Spring Security 403禁止：已调用预身份验证入口点,拒绝访问

qv7cva1a  于 2023-08-05  发布在  Spring
关注(0)|答案(1)|浏览(111)

我的控制器：

@RestController
@RequestMapping("/api/vi/client")
@RequiredArgsConstructor
public class FHubClientController {

    private final FHubService fHubService;
    @GetMapping("/findAllUsersByRole")
    public List<User> findAllUsersByRole(@RequestParam("role") String role) {
        System.out.println("sdfasgf");

        return fHubService.findAllUsersByRole(role.toUpperCase());
    }
}

字符串
我的安全配置：

package com.org.fhub.config;

import lombok.RequiredArgsConstructor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.logout.LogoutHandler;

import static com.org.fhub.domain.user.Permission.*;
import static com.org.fhub.domain.user.UserRoleEnum.ADMIN;
import static com.org.fhub.domain.user.UserRoleEnum.STAFF;
import static org.springframework.http.HttpMethod.*;

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
@EnableMethodSecurity
public class SecurityConfiguration {

    private final JwtAuthenticationFilter jwtAuthFilter;
    private final AuthenticationProvider authenticationProvider;
    private final LogoutHandler logoutHandler;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .csrf(AbstractHttpConfigurer::disable)
                .authorizeHttpRequests((authorize) -> {
                    authorize.requestMatchers(
                            "/api/v1/auth/**",
                            "/v2/api-docs",
                            "/v3/api-docs",
                            "/v3/api-docs/**",
                            "/swagger-resources",
                            "/swagger-resources/**",
                            "/configuration/ui",
                            "/configuration/security",
                            "/swagger-ui/**",
                            "/webjars/**",
                            "/swagger-ui.html"
                    ).permitAll();
                    authorize.requestMatchers("/api/v1/staff/**").hasAnyRole(ADMIN.name(), STAFF.name());
                    authorize.requestMatchers(GET, "/api/v1/staff/**").hasAnyAuthority(ADMIN_READ.name(), STAFF_READ.name());
                    authorize.requestMatchers(POST, "/api/v1/staff/**").hasAnyAuthority(ADMIN_CREATE.name(), STAFF_CREATE.name());
                    authorize.requestMatchers(PUT, "/api/v1/staff/**").hasAnyAuthority(ADMIN_UPDATE.name(), STAFF_UPDATE.name());
                    authorize.requestMatchers(DELETE, "/api/v1/staff/**").hasAnyAuthority(ADMIN_DELETE.name(), STAFF_DELETE.name());
                    authorize.anyRequest().authenticated();
                })

                /* .requestMatchers("/api/v1/admin/**").hasRole(ADMIN.name())

                 .requestMatchers(GET, "/api/v1/admin/**").hasAuthority(ADMIN_READ.name())
                 .requestMatchers(POST, "/api/v1/admin/**").hasAuthority(ADMIN_CREATE.name())
                 .requestMatchers(PUT, "/api/v1/admin/**").hasAuthority(ADMIN_UPDATE.name())
                 .requestMatchers(DELETE, "/api/v1/admin/**").hasAuthority(ADMIN_DELETE.name())*/

                .sessionManagement((session) -> session
                        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                )
                .authenticationProvider(authenticationProvider)
                .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class)
                .logout((logout) -> logout.logoutUrl("/api/v1/auth/logout").addLogoutHandler(logoutHandler).logoutSuccessHandler((request, response, authentication) -> SecurityContextHolder.clearContext()))
        ;

        return http.build();
    }
}

型
我的过滤器：

package com.org.fhub.config;

import com.org.fhub.domain.token.TokenRepository;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.RequiredArgsConstructor;
import org.springframework.lang.NonNull;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;

@RequiredArgsConstructor
@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtService jwtService;
    private final UserDetailsService userDetailsService;
    private final TokenRepository tokenRepository;

