1

我有这个带有登录端点控制器的 Spring Boot 应用程序。我已经设置了这些网络配置：

    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(securedEnabled = true, jsr250Enabled = true, prePostEnabled = true)
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter {


        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.cors().and().csrf().disable().authorizeRequests()
                    .antMatchers(HttpMethod.POST, PathConstants.USER_AUTH +"/**", PathConstants.HELIOS+"/dashboard/**").permitAll()
                    .antMatchers(HttpMethod.GET, "/"+PathConstants.PROCESS_DEFINITION+"/**").permitAll()
                    .antMatchers(HttpMethod.POST, "/"+PathConstants.PROCESS_DEFINITION+"/**").permitAll()
                    .antMatchers(HttpMethod.GET, "/"+PathConstants.PROCESS_INSTANCE+"/**").permitAll()
                    //.antMatchers(HttpMethod.POST,  PathConstants.LOGIN_ACTION).permitAll()
                    //.anyRequest().authenticated()
                    .anyRequest().permitAll()
                    .and()
                    .exceptionHandling().authenticationEntryPoint(jwtAuthEntryPoint).and()
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
            // custom jwt filter.
            http.addFilterBefore(jwtAuthFilter(), UsernamePasswordAuthenticationFilter.class);
        }

和 web mvc 配置：

    @Configuration
    @EnableWebMvc
    public class WebMvcConfiguration implements WebMvcConfigurer {
    private final long MAX_AGE = 3600;



    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**")
                .allowedOrigins("*")
                .allowedMethods("HEAD", "OPTIONS", "GET", "POST", "PUT", "PATCH", "DELETE")
                .allowedHeaders("Content-Type", "X-Requested-With", "accept", "Origin", "Access-Control-Request-Method",
                        "Access-Control-Request-Headers")
                .exposedHeaders("Access-Control-Allow-Origin", "Access-Control-Allow-Credentials")
                .maxAge(MAX_AGE);
    }

我也尝试添加.allowCredentials(true)，但是当我执行登录操作时，它给了我跨源错误并且我的请求被阻止。
这是我的控制器类：

    @RestController
    @RequestMapping
    @CrossOrigin
    public class AuthenticationControllerImpl implements AuthenticationController {





        @PostMapping(PathConstants.LOGIN_ACTION)
        @Override
        public SysdataUser autenticate(@Valid @RequestBody LoginRequest request) {

            Authentication auth = authManager
                    .authenticate(new UsernamePasswordAuthenticationToken(request.getUsername(), request.getPassword()));
            SecurityContextHolder.getContext().setAuthentication(auth);
            String token = jwtProvider.generateToken(auth);
            SysdataUser user = sysdataUserService.getUserProfile(request.getUsername());
            user.setToken(token);
            return user;
        }

配置中缺少什么？

4

1 回答 1

0

我不知道为什么您的配置不会覆盖默认行为。这就是我所做的，它总是对我有用，将@CrossOrigin你的 AuthenticationControllerImpl 类更改为@CrossOrigin(origins = "*"). 让我知道它是否对您有用。

于 2019-05-24T10:23:07.207 回答