService = accountService;    }    @PostMapping(path = "/import")    @ResponseStatus(HttpStatus.ACCEPTED)    public String importAccount(@Valid @RequestBody final ImportAccountDto importAccountDto) {        return this.accountService.importAccount(importAccountDto);    }我的 JWT 过滤器：public class JWTAuthenticationFilter extends GenericFilterBean {    @Override    public void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain filterChain) throws IOException, ServletException {        final HttpServletRequest request = (HttpServletRequest) req;        final HttpServletResponse response = (HttpServletResponse) res;        final String token = request.getHeader("Authorization");        final JJWTService jjwtService = new JJWTService();        if (token == null || !jjwtService.parseJWTToken(token)) {            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);        } else {            filterChain.doFilter(req, res);        }    }