Spring Security 6: исключение отказа в доступе ⇐ JAVA

[Anonymous]

Ниже представлена ​​моя конфигурация веб-безопасности.

Код: Выделить всё

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(securedEnabled = true, proxyTargetClass = true)
public class WebSecurityConfig implements RequestMatcher
{
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
{
auth.inMemoryAuthentication();
}

@Autowired
private RestApiAuthenticationProvider basicAuthenticationProvider;

@Autowired
private JwtAuthenticationProvider jwtAuthenticationProvider;

@Autowired
public void configure(AuthenticationManagerBuilder auth) throws Exception
{
auth.authenticationProvider(basicAuthenticationProvider).authenticationProvider(jwtAuthenticationProvider);
}

@Bean
@Order(1)
public SecurityFilterChain mainFilterChain(HttpSecurity http) throws Exception {
String apiRegex = "/(" + apiPrefix + "/)?api";
http
.securityMatcher("/api/**", "/" + apiPrefix + "/api/**")
.addFilterBefore(new RequestFilter(), UsernamePasswordAuthenticationFilter.class)
.authorizeHttpRequests((requests) -> requests
.requestMatchers(HttpMethod.GET, apiRegex, apiRegex + "/v\\d+").permitAll()I
.anyRequest().authenticated()
)
.anonymous((anonymous) ->
anonymous
.authorities("ROLE_ANONYMOUS")
)
.sessionManagement((session) -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.httpBasic((httpBasic) -> httpBasic.realmName("Test"))
// Make sure a JSON error response is returned for unauthenticated requests
.exceptionHandling((exceptions) -> exceptions.authenticationEntryPoint(new RestApiAuthenticationEntryPoint()))
.csrf(AbstractHttpConfigurer::disable)
.cors(AbstractHttpConfigurer::disable);

return http.build();
}

@Bean
@Order(2)
public SecurityFilterChain secondFilterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests((requests) -> requests
.requestMatchers(HttpMethod.OPTIONS).denyAll()
.dispatcherTypeMatchers(DispatcherType.ASYNC, DispatcherType.FORWARD, DispatcherType.INCLUDE, DispatcherType.ERROR).permitAll()
.requestMatchers("/", "/" + apiPrefix + "/", "/**/favicon.ico", "/swagger-ui/**",
"/" + apiPrefix + "/swagger-ui/**", "/resources/**", "/" + apiPrefix + "/resources/**",
"/apidocs/**", "/" + apiPrefix + "/apidocs/**").permitAll()
.anyRequest().authenticated());

return http.build();
}

}

Я получаю эту ошибку, когда пытаюсь завить -k -X GET "https://localhost:9883/api"

Код: Выделить всё

o.s.s.w.a.AnonymousAuthenticationFilter  : Set SecurityContextHolder to AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=10.27.123.228, SessionId=null], Granted Authorities=[ROLE_ANONYMOUS]]
2024-10-10 06:52:35.613 TRACE {} 6211 --- [https-jsse-nio2-9443-exec-7] o.s.security.web.FilterChainProxy        : Invoking ExceptionTranslationFilter (14/15)
2024-10-10 06:52:35.613 TRACE {} 6211 --- [https-jsse-nio2-9443-exec-7] o.s.security.web.FilterChainProxy        : Invoking AuthorizationFilter (15/15)
2024-10-10 06:52:35.613 TRACE {} 6211 --- [https-jsse-nio2-9443-exec-7] estMatcherDelegatingAuthorizationManager : Authorizing GET /api
2024-10-10 06:52:35.613 TRACE {} 6211 --- [https-jsse-nio2-9443-exec-7] estMatcherDelegatingAuthorizationManager : Checking authorization on GET /api using org.springframework.security.authorization.AuthenticatedAuthorizationManager@354166ed
2024-10-10 06:52:35.613 TRACE {} 6211 --- [https-jsse-nio2-9443-exec-7] o.s.s.w.a.ExceptionTranslationFilter     : Sending AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=10.27.123.228, SessionId=null], Granted Authorities=[ROLE_ANONYMOUS]] to authentication entry point since access is denied

org.springframework.security.access.AccessDeniedException: Access Denied

Я думал, что проблема может быть в анонимном пользователе. поэтому я добавил анонимный доступ для ROLE_ANONYMOUS, но это не помогло.
Похоже, мой механизм сопоставления запросов не работает для /api или /api/v1 без аутентификации. При предоставлении имени пользователя и пароля все работает нормально.
Итак, как мне настроить его для работы без аутентификации для /api

Подробнее здесь: https://stackoverflow.com/questions/790 ... -exception