html 限制匿名访问,Spring Boot Security - 匿名用户访问默认映射/

我们有基于Spring启动的应用程序，并且我们希望给予匿名用户的默认/映射访问权限。 我们添加了默认的index.html(基本页面)。Spring Boot Security - 匿名用户访问默认映射/

在控制器

@RequestMapping("/")

public ModelAndView defaultViewManager(HttpServletRequest request) {

logger.info("Default mapping.");

ModelAndView modelAndView = new ModelAndView("index");

return modelAndView;

}

SecurityConfig

@Configuration

@EnableWebSecurity

public class SecurityConfig extends WebSecurityConfigurerAdapter {

private static final String SSO_HEADER = "AUTH_USER";

public static final String ADMIN = "ROLE_ADMIN";

public static final String USER = "ROLE_USER";

public static final String ANONYMOUS = "ROLE_ANONYMOUS";

@Autowired

private PreAuthUserDetailsService userDetailsService;

@Autowired

public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

auth.authenticationProvider(preAuthenticatedAuthProvider());

}

@Bean

public PreAuthenticatedAuthenticationProvider preAuthenticatedAuthProvider() {

UserDetailsByNameServiceWrapper wrapper =

new UserDetailsByNameServiceWrapper (userDetailsService);

PreAuthenticatedAuthenticationProvider authProvider = new PreAuthenticatedAuthenticationProvider();

authProvider.setPreAuthenticatedUserDetailsService(wrapper);

return authProvider;

}

@Bean

public RequestHeaderAuthenticationFilter headerAuthFilter() throws Exception {

RequestHeaderAuthenticationFilter filter = new RequestHeaderAuthenticationFilter();

filter.setPrincipalRequestHeader(SSO_HEADER);

filter.setAuthenticationManager(authenticationManagerBean());

return filter;

}

上面提到的代码可能没有必要，但对于背景下，我们使用的是PreAuthenticatedAuthentication提供商

@Override

protected void configure(HttpSecurity http) throws Exception {

// @formatter:off

http.addFilter(headerAuthFilter())

.authorizeRequests()

.antMatchers("/").permitAll()

.antMatchers("/admin/**").hasAuthority(ADMIN)

.antMatchers("/**").hasAuthority(USER)

.and()

.logout()

.deleteCookies("remove")

.invalidateHttpSession(true)

.logoutUrl("/logout")

.logoutSuccessUrl("/login?logout")

.and()

.csrf().disable()

.headers().frameOptions().disable();

// @formatter:on

}

}

仅供参考，我有也加入了拦截器。拦截器似乎被触发，即使有排除模式

public void addInterceptors(InterceptorRegistry registry) {

registry.addInterceptor(wikiRequestHandlerInterceptor()).

excludePathPatterns("/").addPathPatterns("/**");

}

在上述SecurityConfig代码。我试图允许使用.antMatchers("/").permitAll()并增加权限休息意味着所有/**和/admin/**。但是这不起作用。请帮助提及正确的antMatchers以提供对默认/映射的匿名访问。

在此先感谢。

+0

“因为”/“和”/ **“可能都匹配，所以我还尝试了”/ index“作为映射，permitAll()和excludePathPattern ...但对/ index的请求仍被检查以进行身份​​验证。 –

2015-02-11 22:47:41