在post-request-porter中访问此资源需要完全身份验证

Question

我的邮递员输出：--

{
"timestamp": "2020-10-19T10:34:26.171Z",
"status": 401,
"error": "Unauthorized",
"message": "Full authentication is required to access this resource",
"path": "/website/api/users/login"
}

我的后端服务器：--

2020-10-19 16:04:26.168  WARN 8728 --- [io-8080-exec-14] c.website.website.jwt.JwtRequestFilter   : JWT Token does not contain auth string

代码：

package com.website.website.security;
import com.fasterxml.jackson.databind.ser.std.ToStringSerializer;
import com.website.website.jwt.CustomAuthProvider;
import com.website.website.jwt.JwtRequestFilter;
import com.website.website.jwt.MyAuthenticationEntryPoint;
import org.bson.types.ObjectId;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import java.util.Date;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private MyAuthenticationEntryPoint jwtAuthenticationEntryPoint;
@Autowired
private UserDetailsService jwtUserDetailsService;
@Autowired
private JwtRequestFilter jwtRequestFilter;
@Autowired
private CustomAuthProvider authProvider;
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
// configure AuthenticationManager so that it knows from where to load
// user for matching credentials
// Use BCryptPasswordEncoder
auth.userDetailsService(jwtUserDetailsService).passwordEncoder(passwordEncoder());
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(authProvider);
}

@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
public Jackson2ObjectMapperBuilder objectMapperBuilder() {
Jackson2ObjectMapperBuilder builder = new Jackson2ObjectMapperBuilder();
builder.serializerByType(ObjectId.class, new ToStringSerializer());
builder.serializerByType(Date.class, new JsonDateSerializer());
return builder;
}

@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity.cors();
// We don't need CSRF for this example
httpSecurity.csrf().disable()
.authorizeRequests().antMatchers( "/users/login","/users/addUser","/users/addCustomer", "/"
,"/v2/**","/swagger-ui.html","/webjars/**","/swagger-resources/**").permitAll().
// all other requests need to be authenticated
anyRequest().authenticated().and().
// make sure we use stateless session; session won't be used to
// store user's state.
exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint).and().sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
// Add a filter to validate the tokens with every request
httpSecurity.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
}
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/authenticate");
}
}

Answer 1

在您的邮递员中，路径是"/website/api/users/login"，而它不在授权路径中。"/website/api/users/login"改变"/users/login"

Answer 2

您已经在类文件中使用了WebSecurityConfigurerAdapter注释，并且启动Spring Boot 2.7.0时，WebSecurityCnfigurerAdapter已被弃用。