Come configurare Spring Security per consentire l'accesso all'URL di Swagger senza autenticazione

Question

Il mio progetto ha Spring Security. Problema principale: impossibile accedere all'URL swagger a http://localhost:8080/api/v2/api-docs. Dice intestazione di autorizzazione mancante o non valida.

Screenshot of the browser window mio pom.xml ha le seguenti voci

<dependency> 
     <groupId>io.springfox</groupId> 
     <artifactId>springfox-swagger2</artifactId> 
     <version>2.4.0</version> 
    </dependency> 

    <dependency> 
     <groupId>io.springfox</groupId> 
     <artifactId>springfox-swagger-ui</artifactId> 
     <version>2.4.0</version> 
    </dependency> 

SwaggerConfig:

@Configuration 
@EnableSwagger2 
public class SwaggerConfig { 

@Bean 
public Docket api() { 
    return new Docket(DocumentationType.SWAGGER_2).select() 
      .apis(RequestHandlerSelectors.any()) 
      .paths(PathSelectors.any()) 
      .build() 
      .apiInfo(apiInfo()); 
} 

private ApiInfo apiInfo() { 
    ApiInfo apiInfo = new ApiInfo("My REST API", "Some custom description of API.", "API TOS", "Terms of service", "myeaddress@company.com", "License of API", "API license URL"); 
    return apiInfo; 
} 

AppConfig:

@Configuration 
@EnableWebMvc 
@ComponentScan(basePackages = { "com.musigma.esp2" }) 
@Import(SwaggerConfig.class) 
public class AppConfig extends WebMvcConfigurerAdapter { 

// ========= Overrides =========== 

@Override 
public void addInterceptors(InterceptorRegistry registry) { 
    registry.addInterceptor(new LocaleChangeInterceptor()); 
} 

@Override 
public void addResourceHandlers(ResourceHandlerRegistry registry) { 
    registry.addResourceHandler("swagger-ui.html") 
     .addResourceLocations("classpath:/META-INF/resources/"); 

    registry.addResourceHandler("/webjars/**") 
     .addResourceLocations("classpath:/META-INF/resources/webjars/"); 
} 

voci web.xml:

<context-param> 
    <param-name>contextConfigLocation</param-name> 
    <param-value> 
     com.musigma.esp2.configuration.AppConfig 
     com.musigma.esp2.configuration.WebSecurityConfiguration 
     com.musigma.esp2.configuration.PersistenceConfig 
     com.musigma.esp2.configuration.ACLConfig 
     com.musigma.esp2.configuration.SwaggerConfig 
    </param-value> 
</context-param> 

WebSecurityConfig:

@Configuration 
@EnableWebSecurity 
@EnableGlobalMethodSecurity(prePostEnabled = true) 
@ComponentScan(basePackages = { "com.musigma.esp2.service", "com.musigma.esp2.security" }) 
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { 
@Override 
    protected void configure(HttpSecurity httpSecurity) throws Exception { 
     httpSecurity 
     .csrf() 
      .disable() 
     .exceptionHandling() 
      .authenticationEntryPoint(this.unauthorizedHandler) 
      .and() 
     .sessionManagement() 
      .sessionCreationPolicy(SessionCreationPolicy.STATELESS) 
      .and() 
     .authorizeRequests() 
      .antMatchers("/auth/login", "/auth/logout").permitAll() 
      .antMatchers("/api/**").authenticated() 
      .anyRequest().authenticated(); 

     // custom JSON based authentication by POST of {"username":"<name>","password":"<password>"} which sets the token header upon authentication 
     httpSecurity.addFilterBefore(loginFilter(), UsernamePasswordAuthenticationFilter.class); 

     // custom Token based authentication based on the header previously given to the client 
     httpSecurity.addFilterBefore(new StatelessTokenAuthenticationFilter(tokenAuthenticationService), UsernamePasswordAuthenticationFilter.class); 
    } 
} 

Answer 1

L'aggiunta di questo alla classe WebSecurityConfiguration dovrebbe fare il trucco.

@Configuration 
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { 

    @Override 
    public void configure(WebSecurity web) throws Exception { 
     web.ignoring().antMatchers("/v2/api-docs", "/configuration/ui", "/swagger-resources", "/configuration/security", "/swagger-ui.html", "/webjars/**"); 
    } 

} 

Answer 2

Ho aggiornato con/configuration/** e/swagger-resources/** e ha funzionato per me.

@Override 
public void configure(WebSecurity web) throws Exception { 
    web.ignoring().antMatchers("/v2/api-docs", "/configuration/ui", "/swagger-resources/**", "/configuration/**", "/swagger-ui.html", "/webjars/**"); 

} 

Answer 3

Ho avuto lo stesso problema utilizzando Spring Boot 2.0.0.M7 + Spring Security + Springfox 2.8.0. E ho risolto il problema utilizzando la seguente configurazione di sicurezza che consente l'accesso pubblico alle risorse dell'interfaccia utente di Swagger.

@Configuration 
@EnableWebSecurity 
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true) 
public class SecurityConfiguration extends WebSecurityConfigurerAdapter { 

    private static final String[] AUTH_WHITELIST = { 
      // -- swagger ui 
      "/v2/api-docs", 
      "/swagger-resources", 
      "/swagger-resources/**", 
      "/configuration/ui", 
      "/configuration/security", 
      "/swagger-ui.html", 
      "/webjars/**" 
      // other public endpoints of your API may be appended to this array 
    }; 


    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http. 
       // ... here goes your custom security configuration 
       authorizeRequests(). 
       antMatchers(AUTH_WHITELIST).permitAll(). // whitelist Swagger UI resources 
       // ... here goes your custom security configuration 
       antMatchers("/**").authenticated(); // require authentication for any endpoint that's not whitelisted 
    } 

} 

Answer 4

@Override 
    protected void configure(HttpSecurity http) throws Exception { 
    http 
    .csrf().disable() 
    .authorizeRequests() 
     .antMatchers("/api/**").authenticated() 
     .anyRequest().permitAll() 
     .and() 
    .httpBasic().and() 
    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS); 
}