Springboot Security hasRole 被忽略

Question

我试图保护我的 Spring Boot 应用程序 (1.21) 的一些 urlpattern 看起来像我的 antMatchers("/report**")。hasRole("REPORT")被忽略。我改变了我的 antMatchers 的顺序，但这没有改变。

例如，如果我浏览到诸如 localhost:9000/report/books 之类的任何内容，我需要登录并且它仅适用于我的用户名密码组合，但我没有将 ROLE REPORT设置为我的用户“user”。所以我希望我不被允许访问报告站点，但会显示该页面。

我必须如何更改只有具有角色报告的用户才能访问该网址？

EDIT1更新源文件

应用程序.java

@SpringBootApplication
@EnableTransactionManagement
public class Application {

    public static void main(String[] args)  {
        @SuppressWarnings("unused")
        ApplicationContext ctx = SpringApplication.run(Application.class, args);
    }
}

配置文件

@Configuration
public class MvcConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/login").setViewName("login");    
    }

    @Bean
    public EmbeddedServletContainerCustomizer containerCustomizer(){
        return new MyCustomizer();
    }

    private static class MyCustomizer implements EmbeddedServletContainerCustomizer {

        @Override
        public void customize(ConfigurableEmbeddedServletContainer factory) {
            factory.addErrorPages(new ErrorPage(HttpStatus.NOT_FOUND, "/error/404"));
            factory.addErrorPages(new ErrorPage(Exception.class, "/error/exception"));
        }

    }

    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {    
      registry.addResourceHandler("/error/**").addResourceLocations("classpath:/static/");
      registry.addResourceHandler("/static/**").addResourceLocations("classpath:/static/");
      registry.addResourceHandler("/css/**").addResourceLocations("classpath:/static/css/");
      registry.addResourceHandler("/images/**").addResourceLocations("classpath:/static/images/");
      registry.addResourceHandler("/js/**").addResourceLocations("classpath:/static/js/");
    }

}

网络安全配置文件

@Configuration
@EnableWebMvcSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {


        http.sessionManagement().enableSessionUrlRewriting(false);

        http
            .formLogin()
                .loginPage("/login")
                .permitAll()
            .and()
                .logout()
                .permitAll()
        .and()
            .authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/report**").hasRole("REPORT")
                .anyRequest().fullyAuthenticated();

    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth
            .inMemoryAuthentication()
            .withUser("user").password("user").roles("USER").and()
            .withUser("admin").password("admin").roles("ADMIN");
    }

}

Answer 1

我需要更改以下内容：

1. 将 /report** 更改为 /report/**
2. 添加 .and().exceptionHandling().accessDeniedPage("/error/403");
3. 也许它可以在没有 @Order 的情况下工作，但我在 Spring Boot 示例中看到了它
4. （/error/403 必须映射到错误页面）

网络安全配置

@Configuration
@EnableWebMvcSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {


        http.sessionManagement().enableSessionUrlRewriting(false);

        http
            .formLogin()
                .loginPage("/login")
                .permitAll()
            .and()
                .logout()
                    .permitAll()
            .and()
                .authorizeRequests()
                    .antMatchers("/").permitAll()
                    .antMatchers("/report/**").hasRole("REPORT")
                    .anyRequest().fullyAuthenticated()
            .and().exceptionHandling().accessDeniedPage("/error/403");

    }

    @Override
    @Order(Ordered.HIGHEST_PRECEDENCE)
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth
            .inMemoryAuthentication()
                .withUser("user").password("user").roles("USER").and()
                .withUser("admin").password("admin").roles("ADMIN","REPORT");
    }

}