我对 Spring Security 有疑问。
我正在尝试使用 mysql 数据检查进行身份验证。我正在使用 AngularJs、Spring Boot 和 Spring Security。
我有一个由 $http.post(...) 调用的 webservice rest。当我启动我的应用程序时，如果我使用 chrome 插件“Advanced Rest Client”>“ http://localhost:8080/check-login ”测试我的 web 服务；它有效，我收到代码 200：OK。
但是，如果我想通过 Chrome 使用相同的 URL 访问我的网络服务。带有身份验证功能的窗口。我认为这是 Spring Security 的预认证。但我不知道如何禁用它。
这是一个问题，因为当我想用浏览器访问 Web 服务时，它说：“ http://localhost:8080/check-login 401 unauthaurized”
编辑：这是我的代码：
HTML：
<form role="form" ng-submit="controller.login()">
<div class="form-group">
<label for="username">Username:</label>
<input type="text" class="form-control" id="username" name="username" ng-model="controller.credentials.username"/>
</div>
<div class="form-group">
<label for="password">Password:</label>
<input type="password" class="form-control" id="password" name="password" ng-model="controller.credentials.password"/>
</div>
<button type="submit" class="btn btn-primary">Submit</button>
</form>
JS：
myModule.controller('NavCtrl',function($rootScope, $location, $http){
var self = this
var authenticate = function(credentials, callback) {
var headers = credentials ? {authorization : "Basic " + btoa(credentials.username + ":" + credentials.password)} : {};
$http.get('user', {headers : headers}).then(
function(response) {
if (response.data.name) {
$rootScope.authenticated = true;
} else {
$rootScope.authenticated = false;
}
callback && callback();
},
function() {
$rootScope.authenticated = false;
callback && callback();
}
);
}
authenticate();
self.credentials = {};
self.login = function() {
authenticate(self.credentials, function() {
if ($rootScope.authenticated) {
$location.path("/");
self.error = false;
} else {
$location.path("/login");
self.error = true;
}
});
};
});
我的 Java 休息：
@RestController
public class TestRest {
@RequestMapping("/user")
public Principal user(Principal user){
return user;
}
}
我的 Java Spring Boot 和安全配置：
@SpringBootApplication
public class BusinessBootApplication {
public static void main(String[] args) {
SpringApplication.run(BusinessBootApplication.class, args);
}
@Configuration
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
protected static class SecurityConfiguration extends WebSecurityConfigurerAdapter{
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.httpBasic()
.and()
.authorizeRequests()
.antMatchers("/index.html","/home.html","/login.html","/").permitAll()
.anyRequest()
.authenticated()
.and()
.addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class)
.csrf()
.csrfTokenRepository(csrfTokenRepository());
}
private CsrfTokenRepository csrfTokenRepository() {
HttpSessionCsrfTokenRepository repo = new HttpSessionCsrfTokenRepository();
repo.setHeaderName("X-XSRF-TOKEN");
return repo;
}
}
}
最后，我的关于 UserDetailsService 的 Java
@Service
public class UserDetailsServiceImpl implements UserDetailsService {
public UserDao userDao;
@Autowired
public UserDetailsServiceImpl(UserDao _userDao) {
super();
userDao = _userDao;
}
@Override
public UserDetails loadUserByUsername(String arg0) throws UsernameNotFoundException {
UserDetailsImpl userDetailsImpl = null;
User user = userDao.findByLogin(arg0);
if(user == null){
throw new UsernameNotFoundException("Login not found");
} else{
userDetailsImpl = new UserDetailsImpl(user);
}
return userDetailsImpl;
}
}
public class UserDetailsImpl implements UserDetails {
/** The Constant serialVersionUID. */
private static final long serialVersionUID = 1L;
/** The _username. */
private String username;
/** The _password. */
private String password;
public UserDetailsImpl(User user) {
username = user.getLogin();
password = user.getPwd();
}
/**
* @param password the password to set
*/
public void setPassword(String password) {
this.password = password;
}
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
// TODO Auto-generated method stub
return null;
}
@Override
public String getPassword() {
// TODO Auto-generated method stub
return null;
}
/**
* @param username the username to set
*/
public void setUsername(String username) {
this.username = username;
}
@Override
public String getUsername() {
// TODO Auto-generated method stub
return null;
}
@Override
public boolean isAccountNonExpired() {
// TODO Auto-generated method stub
return false;
}
@Override
public boolean isAccountNonLocked() {
// TODO Auto-generated method stub
return false;
}
@Override
public boolean isCredentialsNonExpired() {
// TODO Auto-generated method stub
return false;
}
@Override
public boolean isEnabled() {
// TODO Auto-generated method stub
return false;
}
}
你有想法吗 ？谢谢