    @Override
    protected void doFilterInternal(
            @NonNull HttpServletRequest request,
            @NonNull HttpServletResponse response,
            @NonNull FilterChain filterChain
    ) throws ServletException, IOException {
        if (request.getServletPath().contains("/api/v1/auth")) {
            filterChain.doFilter(request, response);
            return;
        }
        final String authHeader = request.getHeader("Authorization");
        final String jwt;
        final String username;
        if (authHeader == null ||!authHeader.startsWith("Bearer ")) {
            filterChain.doFilter(request, response);
            return;
        }
        jwt = authHeader.substring(7);
        username = jwtService.extractUsername(jwt);
        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
            var isTokenValid = tokenRepository.findByToken(jwt)
                    .map(t -> !t.isExpired() && !t.isRevoked())
                    .orElse(false);
            if (jwtService.isTokenValid(jwt, userDetails) && isTokenValid) {
                UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                        userDetails,
                        null,
                        userDetails.getAuthorities()
                );
                authToken.setDetails(
                        new WebAuthenticationDetailsSource().buildDetails(request)
                );
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }
        filterChain.doFilter(request, response);
    }
}

型
我的应用程序配置：

package com.org.fhub.config;

import com.org.fhub.domain.user.UserRepository;
import lombok.RequiredArgsConstructor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@RequiredArgsConstructor
public class ApplicationConfig {

    private final UserRepository repository;

    @Bean
    public UserDetailsService userDetailsService() {
        return username -> repository.findUserByUserName(username)
                .orElseThrow(() -> new UsernameNotFoundException("User not found"));
    }

    @Bean
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService());
        authProvider.setPasswordEncoder(passwordEncoder());
        return authProvider;
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}

型
我的jwtService：

package com.org.fhub.config;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import io.jsonwebtoken.io.Decoders;
import io.jsonwebtoken.security.Keys;
import java.security.Key;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import java.util.function.Function;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Service;

@Service
public class JwtService {

    @Value("${application.security.jwt.secret-key}")
    private String secretKey;
    @Value("${application.security.jwt.expiration}")
    private long jwtExpiration;
    @Value("${application.security.jwt.refresh-token.expiration}")
    private long refreshExpiration;

    public String extractUsername(String token) {
        return extractClaim(token, Claims::getSubject);
    }

    public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
        final Claims claims = extractAllClaims(token);
        return claimsResolver.apply(claims);
    }

    public String generateToken(UserDetails userDetails) {
        return generateToken(new HashMap<>(), userDetails);
    }

    public String generateToken(
            Map<String, Object> extraClaims,
            UserDetails userDetails
    ) {
        return buildToken(extraClaims, userDetails, jwtExpiration);
    }

    public String generateRefreshToken(
            UserDetails userDetails
    ) {
        return buildToken(new HashMap<>(), userDetails, refreshExpiration);
    }

    private String buildToken(
            Map<String, Object> extraClaims,
            UserDetails userDetails,
            long expiration
    ) {
        return Jwts
                .builder()
                .setClaims(extraClaims)
                .setSubject(userDetails.getUsername())
                .setIssuedAt(new Date(System.currentTimeMillis()))
                .setExpiration(new Date(System.currentTimeMillis() + expiration))
                .signWith(getSignInKey(), SignatureAlgorithm.HS256)
                .compact();
    }

    public boolean isTokenValid(String token, UserDetails userDetails) {
        final String username = extractUsername(token);
        return (username.equals(userDetails.getUsername())) && !isTokenExpired(token);
    }

    private boolean isTokenExpired(String token) {
        return extractExpiration(token).before(new Date());
    }

    private Date extractExpiration(String token) {
        return extractClaim(token, Claims::getExpiration);
    }

    private Claims extractAllClaims(String token) {
        return Jwts
                .parserBuilder()
                .setSigningKey(getSignInKey())
                .build()
                .parseClaimsJws(token)
                .getBody();
    }

    private Key getSignInKey() {
        byte[] keyBytes = Decoders.BASE64.decode(secretKey);
        return Keys.hmacShaKeyFor(keyBytes);
    }
}

