直接使用security.basic.path无效|——springboot2.0以上的security的配置

问题

springcloud 版本 为 Finchley.RELEASE
springboot 版本为 2.0.3.RELEASE

如今有需求，/swagger-ui.html 页面须要添加登陆认证，可是原本的接口不须要登陆认证

升级springboot以前的作法是直接在application.yml 文件中添加如下配置：

security: basic: enabled: true # 启用SpringSecurity的安全配置项 path: /swagger-ui.html user: name: aijianzi # 认证用户名 password: course # 认证密码 role: # 受权角色 - USER

升级后这种配置就出错了，连编译都出错，以下图：

 

解决过程

查找源代码，找到以下：
来自：https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-2.0-Migration-Guide

Security
Spring Boot 2 greatly simplifies the default security configuration and makes adding custom security easy. Rather than having several security-related auto-configurations, Spring Boot now has a single behavior that backs off as soon as you add your own WebSecurityConfigurerAdapter.

You are affected if you were using any of the following properties:

security.basic.authorize-mode
security.basic.enabled
security.basic.path
security.basic.realm
security.enable-csrf
security.headers.cache
security.headers.content-security-policy
security.headers.content-security-policy-mode
security.headers.content-type
security.headers.frame
security.headers.hsts
security.headers.xss
security.ignored
security.require-ssl
security.sessions

 　　翻译：Spring Boot 2极大地简化了默认的安全配置，并使添加定制安全性变得更加容易。Spring Boot并无使用几个与安全相关的自动配置，而是在添加本身的WebSecurityConfigurerAdapter时就有了一个单独的行为。若是您使用如下属性，您将受到影响

 

再找到：https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-Security-2.0

Security Auto-configuration
Spring Boot 2.0 does not provide separate auto-configuration for user-defined endpoints and actuator endpoints. When Spring Security is on the classpath, the auto-configuration secures all endpoints by default. It adds the @EnableWebSecurity annotation and relies on Spring Security’s content-negotiation strategy to determine whether to use httpBasic or formLogin. A user with a a default username and generated password is added, which can be used to login.

    翻译：Spring Boot 2.0没有为用户定义的端点和执行器端点提供单独的自动配置。当Spring Security在类路径上时，自动配置默认为全部端点。它添加了@EnableWebSecurity 注释，并依赖于Spring Security的内容协商策略来决定是否使用httpBasic或formLogin。添加了一个默认用户名和生成密码的用户，这能够用来登陆。

 

解决

    对于不一样的URL，安全性是不一样的，关键在于重载WebSecurityConfigurerAdapter 类的configure(HttpSecurity) 方法。具体能够参考以上的两个连接

    个人完整实现以下：

一、pom.xml 中添加依赖：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

 

二、application.yml 文件中配置登陆用户名和密码（若是只到这里，那么全部的请求都会被拦截）

spring: security: user: name: admin password: admin

 

三、添加自定义的配置类，注解@Configuration @EnableWebSecurity

import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; /** * @author jiashubing * @since 2018/7/16 */ @Configuration @EnableWebSecurity public class ActuatorWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() //普通的接口不须要校验
                .antMatchers("/courseApi/**").permitAll() // swagger页面须要添加登陆校验
                .antMatchers("/swagger-ui.html").authenticated() .and() .formLogin(); } }

 

固然也能够配置成须要某个角色的用户才能查看某些URL，百度关键词【SpringSecurity拦截请求】

原创文章，欢迎转载，转载请注明出处！