我的应用程序同时服务于API和浏览器。我已经使用所有自定义提供程序和过滤器实现了API令牌身份验证。现在,配置似乎会影响浏览器的版本。
我有两个问题需要建议如何解决,因为在深入研究文档和其他示例后,我没有取得任何进展。
1)尽管有来自浏览器的请求,但我的StatelessAuthenticationFilter
仍被调用。例如,我已经将请求匹配器指定为"/api/**“。为什么会这样呢?
2) AuthenticationManager
没有注册两个AuthenticationProvider
,这是我调试了错误调用的StatelessAuthenticationFilter
后得出的结论。
下面是我拥有的配置类
@Configuration
@EnableWebSecurity
public class WebSecurityConfig {
@Order(1)
@Configuration
public static class A extends WebSecurityConfigurerAdapter {
@Autowired
TokenAuthenticationProvider tokenAuthenticationProvider;
@Autowired
ApiEntryPoint apiEntryPoint;
@Override
protected void configure(HttpSecurity http) throws Exception {
StatelessAuthenticationFilter filter = new StatelessAuthenticationFilter();
AntPathRequestMatcher requestMatcher = new AntPathRequestMatcher("/api/**");
filter.setRequiresAuthenticationRequestMatcher(requestMatcher);
filter.setAuthenticationManager(super.authenticationManager());
http.csrf().disable()
.exceptionHandling().authenticationEntryPoint(apiEntryPoint)
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class);
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(tokenAuthenticationProvider);
}
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/api/user/register");
}
}
@Configuration
public static class B extends WebSecurityConfigurerAdapter {
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(new DaoAuthenticationProvider());
}
}
}
正如您所看到的,B类没有指定任何内容,但是当我访问localhost:8080时,就会调用StatelessAuthenticationFilter。这里发生什么事情?
https://stackoverflow.com/questions/38103174
复制相似问题