相关疑难解决方法(0)

我们什么时候使用antMatcher()vs antMatchers()？

例如:

http
   .antMatcher("/high_level_url_A/**")
   .authorizeRequests()
      .antMatchers("/high_level_url_A/sub_level_1").hasRole('USER')
      .antMatchers("/high_level_url_A/sub_level_2").hasRole('USER2')
      .somethingElse()
      .anyRequest().authenticated()
      .and()
   .antMatcher("/high_level_url_B/**")
   .authorizeRequests()
      .antMatchers("/high_level_url_B/sub_level_1").permitAll()
      .antMatchers("/high_level_url_B/sub_level_2").hasRole('USER3')
      .somethingElse()
      .anyRequest().authenticated()
      .and()
   ...

我期待的是,

• 任何匹配的请求都/high_level_url_A/**应该经过身份验证+ /high_level_url_A/sub_level_1仅适用于USER且/high_level_url_A/sub_level_2仅适用于USER2
• 任何匹配的请求都/high_level_url_B/**应该被认证+ /high_level_url_B/sub_level_1用于公共访问,并且/high_level_url_A/sub_level_2仅用于USER3.
• 我不关心的任何其他模式 - 但应该公开吗？

我看到最近的例子不包括antMatcher()这些天.这是为什么？是否antMatcher()不再需要？

我已经为我的应用程序设置了 Spring Security Cookie 机制，现在仅用于 API，我需要添加基于 JWT 令牌的身份验证机制。我将 Spring Security 的 MultiHttpSecurityConfiguration 与两个嵌套类一起使用。

会话和 JWT 令牌机制是否应该一起包含在一个应用程序中是一个完全不同的问题，我需要实现两件事。

1. Spring Security 使用 cookie 的基于会话的身份验证将像以前一样工作。
   
2. 需要为 API 添加一个身份验证标头
   

package com.leadwinner.sms.config;

import java.util.Collections;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;

import com.leadwinner.sms.CustomAuthenticationSuccessHandler;
import com.leadwinner.sms.CustomLogoutSuccessHandler;
import com.leadwinner.sms.config.jwt.JwtAuthenticationProvider;
import com.leadwinner.sms.config.jwt.JwtAuthenticationTokenFilter; …