"addCorsMapping" 阻止 Swagger UI

Question

我正在开发一个 Spring 应用程序，我在 Swagger 和 Spring 安全方面遇到了一些问题。我必须添加一个特定的配置以允许几乎所有访问 (CORS)，到目前为止它运行良好，但不知何故它阻止了 Swagger....

这是我的SwaggerConfiguration.java

@Configuration
@EnableSwagger2
@SwaggerDefinition(
        info = @Info(
                description = "Web Service",
                version = "V0.0.1",
                title = "Web Service",
                contact = @Contact(
                        name = "Me",
                        email = "dev@me.com",
                        url = "https://www.me.com/"
                )
        ),
        consumes = {"application/json"},
        produces = {"application/json"},
        schemes = {SwaggerDefinition.Scheme.HTTP, SwaggerDefinition.Scheme.HTTPS}
)
public class SwaggerConfiguration {

    /** List of Swagger endpoints (used by {@code WebSecurityConfig}) */
    static final String[] SWAGGER_ENDPOINTS = {
            "/v2/api-docs",
            "/swagger-resources",
            "/swagger-resources/**",
            "/configuration/ui",
            "/configuration/security",
            "/swagger-ui.html",
            "/webjars/**"
    };

    @Bean
    public Docket swaggerSpringMvcPlugin() {
        return new Docket(DocumentationType.SWAGGER_2)
                .groupName("admin-api")
                .select()
                .paths(paths()) // and by paths
                .build();
    }

    private Predicate<String> paths() {
        return or(
                regex("/admin.*"),
                regex("/issuer.*"),
                regex("/validator.*"),
                regex("/data.*"));

    }
}

这是我的 WebSecurityConfig.java :

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private JwtTokenDecoder jwtTokenDecoder;


    @Bean
    // Mandatory to be able to have % in URL
    // FIXME Set it only for dev environment
    public HttpFirewall allowUrlEncodedPercentHttpFirewall() {
        StrictHttpFirewall firewall = new StrictHttpFirewall();
        firewall.setAllowUrlEncodedPercent(true);
        firewall.setAllowUrlEncodedSlash(true);

        return firewall;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .httpBasic().disable()
                .formLogin().disable()
                .logout().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        // Install the JWT authentication filter
        http.addFilterBefore(new JwtAuthenticationFilter(jwtTokenDecoder), BasicAuthenticationFilter.class);

        // Authorize only authenticated requests
        http.authorizeRequests()
                .anyRequest().authenticated();

       http.cors();
    }

    @Override
    public void configure(WebSecurity web) {
        // Allow access to /admin/login without authentication
        web.ignoring().mvcMatchers("/admin/login", "/admin/validate", "/campaigns", "/data/**", "/issuer/**", "/validator/**");
        web.ignoring().antMatchers(SwaggerConfiguration.SWAGGER_ENDPOINTS);
        web.httpFirewall(allowUrlEncodedPercentHttpFirewall());
    }
}

最后，我有一个 WebConfig.java 用于设置 CORS 授权。在这里：

@Configuration
@EnableWebMvc
public class WebConfig implements WebMvcConfigurer {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                    .allowedOrigins("*")
                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE");
    }
}

很简单。它应该授权几乎所有访问。当我删除它时，可以从 URL localhost:8080/swagger-ui.html 获得 Swagger（但不是我的网络服务...）当我放回去时，它被阻止了，并出现 403 错误 (forbidden)

知道我遗漏了什么吗？

Answer 1

所以解决方案是在 WebConfig

中添加一些配置

我已经添加了这个实现

@Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {

    registry
            .addResourceHandler("swagger-ui.html")
            .addResourceLocations("classpath:/META-INF/resources/");

    registry
            .addResourceHandler("/webjars/**")
            .addResourceLocations("classpath:/META-INF/resources/webjars/");
}

"addCorsMapping" 阻止 Swagger UI

"addCorsMapping" blocking Swagger UI

spring

spring-security

swagger-ui