仅对此用户禁用 java_java – Spring Security：按客户端类型启用/禁用CSRF(浏览器/非浏览器)...

我确信有一种方法可以在Spring Security XML中执行此操作,但由于我使用的是Java Config,因此这是我的解决方案.

@Configuration

@EnableWebSecurity

public class SecurityConfig {

@Configuration

@Order(1)

public static class SoapApiConfigurationAdapter extends WebSecurityConfigurerAdapter {

protected void configure(HttpSecurity http) throws Exception {

http

.antMatcher("/soap/**")

.csrf().disable()

.httpBasic();

}

}

@Configuration

public static class WebApiConfigurationAdapter extends WebSecurityConfigurerAdapter {

protected void configure(HttpSecurity http) throws Exception {

http

.formLogin()

.loginProcessingUrl("/authentication")

.usernameParameter("j_username")

.passwordParameter("j_password").permitAll()

.and()

.csrf().disable()

}

}

}