型
令牌是有效的，它说authenticated=true
日志产生：

2023-07-15T16:58:39.175+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Trying to match request against DefaultSecurityFilterChain [RequestMatcher=any request, Filters=[org.springframework.security.web.session.DisableEncodeUrlFilter@359e27d2, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@277bc3a5, org.springframework.security.web.context.SecurityContextHolderFilter@4ffa7041, org.springframework.security.web.header.HeaderWriterFilter@71fb8301, org.springframework.security.web.authentication.logout.LogoutFilter@749d7c01, com.org.fhub.config.JwtAuthenticationFilter@7cc2c551, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@56b05bd7, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@3e4afd10, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@214fba74, org.springframework.security.web.session.SessionManagementFilter@485c84d7, org.springframework.security.web.access.ExceptionTranslationFilter@5c4714ef, org.springframework.security.web.access.intercept.AuthorizationFilter@7e1d8d41]] (1/1)
2023-07-15T16:58:39.177+01:00 DEBUG 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Securing GET /api/v1/client/findAllUsersByRole?role=PLUS
2023-07-15T16:58:39.177+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking DisableEncodeUrlFilter (1/12)
2023-07-15T16:58:39.178+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking WebAsyncManagerIntegrationFilter (2/12)
2023-07-15T16:58:39.181+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking SecurityContextHolderFilter (3/12)
2023-07-15T16:58:39.182+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking HeaderWriterFilter (4/12)
2023-07-15T16:58:39.183+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking LogoutFilter (5/12)
2023-07-15T16:58:39.183+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.s.w.a.logout.LogoutFilter            : Did not match request to Or [Ant [pattern='/api/v1/auth/logout', GET], Ant [pattern='/api/v1/auth/logout', POST], Ant [pattern='/api/v1/auth/logout', PUT], Ant [pattern='/api/v1/auth/logout', DELETE]]
2023-07-15T16:58:39.183+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking JwtAuthenticationFilter (6/12)
2023-07-15T16:58:43.728+01:00 TRACE 21592 --- [0.1-8080-exec-1] .s.s.w.c.SupplierDeferredSecurityContext : Created SecurityContextImpl [Null authentication]
2023-07-15T16:58:45.906+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking RequestCacheAwareFilter (7/12)
2023-07-15T16:58:45.906+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking SecurityContextHolderAwareRequestFilter (8/12)
2023-07-15T16:58:45.908+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking AnonymousAuthenticationFilter (9/12)
2023-07-15T16:58:45.908+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking SessionManagementFilter (10/12)
2023-07-15T16:58:45.909+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.s.w.a.AnonymousAuthenticationFilter  : Did not set SecurityContextHolder since already authenticated UsernamePasswordAuthenticationToken [Principal=User(id=64b2afc9b0ab605e709f61b6, username=kokoro, name=Brito, password=$2a$10$2PN0M.nH.tUa6sqXX/RaAOIS8kcH4FZUGEO9AzD6Dat/98gW7BF4S, notes=notas, role=PLUS, tokens=null), Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=null], Granted Authorities=[ROLE_PLUS]]
2023-07-15T16:58:45.909+01:00 TRACE 21592 --- [0.1-8080-exec-1] s.CompositeSessionAuthenticationStrategy : Preparing session with ChangeSessionIdAuthenticationStrategy (1/1)
2023-07-15T16:58:45.909+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking ExceptionTranslationFilter (11/12)
2023-07-15T16:58:45.909+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking AuthorizationFilter (12/12)
2023-07-15T16:58:45.910+01:00 TRACE 21592 --- [0.1-8080-exec-1] estMatcherDelegatingAuthorizationManager : Authorizing SecurityContextHolderAwareRequestWrapper[ org.springframework.security.web.header.HeaderWriterFilter$HeaderWriterRequest@1e14ac53]
2023-07-15T16:58:45.923+01:00 TRACE 21592 --- [0.1-8080-exec-1] estMatcherDelegatingAuthorizationManager : Checking authorization on SecurityContextHolderAwareRequestWrapper[ org.springframework.security.web.header.HeaderWriterFilter$HeaderWriterRequest@1e14ac53] using org.springframework.security.authorization.AuthenticatedAuthorizationManager@2918d923
2023-07-15T16:58:45.924+01:00 DEBUG 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Secured GET /api/v1/client/findAllUsersByRole?role=PLUS
2023-07-15T16:58:45.937+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.s.w.header.writers.HstsHeaderWriter  : Not injecting HSTS header since it did not match request to [Is Secure]
2023-07-15T16:58:45.940+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Trying to match request against DefaultSecurityFilterChain [RequestMatcher=any request, Filters=[org.springframework.security.web.session.DisableEncodeUrlFilter@359e27d2, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@277bc3a5, org.springframework.security.web.context.SecurityContextHolderFilter@4ffa7041, org.springframework.security.web.header.HeaderWriterFilter@71fb8301, org.springframework.security.web.authentication.logout.LogoutFilter@749d7c01, com.org.fhub.config.JwtAuthenticationFilter@7cc2c551, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@56b05bd7, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@3e4afd10, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@214fba74, org.springframework.security.web.session.SessionManagementFilter@485c84d7, org.springframework.security.web.access.ExceptionTranslationFilter@5c4714ef, org.springframework.security.web.access.intercept.AuthorizationFilter@7e1d8d41]] (1/1)
2023-07-15T16:58:45.940+01:00 DEBUG 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Securing GET /error?role=PLUS
2023-07-15T16:58:45.940+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking DisableEncodeUrlFilter (1/12)
2023-07-15T16:58:45.940+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking WebAsyncManagerIntegrationFilter (2/12)
2023-07-15T16:58:45.940+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking SecurityContextHolderFilter (3/12)
2023-07-15T16:58:45.940+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking HeaderWriterFilter (4/12)
2023-07-15T16:58:45.940+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking LogoutFilter (5/12)
2023-07-15T16:58:45.941+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.s.w.a.logout.LogoutFilter            : Did not match request to Or [Ant [pattern='/api/v1/auth/logout', GET], Ant [pattern='/api/v1/auth/logout', POST], Ant [pattern='/api/v1/auth/logout', PUT], Ant [pattern='/api/v1/auth/logout', DELETE]]
2023-07-15T16:58:45.941+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking JwtAuthenticationFilter (6/12)
2023-07-15T16:58:45.941+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking RequestCacheAwareFilter (7/12)
2023-07-15T16:58:45.941+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking SecurityContextHolderAwareRequestFilter (8/12)
2023-07-15T16:58:45.941+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking AnonymousAuthenticationFilter (9/12)
2023-07-15T16:58:45.941+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking SessionManagementFilter (10/12)
2023-07-15T16:58:45.941+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking ExceptionTranslationFilter (11/12)
2023-07-15T16:58:45.941+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking AuthorizationFilter (12/12)
2023-07-15T16:58:45.941+01:00 TRACE 21592 --- [0.1-8080-exec-1] estMatcherDelegatingAuthorizationManager : Authorizing SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.core.ApplicationHttpRequest@4a6fe6ad]]
2023-07-15T16:58:45.945+01:00 TRACE 21592 --- [0.1-8080-exec-1] estMatcherDelegatingAuthorizationManager : Checking authorization on SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.core.ApplicationHttpRequest@4a6fe6ad]] using org.springframework.security.authorization.AuthenticatedAuthorizationManager@2918d923
2023-07-15T16:58:45.945+01:00 TRACE 21592 --- [0.1-8080-exec-1] .s.s.w.c.SupplierDeferredSecurityContext : Created SecurityContextImpl [Null authentication]
2023-07-15T16:58:45.946+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.s.w.a.AnonymousAuthenticationFilter  : Set SecurityContextHolder to AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=null], Granted Authorities=[ROLE_ANONYMOUS]]
2023-07-15T16:58:45.946+01:00 TRACE 21592 --- [0.1-8080-exec-1] o.s.s.w.a.ExceptionTranslationFilter     : Sending AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=null], Granted Authorities=[ROLE_ANONYMOUS]] to authentication entry point since access is denied

