在 Springfox 和 Spring MVC 中配置安全架构和上下文

Question

我有一个简单的REST服务，用Spring MVC实现。我决定用Springfox和Swagger 2.0来描述它们。在我开始添加安全架构和上下文之前，一切似乎都很好。我对某些端点使用 HTTP 基本身份验证，对其他端点使用基于令牌的身份验证。无论我做什么，我都看不到任何设置 HTTP 基本身份验证凭据或在 Swagger UI 中指定令牌的选项。下面是我的配置。为简单起见，我将这两种模式应用于此处的所有终结点。

@Configuration
@EnableSwagger2
public class SwaggerConfig {
    @Bean
    public Docket apiV1() {
      return new Docket(DocumentationType.SWAGGER_2)
        .select()
        .apis(RequestHandlerSelectors.any())
        .paths(PathSelectors.any())
        .build()
      .pathMapping("/api/v1")
      .securitySchemes(newArrayList(new BasicAuth("xBasic"), 
                                    new ApiKey("X-Auth-Token", "xAuthToken", "header")))
      .securityContexts(newArrayList(xBasicSecurityContext(), xAuthTokenSecurityContext()))
    }
    private SecurityContext xBasicSecurityContext() {
      SecurityContext.builder()
        .securityReferences(newArrayList(new SecurityReference("xBasic", 
                                                               new AuthorizationScope[0])))
        .build()
    }
    private SecurityContext xAuthTokenSecurityContext() {
      SecurityContext.builder()
        .securityReferences(newArrayList(new SecurityReference("xAuthToken", 
                                                               new AuthorizationScope[0])))
        .build()
    }

Answer 1

我尝试过这种方法：拆分 Docket 配置。它还迫使我将API分成两组（和包），但最终这是一个很好的架构决定。

@Configuration
@EnableSwagger2
public class SwaggerConfig {
    @Bean
    public Docket authTokenSecuredApi() {
      return new Docket(DocumentationType.SWAGGER_2)
        .groupName("authTokenGroup") // 2 Dockets -> need to differ using groupName
        .select()
        .apis(RequestHandlerSelectors.basePackage("cz.bank.controller.package1"))
        .paths(PathSelectors.any())
        .build()
        .securitySchemes(Collections.singletonList(new ApiKey("X-Auth-Token", 
                                                              "xAuthToken",
                                                              "header")))
        .securityContexts(Collections.singletonList(xAuthTokenSecurityContext()));
    }
    @Bean
    public Docket basicAuthSecuredApi() {
      return new Docket(DocumentationType.SWAGGER_2)
        .groupName("basicAuthGroup") // 2 Dockets -> need to differ using groupName
        .select()
        .apis(RequestHandlerSelectors.basePackage("cz.bank.controller.package2"))
        .paths(PathSelectors.any())
        .build()
        .securitySchemes(Collections.singletonList(new BasicAuth("xBasic")))
        .securityContexts(Collections.singletonList(xBasicSecurityContext()));
    }
    private SecurityContext xBasicSecurityContext() {
      return SecurityContext.builder()
        .securityReferences(Collections.singletonList(
                              new SecurityReference("xBasic", 
                                                    new AuthorizationScope[0])))
        .build();
    }
    private SecurityContext xAuthTokenSecurityContext() {
      return SecurityContext.builder()
        .securityReferences(Collections.singletonList(
                              new SecurityReference("xAuthToken", 
                                                    new AuthorizationScope[0])))
        .build();
    }
}

说实话，我更愿意直接在控制器中配置授权，使用 @ApiOperation authorizations 的属性或@Api Swagger 注释。但是考虑到这个 springfox "功能"，它不适用于@Api注释，这会导致将其复制到导致凌乱讨厌的丑陋罪恶代码的每个@ApiOperation：-）