Spring 安全过滤器阻止 restful api 调用

Question

我有一个使用 Spring 4 的 Web 应用程序。我在这里使用 Spring 安全性。与此同时，我需要打开一个没有安全保护的 restful api。问题是，在启用安全过滤器之前，我的其余 POST 调用会收到 405 方法不允许的响应（GET 仍然有效）。同时服务器日志显示

.11:27:13.058 [http-bio-8080-exec-5] WARN  o.s.web.servlet.PageNotFound - Request method 'POST' not supported

当我评论来自 web.xml POST 的安全过滤器时工作正常。我尝试将以下行添加到安全 xml 但没有帮助。

<intercept-url pattern="/rest**" access="permitAll" />

我的 web.xml ，安全过滤器是评论 POST 开始工作的结尾。

<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
      http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
     version="2.5">

<display-name>Counter Web Application</display-name>

<servlet>
    <servlet-name>mvc-dispatcher</servlet-name>
    <servlet-class>
        org.springframework.web.servlet.DispatcherServlet
    </servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>mvc-dispatcher</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>

<listener>
    <listener-class>
        org.springframework.web.context.ContextLoaderListener
    </listener-class>
</listener>

<!-- Loads Spring Security config file -->
<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
        /WEB-INF/application-security.xml,
        /WEB-INF/application-database.xml
    </param-value>
</context-param>

 <!--Spring Security -->
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

我的申请-security.xml

<beans:beans xmlns="http://www.springframework.org/schema/security"
         xmlns:beans="http://www.springframework.org/schema/beans"
         xmlns:security="http://www.springframework.org/schema/security"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd">

<security:http security="none" pattern="**/resources/**"/>

<!-- enable use-expressions -->
<http auto-config="true" use-expressions="true">

    <intercept-url pattern="/admin**" access="hasRole('ROLE_ADMIN')" />

    <intercept-url pattern="/rest**" access="permitAll" />

    <!-- access denied page -->
    <access-denied-handler error-page="/access-denied" />

    <form-login
            login-page="/login"
            default-target-url="/admin/dashboard"
            authentication-failure-url="/login?error"
            username-parameter="username"
            password-parameter="password" />
    <logout logout-success-url="/login?logout"  />
    <!-- enable csrf protection -->
    <csrf/>
</http>

<!-- Select users and user_roles from database -->
<authentication-manager>

    <authentication-provider>
        <password-encoder ref="encoder" />
        <jdbc-user-service data-source-ref="dataSource"
                           users-by-username-query="select username,password, enabled from users where username=?"
                           authorities-by-username-query="select username, role from user_roles where username =?" />
    </authentication-provider>

</authentication-manager>

<beans:bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
    <beans:constructor-arg name="strength" value="10" />
</beans:bean>

我的休息控制器。我还有其他控制器。我这里只有假约会。努力让事情先行。

    @RestController
    @RequestMapping("/rest/orders")
    public class OrderRestController {

    @Autowired
    private FoodItemService foodItemService;

    @RequestMapping(value = "", method = RequestMethod.POST)
    public Order addOrder(Order orderDto) {
        return orderDto;
    }

    @RequestMapping(value = "", method = RequestMethod.GET)
    public Order getOrder() {
        FoodItem foodItem = foodItemService.findOne(1, Boolean.TRUE);
        Order orderDto = new Order();
        orderDto.setRoomId(23);
        OrderItem orderItem = new OrderItem();
        orderItem.setFoodItem(foodItem);
        orderItem.setAmount(4);
        List<OrderItem> orderItems = new LinkedList<OrderItem>();
        orderItems.add(orderItem);
        orderDto.setOrderItemList(orderItems);
        return orderDto;
    }

Answer 1

通过查看您的控制器，您似乎有 2 个没有价值的方法，它们正在尝试响应 URL ..../rest/orders；我会这样写：

@RestController
@RequestMapping("/rest/orders")
public class OrderRestController {

@Autowired
private FoodItemService foodItemService;

@RequestMapping(value = "addOrder", method = RequestMethod.POST)
public Order addOrder(Order orderDto) {
    return orderDto;
}

@RequestMapping(value = "getOrder", method = RequestMethod.GET)
public Order getOrder() {
    FoodItem foodItem = foodItemService.findOne(1, Boolean.TRUE);
    Order orderDto = new Order();
    orderDto.setRoomId(23);
    OrderItem orderItem = new OrderItem();
    orderItem.setFoodItem(foodItem);
    orderItem.setAmount(4);
    List<OrderItem> orderItems = new LinkedList<OrderItem>();
    orderItems.add(orderItem);
    orderDto.setOrderItemList(orderItems);
    return orderDto;
}

在那之后，如果我想调用 addOrder 方法，我会调用 URL /rest/orders/addOrder（使用 POST 方法），如果我想的话要调用 getOrder 方法，我会对 URL /rest/orders/getOrder 进行 REST 调用。 Morevoer 我会将一个参数（例如 orderId）传递给 getOrder 方法，这样我就可以加载选定的订单

Answer 2

问题是 csrf 被启用。应该进一步研究禁用 csrf 和安全性，但目前禁用它是解决方案。

Answer 3

你试过这个吗：

<intercept-url pattern="/rest/**" access="permitAll" />

Spring 安全过滤器阻止 restful api 调用

Spring security filter blocking restful api calls

rest

spring

spring-mvc

spring-security