为了只在swagger上进行身份验证，我实现了两个不同的过滤器链。一个用于swagger，另一个用于整个服务。这是我的SecurityConfig的样子：

http.addFilterBefore(ssoAuthFilter, UsernamePasswordAuthenticationFilter.class);

        http.authorizeHttpRequests(c ->
                            c.requestMatchers("/swagger-ui").hasAnyAuthority("STAFF","ADMIN","CASHIER","TENANTADMIN")
                                    .requestMatchers("/api-docs/swagger-config").permitAll()
                                    .requestMatchers("/swagger-ui/login").permitAll()
                                    .requestMatchers("/actuator/health").permitAll()
                                    .requestMatchers("/actuator/prometheus").permitAll()
                                    .requestMatchers("/api-docs").hasAnyAuthority("STAFF","ADMIN", "CASHIER", "TENANTADMIN")
                                    .requestMatchers("/api-docs/eod").hasAnyAuthority("ADMIN", "STAFF", "TENANTADMIN", "CASHIER")
                                    .requestMatchers("/api-docs/statistics").hasAnyAuthority("ADMIN", "STAFF", "CASHIER", "TENANTADMIN")
                                    .dispatcherTypeMatchers( DispatcherType.ERROR ).permitAll()
                            .anyRequest().authenticated()
        );

        http.formLogin(form -> form
                .loginPage("/swagger-ui/login")
                .loginProcessingUrl("/swagger-ui/login")
                .successHandler(myAuthenticationSuccessHandler())
                .failureHandler(myAuthenticationFailureHandler())
                .permitAll()
        );

        http.addFilterBefore(swaggerAuthFilter, UsernamePasswordAuthenticationFilter.class).exceptionHandling(handling -> {
            handling.accessDeniedHandler(accessDeniedHandler());
            handling.authenticationEntryPoint(new CustomHttp403ForbiddenEntryPoint());
        });

        http.authenticationProvider(swaggerAuthProvider);

字符串
正如你所看到的，我已经为我的整个服务和SwaggerAuthFilter的 Swagger 的目的只SSOAuthFilter。
您还需要一个AuthenticationProvider：

public class SwaggerAuthProvider implements AuthenticationProvider {
        private UserService userService;
    
        @Autowired
        public SwaggerAuthProvider(UserService userService) {
            this.userService = userService;
        }
    
        @Override
        public Authentication authenticate(Authentication authentication) throws AuthenticationException {
            String username = authentication.getName();
            String password = authentication.getCredentials().toString();
            Optional<WhoAmIResponse> whoAmIResponse = userService.authenticate(new LoginRequest(username,password));
    
            if (whoAmIResponse.isEmpty()) {
                log.debug("Authentication failed. Invalid credentials.");
                throw new BadCredentialsException("Authentication failed. Invalid credentials.");
            }
    
            // Create a new authenticated token with the JWT token
            return new JwtAuthenticationToken(
                    whoAmIResponse.get().getToken(),
                    username, password,
                    List.of(
                            new SimpleGrantedAuthority(
                                whoAmIResponse.get().getType().toUpperCase()
                            )
                    )
            );
        }
    
        @Override
        public boolean supports(Class<?> authentication) {
            return authentication.isAssignableFrom(JwtAuthenticationToken.class);
        }
    }

型
这就是我的SwaggerAuthFilter看起来的样子：

public class SwaggerAuthFilter extends OncePerRequestFilter {

    private final MyUserDetailsService userDetailsService;
    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

    @Autowired
    public SwaggerAuthFilter(MyUserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }

    private String checkCookie(Cookie tokenCookie){
        String token = tokenCookie.getValue();
        if(token == null || token.length() < 7){
            log.debug("token problem with length {}", token.length());
        }

        if(token.startsWith("Bearer"))
            return token.substring(7);
        return token;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest req,
                                    HttpServletResponse res,
                                    FilterChain chain) throws IOException, ServletException {
        String url = req.getRequestURI();
        if(
                (!req.getRequestURI().contains("swagger-ui") &&
                !req.getRequestURI().contains("api-docs")) ||
                req.getRequestURI().contains("login")
        ){
            log.debug("request with uri: {} was not associated with swagger filter", url);
            chain.doFilter(req, res);
            return;
        }

        Cookie tokenCookie = WebUtils.getCookie(req, "token");
        if(tokenCookie == null){
            log.debug("token cookie is null, redirecting to login page");
            redirectStrategy.sendRedirect(req, res, "/swagger-ui/login");
            return;
        }
        String token = checkCookie(tokenCookie);

        UsernamePasswordAuthenticationToken authentication;
        try {
            UserDetails userDetails = userDetailsService.loadUserByUsername(token);
            if(userDetails == null){
                log.debug("user retrieved by token in cookie is null, redirecting to login page");
                tokenCookie.setMaxAge(0);
                res.addCookie(tokenCookie);
                redirectStrategy.sendRedirect(req, res, "/swagger-ui/login");
                return;
            }
            authentication =
                    new JwtAuthenticationToken(token,userDetails,
                            null,
                            userDetails.getAuthorities());

            authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(req));

        } catch (AuthException | NullPointerException | IllegalArgumentException e) {
            log.debug("cannot authorize because {}", e.getLocalizedMessage());
            authentication = null;
        }
        SecurityContextHolder.getContext().setAuthentication(authentication); // set the user here
        chain.doFilter(req, res);
    }
}

型
希望这能帮助您解决问题！

这是一个奇怪的例子。在我工作的服务中，我们有一个端点叫做/error。
Spring有一个默认的错误控制器，它也有一个名为/error的端点。
这在以前从来都不是问题，但是很明显，随着spring-security的加入，有些事情发生了变化，这就成了一个问题。
Spring不知道该使用哪个资源来做它想做的事情，所以选择了错误的资源，这导致了奇怪的行为。
有趣的是，没有实际的错误。
在调试日志中，我注意到我们出于某种原因调用了/error（仍然无法弄清楚这一点），并且有一个警告说预期的主体不在请求中，这很奇怪，因为我们没有调用该资源，并且失败的GET请求没有主体。
直到我们打开跟踪日志，我们才看到有两个冲突的/error资源，spring正在挑选资源，而不是它正在寻找的资源。
我们将错误资源重命名为其他内容，所有问题都消失了。
我觉得奇怪的是，当这种情况发生时，spring并没有正确地抱怨。
无论如何，它现在正在工作。