java 安全过滤器配置在升级到Sping Boot 3后不工作[重复]

brvekthn  于 5个月前  发布在  Java
关注(0)|答案(1)|浏览(60)

此问题在此处已有答案

Spring security method cannot decide pattern is MVC or not Spring Boot application exception(8个回答)
2天前关闭。
我正在从Sping Boot 2.7.5升级到3.0.11,并且在SecurityFilter配置中有几个变化。我能够将现有的filter class转换为Sping Boot 3.x细节,但是,我在运行应用程序时遇到以下错误:
Error:无法示例化[org. springframework.security.web.SecurityFilterChain]:Factory方法'filterChain'抛出异常,并显示消息:Web安全配置错误:此方法无法决定这些模式是否为Spring MVC模式。如果此端点是Spring MVC端点,请使用requestMatchers(MvcRequestMatcher);否则,请使用requestMatchers(AntPathRequestMatcher)。
这是因为在servlet上下文中有多个可Map的servlet:{org.springframework.web.servlet.DispatcherServlet=[/],org.h2.server.web.JakartaWebServlet=[/h2-console/*]}。
这是我的配置类:

@Configuration
@EnableMethodSecurity(securedEnabled = true, jsr250Enabled = true)
public class WebSecurityConfig {

    private static final String[] AUTH_WHITELIST = {
            // -- Swagger UI v2
            "/v2/api-docs",
            "v2/api-docs",
            "/swagger-resources",
            "swagger-resources",
            "/swagger-resources/**",
            "swagger-resources/**",
            "/configuration/ui",
            "configuration/ui",
            "/configuration/security",
            "configuration/security",
            "/swagger-ui.html",
            "swagger-ui.html",
            "webjars/**",
            // -- Swagger UI v3
            "/api/template/v3/api-docs/**",
            "v3/api-docs/**",
            "/api/template/swagger-ui/**",
            "swagger-ui/**",
            // Actuators
            "/actuator/**",
            "/health/**"
    };

    /**
     * Configures access to application with reduced requirements to security
     * to allow local testing and h2 console.
     *
     * @param http security object
     * @return instance of {@link SecurityFilterChain}
     */
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        try {
            http
                    .csrf(AbstractHttpConfigurer::disable)
                    .authorizeHttpRequests(auth -> auth
                            .requestMatchers(AUTH_WHITELIST).permitAll()
                            .anyRequest().authenticated()
                    )
                    .sessionManagement(session -> session.sessionCreationPolicy(STATELESS))
                    .httpBasic(AbstractHttpConfigurer::disable) // disables pop-up
                    .formLogin(AbstractHttpConfigurer::disable)
                    .headers(httpSecurityHeadersConfigurer -> httpSecurityHeadersConfigurer
                                    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)) // to make accessible h2 console, disables xframe deny warnings
                    .cors(); // uses cors settings - only disabled if WebConfigLocal running
            return http.build();
        } catch (Exception ex) {
            throw new GenericRuntimeException(buildMessage(ERROR_WEB_SECURITY_FILTER.getText(ex.getMessage())), ex);
        }
    }
}

字符串
谁能帮我弄明白哪里出错了吗?我无法从错误中理解任何东西。

fafcakar

fafcakar1#

从Spring Security版本6.x开始,不再能够流畅地要求MvcRequestMatcher。相反,所需的模式被传递给一个通用的#requestMatchers方法,该方法默认使用MvcRequestMatcher在后台进行Map。如果需要,AntPathRequestMatcher现在必须显式地传递给这个#requestMatchers方法。
发现的安全漏洞CVE-2023-34035表明,如果Spring Security保护了多个可Map的servlet,则可能会发生错误配置。因此,从版本6.1.2开始,在两个servlet的情况下,必须显式指定RequestMatcher
例如,H2数据库在其端点的上下文中放置了自己专用的JakartaWebServlet,这迫使我们为Spring的DispatcherServlet处理的所有端点显式指定MvcRequestMatcher
cve-2023-34035-mitigations所述,您可以执行以下操作:
1.提供以下bean

@Bean
public MvcRequestMatcher.Builder mvc(HandlerMappingIntrospector introspector) {
    return new MvcRequestMatcher.Builder(introspector);
}

字符串
1.调整您的过滤器链:

@Bean
public SecurityFilterChain filterChain(MvcRequestMatcher.Builder mvc, HttpSecurity http) throws Exception {
    try {
        http
                .csrf(AbstractHttpConfigurer::disable)
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers(mvc.pattern(AUTH_WHITELIST)).permitAll()
                        .anyRequest().authenticated()
                )
                .sessionManagement(session -> session.sessionCreationPolicy(STATELESS))
                .httpBasic(AbstractHttpConfigurer::disable) // disables pop-up
                .formLogin(AbstractHttpConfigurer::disable)
                .headers(httpSecurityHeadersConfigurer -> httpSecurityHeadersConfigurer
                                .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)) // to make accessible h2 console, disables xframe deny warnings
                .cors(); // uses cors settings - only disabled if WebConfigLocal running
        return http.build();
    } catch (Exception ex) {
        throw new GenericRuntimeException(buildMessage(ERROR_WEB_SECURITY_FILTER.getText(ex.getMessage())), ex);
    }
}


如果这不能解决你的问题,你可能还想为H2数据库设置一个专用的过滤器链,但是我不认为这是必要的。

相关问题