如何在Spring Security WebFlux反应式应用中将静态资源请求排除在过滤器之外
如何在Spring Security WebFlux反应式应用中将静态资源请求排除在过滤器之外
提问于 2021-01-23 20:22:14
我对spring安全servlet应用程序的理解如下：
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().mvcMatchers(""/favicon.ico", "/doc.html", "/webjars/**", "/swagger-resources/**", "/**/v2/api-docs"");
}以下请求通过了spring安全反应式应用的过滤：
@Bean
public SecurityWebFilterChain springSecurityFilterChain( ServerHttpSecurity http ) {
final String[] skipSwaggerUrls = new String[] {
"/favicon.ico",
"/doc.html",
"/webjars/**",
"/swagger-resources/**",
"/**/v2/api-docs" };
http.authorizeExchange()
.pathMatchers( skipSwaggerUrls ).permitAll()
.anyExchange().authenticated()
.and().csrf().disable()
.oauth2ResourceServer()
.bearerTokenConverter( new JwtExtractTokenAuthenticationConverter() )
.authenticationEntryPoint( new UserAuthenticationEntryPoint() )
.accessDeniedHandler( new UserAccessDeniedHandler() )
.jwt();
return http.build();
}如何将静态资源请求排除在Spring Security WebFlux Reactive Application的过滤器之外？
谢谢你的帮忙
回答 1
Stack Overflow用户
发布于 2021-01-24 00:00:15
我目前已经解决了这个问题，如下所示
@Bean
public SecurityWebFilterChain springSecurityFilterChain( ServerHttpSecurity http ) {
final String[] skipUrls = new String[] { "/user-account/user/login" };
final String[] skipSwaggerUrls = new String[] {
"/favicon.ico",
"/doc.html",
"/webjars/**",
"/swagger-resources/**",
"/**/v2/api-docs" };
JwtAuthenticationConverter authenticationConverter = new JwtAuthenticationConverter();
authenticationConverter.setJwtGrantedAuthoritiesConverter( new JwtTokenGrantedAuthoritiesConverter() );
ReactiveJwtAuthenticationConverterAdapter jwtAuthenticationConverter = new ReactiveJwtAuthenticationConverterAdapter(
authenticationConverter );
// change
ServerWebExchangeMatcher pathMatchers = ServerWebExchangeMatchers
.pathMatchers( ArrayUtils.addAll( skipUrls, skipSwaggerUrls ) );
http.securityMatcher( new NegatedServerWebExchangeMatcher( pathMatchers ) )
.authorizeExchange()
.pathMatchers( "/**" ).access( new UserAuthorityReactiveAuthorizationManager() )
.anyExchange().authenticated()
.and().csrf().disable()
.addFilterAfter( new AuthWebFilter(), SecurityWebFiltersOrder.AUTHENTICATION )
.oauth2ResourceServer()
.bearerTokenConverter( new JwtExtractTokenAuthenticationConverter() )
.authenticationEntryPoint( new UserAuthenticationEntryPoint() )
.accessDeniedHandler( new UserAccessDeniedHandler() )
.jwt()
.jwtAuthenticationConverter( jwtAuthenticationConverter );
return http.build();
}这是我的issue
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/65859147
复制相关文章
相似问题
腾讯云开发者
