Spring Security 5.2.2 + Spring Boot 2.2 + Oauth 自动配置：允许一些 uri 并仅保护少数：403 错误

Question

我有授权服务器和资源服务器。我已经自动配置了 OAuth 默认实现。不需要代码，只在

中完成了配置

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          jwk-set-uri:<auth server configuration url here>

Maven 依赖项

<dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>
                spring-boot-starter-oauth2-resource-server
            </artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

目前我所有的 url 都受到保护。

@PostMapping(path = "/secure/test", consumes = "application/json", produces = "application/json")   
    public @ResponseBody String testService(@RequestBody String name ,@RequestHeader Map<String, String>headers) {
headers.forEach((K,V)->printHeaders(K,V));
}

我希望每个人都可以访问我下面的 uri，

@PostMapping(path = "/test", consumes = "application/json", produces = "application/json")  
    public @ResponseBody String testAuthService(@RequestBody String name ,@RequestHeader Map<String, String>headers) {
headers.forEach((K,V)->printHeaders(K,V));
}

我尝试覆盖以下但在没有不记名令牌的情况下尝试时出现 403 错误

@Configuration
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) {
        try {
            http
                .authorizeRequests(authorize -> authorize
                    .mvcMatchers("/api/secure/**").authenticated()
                    .anyRequest().permitAll()
                )
                .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
        } catch (Exception e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
    }
}

错误响应

{
    "timestamp": "2020-05-07T14:28:22.729+0000",
    "status": 403,
    "error": "Forbidden",
    "message": "Forbidden",
    "path": "/api/test"
}

如何使用 Spring Security 5.2.2 + Spring Boot 2.2 + Oauth Autoconfiguration

只允许对某些 url 进行身份验证

Answer 1

如果您在执行 POST 时得到 403，您可能忘记提供 crsrf-token

CSRF 保护在 Java 配置中默认启用，但您可以禁用它。

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
      .csrf().disable()                 // <--- disable CSRF 
      .authorizeRequests(...
      ....

或者在您的表单中提供一个令牌。

<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>

如果您使用JSON，则不能将CSRF 令牌作为参数提交。相反，在 header.

中提交令牌

<meta name="_csrf" content="${_csrf.token}"/>
<meta name="_csrf_header" content="${_csrf.headerName}"/>

JS附上header.

var token = $("meta[name='_csrf']").attr("content");
var header = $("meta[name='_csrf_header']").attr("content");

$(document).ajaxSend(function(e, xhr, options) {
    xhr.setRequestHeader(header, token);
});

Spring Security 5.2.2 + Spring Boot 2.2 + Oauth 自动配置：允许一些 uri 并仅保护少数：403 错误

Spring Security 5.2.2 + Spring Boot 2.2 + Oauth Autoconfiguration : Permit some uri and secure only few : 403 Error

spring-security

spring-security-oauth2