Yaylı önyükleme ile güvenlik yapılandırması

Question

Spring-Boot için bir Spring Security yapılandırma sınıfı oluşturdum. Giriş sayfamın kaynakları css, js ve ico dosyaları var. Kaynaklar güvenlik nedenleriyle reddediliyor ve her defasında giriş sayfasına yönlendiriliyor. EnableWebMVCSecurity neden Classpath kaynak konumunu eklemez. Kodu ikinci snippet'te olduğu gibi değiştirdikten sonra, Classpath kaynak yeri eklenir. İlk kod snippet'indeki kaynaklar için neyi kaçırdığımı anlamıyorum.

@Configuration 

/* 
* Enable Spring Security’s web security support and provide the Spring MVC integration 
* It also extends WebSecurityConfigurerAdapter and overrides a couple of its methods to set some specifics of the web security configuration. 
*/ 
@EnableWebMvcSecurity 
public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 

/** 
* The configure(HttpSecurity) method defines with URL paths should be 
    * secured and which should not. 
    */ 
    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
     .authorizeRequests() 
      .anyRequest().authenticated(); 

//  There is a custom "/login" page specified by loginPage(), and everyone 
//  is allowed to view it.  
     http 
      .formLogin() 
       .loginPage("/login.html") 
       .permitAll() 
       .and() 
      .logout() 
       .permitAll().logoutSuccessUrl("/login.html"); 
    } 

    @Configuration 
    protected static class AuthenticationConfiguration extends 
      GlobalAuthenticationConfigurerAdapter { 
     @Override 
     public void init(AuthenticationManagerBuilder auth) throws Exception { 
//   As for the configure(AuthenticationManagerBuilder) method, it sets up 
//   an in-memory user store with a single user. That user is given a 
//   username of "user", a password of "password", and a role of "USER". 
      auth 
        .inMemoryAuthentication() 
        .withUser("user@domain.com").password("password").roles("USER"); 
     } 
    } 

ben görmezden yolları filtreye eklenmiştir fark kodunu değiştirdikten sonra

@Configuration 
/* 
* Enable Spring Security’s web security support and provide the Spring MVC integration 
* It also extends WebSecurityConfigurerAdapter and overrides a couple of its methods to set some specifics of the web security configuration. 
*/ 
public class WebSecurityConfig{ 

    @Bean 
    public ApplicationSecurity applicationSecurity() { 
     return new ApplicationSecurity(); 
    } 

    @Bean 
    public AuthenticationSecurity authenticationSecurity() { 
     return new AuthenticationSecurity(); 
    } 

    @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) 
    protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter { 
     @Override 
     protected void configure(HttpSecurity http) throws Exception { 
      http 
      .authorizeRequests() 
       .anyRequest().authenticated(); 
      http 
       .formLogin() 
        .loginPage("/login.html") 
        .permitAll() 
        .and() 
       .logout() 
        .permitAll().logoutSuccessUrl("/login.html"); 

     } 
    } 

    @Order(Ordered.HIGHEST_PRECEDENCE + 10) 
    protected static class AuthenticationSecurity extends 
      GlobalAuthenticationConfigurerAdapter { 
     @Override 
     public void init(AuthenticationManagerBuilder auth) throws Exception { 
      auth 
      .inMemoryAuthentication() 
      .withUser("user@domain.com").password("password").roles("USER"); 

     } 
    } 
} 

kodunu değiştirerek bu çalışma var ve ben günlüklerinde bkz:

 
[ost-startStop-1] o.s.s.web.DefaultSecurityFilterChain  : Creating filter chain: Ant [pattern='/css/**'], [] 
[ost-startStop-1] o.s.s.web.DefaultSecurityFilterChain  : Creating filter chain: Ant [pattern='/js/**'], [] 
[ost-startStop-1] o.s.s.web.DefaultSecurityFilterChain  : Creating filter chain: Ant [pattern='/images/**'], [] 
[ost-startStop-1] o.s.s.web.DefaultSecurityFilterChain  : Creating filter chain: Ant [pattern='/**/favicon.ico'], [] 
[ost-startStop-1] o.s.s.web.DefaultSecurityFilterChain  : Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@4e3e0069, org.springframework.security.web.context.SecurityContextPersistenceFilter@3d2dd0cf, org.springframework.security.web.header.HeaderWriterFilter@33fc3b02, org.springframework.security.web.csrf.CsrfFilter@9b7a3ac, org.springframework.security.web.authentication.logout.LogoutFilter@267237ef, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@129495ef, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@7db0a467, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@764d1dbd, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@25a5268d, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@15c01d0c, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@37818a3b, org.springframework.security.web.session.SessionManagementFilter@3fe57e49, org.springframework.security.web.access.ExceptionTranslationFilter@4278af59, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@424bef91] 

Başına

Answer 1

docs Eğer @EnableWebSecurity kullanarak ilk örnekte yay çizme Otomatik yapılandırma devre dışı, bu yüzden açıkça tüm sta görmezden zorunda kalacak tik kaynakları elle. İkinci örnekte, varsayılan autoconfig'in üstüne ek bir WebSecurityConfigurer sağlamanız yeterlidir.

Answer 2

WebSecurityConfigurerAdapter uzanan bir Yapılandırma dosyası oluşturun ve benzeri temel güvenlik eklemek için @EnableWebSecurity

Sen configure(HttpSecurity http) gibi yöntemler geçersiz kılabilir ile sınıf açıklama için işaretçisi

@Configuration 
@EnableWebSecurity 
public class AppWebSecurityConfigurer extends WebSecurityConfigurerAdapter { 
    @Override 
    protected void configure(HttpSecurity http) throws Exception {  
     http 
      .csrf().disable() 
      .authorizeRequests() 
       .anyRequest().permitAll(); 
     } 
}