Spring安全配置不适用于Spring SimpleUrlHandlerMapping

更新：

为什么csrf().disable()有效

CSRF代表跨站点请求伪造

简而言之，它是与请求一起发送以防止攻击的令牌。为了使用Spring Security的CSRF保护，我们首先需要确保我们使用正确的HTTP方法任何修改状态（PATCH，POST，PUT，和DELETE-不是GET）。

使用Spring CookieCsrfTokenRepository进行CSRF保护的工作方式如下：

1. 客户端向服务器（Spring Boot Backend）发出GET请求，例如对主页的请求
2. Spring发送GET请求的响应以及Set-cookie包含安全生成的XSRF令牌的标头
3. 浏览器使用XSRF令牌设置cookie
4. 在发送状态更改请求（例如POST）时，客户端（可能是有角度的）将cookie值复制到HTTP请求标头中
5. 该请求与标头和cookie一起发送（浏览器自动附加cookie）
6. Spring比较标头和cookie值，如果相同，则接受请求，否则，将403返回给客户端

该方法withHttpOnlyFalse允许Angular读取XSRF cookie。确保Angular发出XHR请求并将其withCreddentials标志设置为true。

有关更多详细信息，您可以探索以下内容

• Spring Security CSRF令牌存储库cookie是否会自动处理所有Ajax请求？

• Spring Security的AJAX请求给出403禁止

• 带有Spring Security的基本CSRF攻击模拟和防护

更新方法 configure(HttpSecurity http)

 http
            .csrf()
            .ignoringAntMatchers("endpoint-to-be-ignored-for-csrf")
            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            .and()
            .authorizeRequests()
            .antMatchers("/index").permitAll() 
            .anyRequest().authenticated();

antMatchers中使用allowAll（）指定的端点不需要身份验证，并且antMatchers("/index").permitAll()可以正常工作。

• 确保您的安全配置类使用@EnableWebSecurity和注释@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
• 安全配置类位于包结构中，并由Spring扫描。弹簧成分扫描

您可以在这里找到最小的工作示例

SecurityConfiguration.java

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    // https://stackoverflow.com/a/56389047/10961238 -> WebSecurity vs HttpSecurity

    // Add this method if .antMatchers("/index").permitAll() does not work
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.debug(true);
//        web
//            .ignoring()
//            .antMatchers("/index");
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .authorizeRequests()
            .antMatchers("/index").permitAll() //commenting this line will be results in 403
            .anyRequest().authenticated();
    }

}

SampleController.java

import org.springframework.stereotype.Controller;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.mvc.AbstractController;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@Controller("myController")
public class SampleController extends AbstractController {
    @Override
    protected ModelAndView handleRequestInternal(HttpServletRequest request, HttpServletResponse response) throws Exception {
        System.out.println("::::::::::::::::::::::::::::::::Controller:::::::::::::::::::::::::::::::::");
        response.getWriter().print("Hello world!");
        return null;
    }
}

MainApplication.java

import com.example.mappings.controller.SampleController;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.web.servlet.handler.SimpleUrlHandlerMapping;

import java.util.Properties;

@SpringBootApplication
public class MappingsApplication {

    public static void main(String[] args) {
        SpringApplication.run(MappingsApplication.class, args);
    }

    @Bean
    public SimpleUrlHandlerMapping sampleServletMapping() {
        System.out.println("::::::::::::::::::::::::::::::::SimpleUrlHandlerMapping:::::::::::::::::::::::::::::::::");
        SimpleUrlHandlerMapping mapping = new SimpleUrlHandlerMapping();
        mapping.setOrder(Integer.MAX_VALUE - 2);

        Properties urlProperties = new Properties();
        urlProperties.put("/index", sampleController());
        mapping.setMappings(urlProperties);

        return mapping;
    }

    @Bean
    public SampleController sampleController() {
        System.out.println("::::::::::::::::::::::::::::::::Setting SampleController:::::::::::::::::::::::::::::::::");
        return new SampleController();
    }
}

application.properties

spring.security.user.name = user
spring.security.user.password = user
spring.security.user.roles = ADMIN