启用 Spring 安全性使 Swagger 输出 text/plain 而不是 HTML

Question

大摇大摆的作品！我可以和 http://localhost:8090/sdoc.jsp 互动，一切都很好。

我将以下内容添加到 pom.xml...

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

我还添加了以下两个文件：

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        String name = authentication.getName();
        String password = authentication.getCredentials().toString();

        if( !Authenticate.authenticate(name, password) )
            return null;

        List<GrantedAuthority> grantedAuths = new ArrayList<>();
        grantedAuths.add(new SimpleGrantedAuthority("ROLE_USER"));
        Authentication auth = new UsernamePasswordAuthenticationToken(name, password, grantedAuths);
        return auth;
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}

和

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
                .disable()

            .authorizeRequests()
                .anyRequest().permitAll()
                .antMatchers("/**").authenticated().and()
                .formLogin().loginPage("/login").permitAll().and()
                .httpBasic()
                ;
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(new CustomAuthenticationProvider());
    }
}

此时，如果我访问之前工作的同一个 URL，我现在得到的响应类型是 "text/plain"，而不是漂亮的 HTML 浏览器，我看到了源代码代码。

如果我还原更改并从项目中删除这两个文件并删除 JAR 文件，它将再次工作。

如何让 Spring Security 和 Swagger 发挥良好的作用？我做错了什么。

Answer 1

我怀疑这是由于 Spring-Security 对 content-type headers (http://docs.spring.io/spring-security/site/docs/3.2.0.CI-SNAPSHOT/reference/html/headers.html#headers-content-type-options) 的影响。

来自文档 -

Historically browsers, including Internet Explorer, would try to guess the content type of a request using content sniffing. This allowed browsers to improve the user experience by guessing the content type on resources that had not specified the content type. For example, if a browser encountered a JavaScript file that did not have the content type specified, it would be able to guess the content type and then execute it.

The problem with content sniffing is that this allowed malicious users to use polyglots (i.e. a file that is valid as multiple content types) to execute XSS attacks. For example, some sites may allow users to submit a valid postscript document to a website and view it. A malicious user might create a postscript document that is also a valid JavaScript file and execute a XSS attack with it.

同样，从文档中，为了覆盖默认值 -

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends
   WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
      // ...
      .headers()
        .contentTypeOptions();
  }
}

Answer 2

哇，我认为这是沿着这些方向发展的。非常感谢

当我尝试这个并开始工作时

.headers()
    .disable()

我将默认的 contentTypeOptions 缩小为..

.headers()
        //.contentTypeOptions()   // If this is uncommented it fails.
        .xssProtection()
        .cacheControl()
        .httpStrictTransportSecurity()
        .frameOptions()
        .and()

启用 Spring 安全性使 Swagger 输出 text/plain 而不是 HTML

Enabling Spring Security makes Swagger output text/plain instead of HTML

spring-security

spring-boot

swagger

swagger-ui

swagger-maven-plugin