从 WebSecurityConfigurerAdapter 迁移到 SecurityFilterChain

Question

这是迁移前我的工作安全配置：

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring()
                .antMatchers("/auth/**")
                .antMatchers("/swagger-ui/**")
                .antMatchers("/swagger-ui.html")
                .antMatchers("/swagger-resources/**")
                .antMatchers("/v2/api-docs/**")
                .antMatchers("/v3/api-docs/**");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(grantedPortalRoleConverter);

        http
                .csrf().disable()
                .cors()
                .and()
                .exceptionHandling()
                .authenticationEntryPoint(new AuthenticationFallbackEntryPoint())
                .and()
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .authorizeRequests(authorize -> authorize.anyRequest().authenticated())
                .oauth2ResourceServer()
                .jwt().jwtAuthenticationConverter(jwtAuthenticationConverter);
    }

这是迁移后我的安全链配置：

    @Bean
    @Order(1)
    public SecurityFilterChain ignorePathsSecurityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(authorize -> authorize
                        .antMatchers(
                                "/auth/**",
                                "/swagger-ui/**",
                                "/swagger-ui.html",
                                "/swagger-resources/**",
                                "/v3/api-docs/**")
                            .permitAll());

        return http.build();
    }

    @Bean
    @Order(2)   
    public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http, GrantedPortalRoleConverter grantedPortalRoleConverter) throws Exception {
        JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(grantedPortalRoleConverter);

        http
                .csrf().disable()
                .cors(Customizer.withDefaults())
                .exceptionHandling(configurer -> configurer.authenticationEntryPoint(new AuthenticationFallbackEntryPoint()))
                .sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated())
                .oauth2ResourceServer(configurer -> configurer.jwt().jwtAuthenticationConverter(jwtAuthenticationConverter));

        return http.build();
    }

使用原始conf，当我调用随机的不存在路径时：

    @Test
    void should_not_authenticate_or_return_not_found() throws Exception {
        logger.info("should_not_authenticate_or_return_not_found");
        
        mvc.perform(get("/toto/tata"))
                .andExpect(status().isUnauthorized());      
    }

我得到：

15:44:00.230 [main] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor - Failed to authorize filter invocation [GET /toto/tata] with attributes [authenticated]

使用新的conf，我刚刚收到HTTP 404，请问我在这里缺少什么？我看不出任何差异，调试日志也没有显示太多。

这是使用非工作conf丢失的第一行日志：

16:24:58.651 [main] DEBUG o.s.s.w.a.e.ExpressionBasedFilterInvocationSecurityMetadataSource - Adding web access control expression [authenticated] for any request

但在两个日志中，我都可以看到（新conf中有两行，因为有两个安全链）：

o.s.s.web.DefaultSecurityFilterChain - Will secure any request with (...)

Answer 1

解释

当你有多个SecurityFilterChain时，你必须指定一个请求匹配器，否则所有请求都将由第一个（SecurityFilterChain用 注释）处理@Order(1)，而永远不会到达第二个SecurityFilterChain（用 注释）@Order(2)。

在您上面共享的代码中，这意味着.requestMatchers()在以下位置进行配置ignorePathsSecurityFilterChain：

@Bean
@Order(1)
public SecurityFilterChain ignorePathsSecurityFilterChain(HttpSecurity http) throws Exception {
    http
        .requestMatchers(requests -> requests // add this block
            .antMatchers(
                "/auth/**",
                "/swagger-ui/**",
                "/swagger-ui.html",
                "/swagger-resources/**",
                "/v3/api-docs/**")
        )
        .authorizeHttpRequests(authorize -> authorize
            .antMatchers(
                "/auth/**",
                "/swagger-ui/**",
                "/swagger-ui.html",
                "/swagger-resources/**",
                "/v3/api-docs/**")
            .permitAll());

    return http.build();
}

这意味着只有匹配的请求/auth/**等/swagger-ui/**将由 处理ignorePathsSecurityFilterChain，而其余请求将移至defaultSecurityFilterChain。

requestMatchers要了解和之间的区别，authorizeHttpRequests您可以查看这个 StackOverflow 问题。

解决方案

更好的选择是将SecurityFilterChains 合并为一个。在这种情况下，我看不出您有任何理由将它们分开。

最终的配置将是：

@Bean
public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http, GrantedPortalRoleConverter grantedPortalRoleConverter) throws Exception {
    JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
    jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(grantedPortalRoleConverter);

    http
            .authorizeHttpRequests(authorize -> authorize
                    .antMatchers(
                            "/auth/**",
                            "/swagger-ui/**",
                            "/swagger-ui.html",
                            "/swagger-resources/**",
                            "/v3/api-docs/**")
                    .permitAll()
                    .anyRequest().authenticated()
            )
            .csrf().disable()
            .cors(Customizer.withDefaults())
            .exceptionHandling(configurer -> configurer.authenticationEntryPoint(new AuthenticationFallbackEntryPoint()))
            .sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .oauth2ResourceServer(configurer -> configurer.jwt().jwtAuthenticationConverter(jwtAuthenticationConverter));

    return http.build();
}

选择

或者，您可以使用 aWebSecurityCustomizer来忽略某些端点：

@Bean
public WebSecurityCustomizer webSecurityCustomizer() {
    return (web) -> web.ignoring().antMatchers(
                "/auth/**",
                "/swagger-ui/**",
                "/swagger-ui.html",
                "/swagger-resources/**",
                "/v3/api-docs/**");
}

然后你将使用defaultSecurityFilterChain作为你唯一的SecurityFilterChain.