Configurazione di sicurezza con Spring-boot

Question

Ho creato una classe di configurazione Spring Security per Spring-Boot. La mia pagina di login ha risorse css, js e ico files. Le risorse vengono rifiutate per motivi di sicurezza e reindirizzate ogni volta alla pagina di accesso. Perché EnableWebMVCSecurity non aggiunge la posizione della risorsa Classpath. Dopo aver modificato il codice come nel secondo frammento, viene aggiunta la posizione della risorsa I Classpath. non capisco cosa mi manca per le risorse nel primo snippet di codice.

@Configuration 

/* 
* Enable Spring Security’s web security support and provide the Spring MVC integration 
* It also extends WebSecurityConfigurerAdapter and overrides a couple of its methods to set some specifics of the web security configuration. 
*/ 
@EnableWebMvcSecurity 
public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 

/** 
* The configure(HttpSecurity) method defines with URL paths should be 
    * secured and which should not. 
    */ 
    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
     .authorizeRequests() 
      .anyRequest().authenticated(); 

//  There is a custom "/login" page specified by loginPage(), and everyone 
//  is allowed to view it.  
     http 
      .formLogin() 
       .loginPage("/login.html") 
       .permitAll() 
       .and() 
      .logout() 
       .permitAll().logoutSuccessUrl("/login.html"); 
    } 

    @Configuration 
    protected static class AuthenticationConfiguration extends 
      GlobalAuthenticationConfigurerAdapter { 
     @Override 
     public void init(AuthenticationManagerBuilder auth) throws Exception { 
//   As for the configure(AuthenticationManagerBuilder) method, it sets up 
//   an in-memory user store with a single user. That user is given a 
//   username of "user", a password of "password", and a role of "USER". 
      auth 
        .inMemoryAuthentication() 
        .withUser("user@domain.com").password("password").roles("USER"); 
     } 
    } 

Ho ottenuto questo lavoro modificando il codice di

@Configuration 
/* 
* Enable Spring Security’s web security support and provide the Spring MVC integration 
* It also extends WebSecurityConfigurerAdapter and overrides a couple of its methods to set some specifics of the web security configuration. 
*/ 
public class WebSecurityConfig{ 

    @Bean 
    public ApplicationSecurity applicationSecurity() { 
     return new ApplicationSecurity(); 
    } 

    @Bean 
    public AuthenticationSecurity authenticationSecurity() { 
     return new AuthenticationSecurity(); 
    } 

    @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) 
    protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter { 
     @Override 
     protected void configure(HttpSecurity http) throws Exception { 
      http 
      .authorizeRequests() 
       .anyRequest().authenticated(); 
      http 
       .formLogin() 
        .loginPage("/login.html") 
        .permitAll() 
        .and() 
       .logout() 
        .permitAll().logoutSuccessUrl("/login.html"); 

     } 
    } 

    @Order(Ordered.HIGHEST_PRECEDENCE + 10) 
    protected static class AuthenticationSecurity extends 
      GlobalAuthenticationConfigurerAdapter { 
     @Override 
     public void init(AuthenticationManagerBuilder auth) throws Exception { 
      auth 
      .inMemoryAuthentication() 
      .withUser("user@domain.com").password("password").roles("USER"); 

     } 
    } 
} 

Dopo aver modificato il codice ho notato che i sentieri Ignora sono stati aggiunti al filtro e vedo quanto segue in ceppi:

 
[ost-startStop-1] o.s.s.web.DefaultSecurityFilterChain  : Creating filter chain: Ant [pattern='/css/**'], [] 
[ost-startStop-1] o.s.s.web.DefaultSecurityFilterChain  : Creating filter chain: Ant [pattern='/js/**'], [] 
[ost-startStop-1] o.s.s.web.DefaultSecurityFilterChain  : Creating filter chain: Ant [pattern='/images/**'], [] 
[ost-startStop-1] o.s.s.web.DefaultSecurityFilterChain  : Creating filter chain: Ant [pattern='/**/favicon.ico'], [] 
[ost-startStop-1] o.s.s.web.DefaultSecurityFilterChain  : Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@4e3e0069, org.springframework.security.web.context.SecurityContextPersistenceFilter@3d2dd0cf, org.springframework.security.web.header.HeaderWriterFilter@33fc3b02, org.springframework.security.web.csrf.CsrfFilter@9b7a3ac, org.springframework.security.web.authentication.logout.LogoutFilter@267237ef, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@129495ef, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@7db0a467, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@764d1dbd, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@25a5268d, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@15c01d0c, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@37818a3b, org.springframework.security.web.session.SessionManagementFilter@3fe57e49, org.springframework.security.web.access.ExceptionTranslationFilter@4278af59, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@424bef91] 

Answer 1

Per il docs è stato disabilitato l'autoconfig di avvio di primavera nel primo esempio utilizzando @EnableWebSecurity, quindi è necessario ignorare esplicitamente tutte le sta risorse di tic manualmente. Nel secondo esempio viene semplicemente fornito un WebSecurityConfigurer che è additivo in cima all'autoconfig predefinito.

Answer 2

Creare un file di di configurazione che si estende WebSecurityConfigurerAdapter e annotare la classe con @EnableWebSecurity

È possibile ignorare metodi come configure(HttpSecurity http) per aggiungere sicurezza di base come qui di seguito

@Configuration 
@EnableWebSecurity 
public class AppWebSecurityConfigurer extends WebSecurityConfigurerAdapter { 
    @Override 
    protected void configure(HttpSecurity http) throws Exception {  
     http 
      .csrf().disable() 
      .authorizeRequests() 
       .anyRequest().permitAll(); 
     } 
}