Endpoint,Spring Security Configuration返回:该方法无法决定模式是否为SpringMVC

t3psigkw  于 2023-10-20  发布在  Spring
关注(0)|答案(1)|浏览(135)

SecurityFilterChain beans in SecurityConfiguration返回此错误我没有找到任何关于此方法的内容来解决它:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration {
    
      @Bean
        public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
            return  httpSecurity
                    .csrf(csrf -> csrf.disable())
                    .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                    .authorizeHttpRequests(authorize -> authorize
                            .requestMatchers(HttpMethod.POST, "/auth/login").permitAll()
                            .requestMatchers(HttpMethod.POST, "/auth/register").permitAll()
                            .requestMatchers(HttpMethod.POST, "/product").hasRole("ADMIN")
                            .anyRequest().authenticated()
                    )
                    .build();
        }
}

由于:org.springframework.beans.BeanInstantiationException:无法示例化[org.springframework.security.web.SecurityFilterChain]:工厂方法“securityFilterChain”引发异常,并显示消息:这个方法不能决定这些模式是否是Spring MVC模式。如果此端点是Spring MVC端点,请使用requestMatchers(MvcRequestMatcher);否则,请使用requestMatchers(AntPathRequestMatcher)。
原因:java.lang.IllegalArgumentException:这个方法不能决定这些模式是否是Spring MVC模式。如果此端点是Spring MVC端点,请使用requestMatchers(MvcRequestMatcher);否则,请使用requestMatchers(AntPathRequestMatcher)。

nnt7mjpx

nnt7mjpx1#

此处描述了原因cve-2023-34035
还有一些关于这个主题的讨论,你可以在这里找到13568
作为解决方法,您可以执行以下操作:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
    MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector);
    http.authorizeHttpRequests((requests) -> requests
        .requestMatchers(mvcMatcherBuilder.pattern("/test1")).permitAll()
        .anyRequest().authenticated()
    );
    return http.build();
}

相关问题