Spring Boot - OAuth2 - 所有請求都被禁止

我有一個Spring啓動應用程序，可以啓用REST和OAuth（應用程序&資源服務器）。Spring Boot - OAuth2 - 所有請求都被禁止

MyApplication.java

@SpringBootApplication 
@EnableResourceServer 
public class MyApplication { 
    public static void main(String[] args) { 
     SpringApplication.run(MyApplication.class, args); 
    } 
}

OAuthConfig.java

@Configuration 
@EnableAuthorizationServer 
public class OAuthConfig extends AuthorizationServerConfigurerAdapter { 
    @Autowired 
    private UserDetailsService userDetailsService; 
    private TokenStore tokenStore = new InMemoryTokenStore(); 
    @Autowired 
    private AuthenticationManager authenticationManager; 

    @Bean 
    public PasswordEncoder passwordEncoder() { 
     return new BCryptPasswordEncoder(); 
    } 

    @Override 
    public void configure(AuthorizationServerEndpointsConfigurer configurer) throws Exception { 
     configurer.authenticationManager(authenticationManager); 
     configurer.userDetailsService(userDetailsService); 
     configurer.tokenStore(tokenStore); 
    } 

    @Override 
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
     clients 
     .inMemory() 
     .withClient("app") 
     .secret("secret") 
     .accessTokenValiditySeconds(120) 
     .refreshTokenValiditySeconds(600) 
     .scopes("read", "write") 
     .authorizedGrantTypes("password", "refresh_token") 
     .resourceIds("resources"); 
    } 
}

SimpleCorsFilter.java

@Component 
@Order(Ordered.HIGHEST_PRECEDENCE) 
public class SimpleCorsFilter implements Filter { 
    public SimpleCorsFilter() { 
    } 

    @Override 
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { 
     HttpServletResponse response = (HttpServletResponse) res; 
     HttpServletRequest request = (HttpServletRequest) req; 
     response.setHeader("Access-Control-Allow-Origin", "*"); 
     response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE"); 
     response.setHeader("Access-Control-Max-Age", "3600"); 
     response.setHeader("Access-Control-Allow-Headers", "x-requested-with, authorization, content-type"); 

     if ("OPTIONS".equalsIgnoreCase(request.getMethod())) { 
      response.setStatus(HttpServletResponse.SC_OK); 
     } else { 
      chain.doFilter(req, res); 
     } 
    } 

    @Override 
    public void init(FilterConfig filterConfig) { 
    } 

    @Override 
    public void destroy() { 
    } 
}

WebSecurityConfig.java

@Configuration 
@EnableWebSecurity 
public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 
    @Override 
    public void configure(WebSecurity web) throws Exception { 
     web 
     .ignoring() 
     .antMatchers("/signup"); 
    } 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http.csrf().disable(); 
    } 
}

TestController.java

@RestController 
public class TestController { 
    @Autowired 
    private PanelService testService; 

    @PostMapping("/test") 
    public Panel getTest() throws Exception { 
     return testService.get(); 
    } 
}

我能夠成功地生成令牌，也可以通過調用使用上述設置的refresh_token得到一個新的令牌。問題是，我的其餘調用也是返回數據，而不管路由令牌是否通過。 /test總是返回有或沒有令牌的數據。

我也試過HTTP安全中的不同選項。即使我使用有效的令牌，下面的一個總是會拋出禁止。

http.csrf().disable(); 
.authorizeRequests() 
.antMatchers("/signup").permitAll() 
.and() 
.authorizeRequests() 
.anyRequest().authenticated() 
.httpBasic();

我在做什麼錯？

來源

2017-10-06 SRCM

我在回答我自己的問題以幫助所有面臨類似問題的人。

坐落在application.properties以下屬性文件

security.oauth2.resource.filter-order=3

另外在WebSecurityConfigurerAdapter添加以下代碼行中配置HttpSecurity（我不知道這段代碼是如何使工作 - 我仍在調查）

@Override 
protected void configure(HttpSecurity http) throws Exception { 
    http 
    .sessionManagement() 
    .sessionCreationPolicy(SessionCreationPolicy.STATELESS) 
    ... 
}

上面的代碼是在下面的兩個例子引用（請參閱GitHub的代碼）

https://medium.com/@nydiarra/secure-a-spring-boot-rest-api-with-json-web-token-reference-to-angular-integration-e57a25806c50

http://www.svlada.com/jwt-token-authentication-with-spring-boot/

來源

2017-10-13 12:48:43 SRCM

只是'security.oauth2.resource.filter階= 3'使它工作。 –

Spring Boot - OAuth2 - 所有請求都被禁止

回答

相關問題