Spring Security 的 permitAll Unauthorized

Question

我想忽略所有带有HttpMethod.GET的 URL，带有 Post、Delete、Put 的 URL 需要进行身份验证。我的网址是"/api/manga","/api/grupos","/api/autor","/genero","/api/pagina","/api/capitulo"PermitAll 不适用于 JWTFilter，如果删除过滤器，则工作正常。如何忽略或允许所有网址HttpMethod.GET？需要创建单独的 api 进行身份验证？网络安全配置@Configuration@EnableWebSecurity@EnableGlobalMethodSecurity(prePostEnabled = true)public class WebSecurityConfig extends WebSecurityConfigurerAdapter {    @Override    protected void configure(HttpSecurity http) throws Exception {        http.authorizeRequests()                .antMatchers(HttpMethod.GET, "/api/manga", "/api/grupos", "/api/autor", "/genero", "/api/pagina",                        "/api/capitulo")                .permitAll().anyRequest().fullyAuthenticated().and()                .addFilterBefore(new JWTAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class).httpBasic()                .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().csrf()                .disable();    }    @Override    public void configure(WebSecurity web) throws Exception {        web.ignoring().antMatchers("/favicon.ico", "/", "/index.html", "/registrar", "/autenticar", "/app/**");    }}JWT认证过滤器public class JWTAuthenticationFilter extends GenericFilterBean {    private static final String AUTHORIZATION_HEADER = "Authorization";    private static final String AUTHORITIES_KEY = "roles";    @Override    public void doFilter(final ServletRequest req, final ServletResponse res,final FilterChain filterChain)            throws IOException, ServletException {              final HttpServletRequest request = (HttpServletRequest) req;               String authReader = request.getHeader(AUTHORIZATION_HEADER);        if (authReader == null || !authReader.startsWith("Bearer ")) {            ((HttpServletResponse) res).sendError(HttpServletResponse.SC_UNAUTHORIZED, "invalido autorization");        } 

Answer 1

解决方案是 ignore HttpMethod.GET，因此所有带有 get 方法的 url 都将被忽略。

    @Override

    public void configure(WebSecurity web) throws Exception {

        web.ignoring()

        .antMatchers(HttpMethod.GET)

        .antMatchers("/favicon.ico", "/", "/index.html", "/registrar",

                "/autenticar", "/app/**");

    }