org.springframework.security.access.AccessDeniedException: Access Denied
    at org.springframework.security.web.access.intercept.AuthorizationFilter.doFilter(AuthorizationFilter.java:98) ~[spring-security-web-6.1.1.jar:6.1.1]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.1.1.jar:6.1.1]
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:126) ~[spring-security-web-6.1.1.jar:6.1.1]
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:120) ~[spring-security-web-6.1.1.jar:6.1.1]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.1.1.jar:6.1.1]

2023-07-15T16:58:45.951+01:00 DEBUG 21592 --- [0.1-8080-exec-1] o.s.s.w.a.Http403ForbiddenEntryPoint     : Pre-authenticated entry point called. Rejecting access

型
我的构建。gradle：

implementation 'org.springframework.boot:spring-boot-starter-data-mongodb'
    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'org.springframework.boot:spring-boot-starter-security:3.1.1'

型
我正确地发送承载，并与DB验证它。所有其他具有权限的端点/控制器工作正常、注册、删除等。这个甚至不进控制器。
我希望允许执行此端点。

spring-security

1条答案

按热度按时间
lx0bsm1f

lx0bsm1f1#

现在遇到同样的问题，你是怎么解决的？

赞(0）分享  回复(0）举报  2023-08-05
我来回答

相关问题

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新问答

    更多
    • 蜀ICP备2022004421号-2 NULL123 https://www.null123.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com