Spring安全與JWT

Question

我正在嘗試與JWT一起開發Spring Security項目。 我想用Spring Security（無JWT令牌）訪問Login api。但是通過下面的配置，每次（對於登錄api），它正在檢查JWT令牌給我403錯誤。

以下是我的WebSecurityConfig。

@Configuration 
@EnableWebSecurity 
public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 

@Autowired 
private JwtAuthFilter jwtAuthFilter; 

@Autowired 
private TokenAuthenticationService jwtAuthenticationProvider; 

@Override 
public void configure(AuthenticationManagerBuilder auth) throws Exception { 
    auth.authenticationProvider(jwtAuthenticationProvider); 
} 



@Override 
protected void configure(HttpSecurity http) throws Exception { 

    http.csrf().ignoringAntMatchers("/api/v1/login"); 
    http.csrf().disable(); 

    http.authorizeRequests() 
      .antMatchers("/api/v1/login") 
      .permitAll() 
      .and() 
      .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class); 
} 

}

在此先感謝

Answer 1

對於登錄路徑配置是這樣的，可以用：

@Override 
protected void configure(HttpSecurity http) throws Exception { 
    http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin() 
      .usernameParameter("username") // default is username 
      .passwordParameter("password") // default is password 
      .loginPage("/authentication/login") // default is /login with an HTTP get 
      .failureUrl("/authentication/login?failed") // default is /login?error 
      .loginProcessingUrl("/authentication/login/process"); // default is /login 
                    // with an HTTP 
                    // post 
} 

如果某些路徑需要被忽略configure(WebSecurity web)可以覆蓋：

@Override 
public void configure(WebSecurity web) throws Exception { 
    web.ignoring().antMatchers("/api/v1/somepath").antMatchers("/static/**"); 
}