security java的配置,基于Java的配置以启用Spring Security匿名访问

I want to enable the use of "ROLE_ANONYMOUS" to allow anonymous access to some urls in my app. And I used the below configuration.

@Override

protected void configure(HttpSecurity http) throws Exception {

http

.requestCache()

.requestCache(new NullRequestCache()).and()

.anonymous().authorities("ROLE_ANONYMOUS").and()

.exceptionHandling().and()

.servletApi().and()

.headers().cacheControl().and()

.authorizeRequests()

.antMatchers("/").permitAll()

.antMatchers("/profile/image").permitAll()

.antMatchers("/favicon.ico").permitAll()

.antMatchers("/resources/**").permitAll()

//.antMatchers(HttpMethod.GET, "/login/**").permitAll()

//.antMatchers(HttpMethod.GET, "/location/**").permitAll()

.anyRequest().authenticated()/*.and()

.apply(new SpringSocialConfigurer())*/;

// custom Token based authentication based on the header previously given to the client

//.addFilterBefore(new StatelessAuthenticationFilter(tokenAuthenticationService), UsernamePasswordAuthenticationFilter.class);

}

My controller looks like:

@RestController

@RequestMapping(value="/login", produces="application/json")

public class LoginController {

@Secured( value={"ROLE_ANONYMOUS"})

@RequestMapping(method=RequestMethod.GET)

public String get(){

return "hello";

}

}

But when I try to hit "/login" I get 403 access denied error.

Please help me how I can enable annotation based anonymous access.

解决方案

As Faraj Farook wrote, you have to permit access to your login page URL. You commented the relevant line out:

@Override

protected void configure(HttpSecurity http) throws Exception {

http

.anonymous()

.authorities("ROLE_ANONYMOUS")

.and()

.headers()

.cacheControl()

.and()

.authorizeRequests()

.antMatchers("/").permitAll()

.antMatchers("/profile/image").permitAll()

.antMatchers("/favicon.ico").permitAll()

.antMatchers("/resources/**").permitAll()

.antMatchers(HttpMethod.GET, "/login/**").permitAll()

.anyRequest().authenticated()

}

But if you prefer not to use permitAll() you could use hasAuthority("ROLE_ANONYMOUS"). In this case you don't need to annotate your method with

@Secured( value={"ROLE_ANONYMOUS"}).