Skip to main content
Tweeted twitter.com/StackOverflowPT/status/1346969846572064771
adicionou 1829 caracteres ao conteúdo
Fonte Link
Dup
  • 164
  • 2
  • 8

Edit02


import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;



@EnableWebSecurity
@EnableAuthorizationServer
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
        return super.authenticationManager();
    }
    
    protected void configure(HttpSecurity http, WebSecurity web) throws Exception {
        protected void configure(HttpSecurity http) throws Exception {

        System.out.println("Chamou HttpSecurity");

          http.csrf().disable()
            .authorizeRequests()
                .antMatchers(HttpMethod.GET, "/usuario/informacoes/**"*")
                .permitAll()
            .anyRequest().authenticated()
            .and().csrf()    .disableauthenticated();
    }
}
    
    @Override
    public void configure(WebSecurity web) throws Exception {
        web
            .ignoring().antMatchers("/favicon.ico");
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}
@RestController
@RequestMapping("/usuario")

@RequestMapping(value = "/informacoes/{id}", method = RequestMethod.GET)
    public ResponseEntity<Object[]> informacoesUsuario(@Valid @PathVariable("id") Long id) throws Exception {
        
        Object[] response = usuarioServices.informacoesUsuario(id);
                
        return ResponseEntity.status(HttpStatus.OK).body(response);
    }

SecurityCORSFilter

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;

import org.springframework.stereotype.Component;

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class SecurityCORSFilter implements Filter {

    public void init(FilterConfig fc) throws ServletException {
    }

    public void doFilter(ServletRequest req, ServletResponse resp,
                         FilterChain chain) throws IOException, ServletException {
      
        System.out.println("Chamou SecurityCORSFilter");
        HttpServletResponse response = (HttpServletResponse) resp;
        HttpServletRequest request = (HttpServletRequest) req;
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Headers", "authorization, Content-Type");
        
        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);
        } else {
            chain.doFilter(req, resp);
        }
    }
}

PorO interessante é que se eu fizer um Request, para qualquer API, o console não esta funcionandoimprimi ? tentei diversas maneiras, todas seguindo documentaçõesChamou HttpSecurity parece que as configurações de WebSecurityConfigurerAdapter não estão sendo aplicadas.

Saída do console, apos um Request: inserir a descrição da imagem aqui


import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;



@EnableWebSecurity
@EnableAuthorizationServer
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
        return super.authenticationManager();
    }
    
    protected void configure(HttpSecurity http, WebSecurity web) throws Exception {
        http
            .authorizeRequests()
            .antMatchers(HttpMethod.GET, "/usuario/informacoes/**")
            .permitAll()
            .anyRequest().authenticated()
            .and().csrf().disable();
    }
    
    @Override
    public void configure(WebSecurity web) throws Exception {
        web
            .ignoring().antMatchers("/favicon.ico");
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}
@RestController
@RequestMapping("/usuario")

@RequestMapping(value = "/informacoes/{id}", method = RequestMethod.GET)
    public ResponseEntity<Object[]> informacoesUsuario(@Valid @PathVariable("id") Long id) throws Exception {
        
        Object[] response = usuarioServices.informacoesUsuario(id);
                
        return ResponseEntity.status(HttpStatus.OK).body(response);
    }

Por que não esta funcionando ? tentei diversas maneiras, todas seguindo documentações.

Edit02


import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;



@EnableWebSecurity
@EnableAuthorizationServer
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
        return super.authenticationManager();
    }
    
    protected void configure(HttpSecurity http, WebSecurity web) throws Exception {
        protected void configure(HttpSecurity http) throws Exception {

        System.out.println("Chamou HttpSecurity");

          http.csrf().disable()
            .authorizeRequests()
                .antMatchers(HttpMethod.GET, "/usuario/informacoes/*")
                .permitAll()
            .anyRequest()
                .authenticated();
    }
}
    
    @Override
    public void configure(WebSecurity web) throws Exception {
        web
            .ignoring().antMatchers("/favicon.ico");
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}
@RestController
@RequestMapping("/usuario")

@RequestMapping(value = "/informacoes/{id}", method = RequestMethod.GET)
    public ResponseEntity<Object[]> informacoesUsuario(@Valid @PathVariable("id") Long id) throws Exception {
        
        Object[] response = usuarioServices.informacoesUsuario(id);
                
        return ResponseEntity.status(HttpStatus.OK).body(response);
    }

SecurityCORSFilter

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;

import org.springframework.stereotype.Component;

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class SecurityCORSFilter implements Filter {

    public void init(FilterConfig fc) throws ServletException {
    }

    public void doFilter(ServletRequest req, ServletResponse resp,
                         FilterChain chain) throws IOException, ServletException {
      
        System.out.println("Chamou SecurityCORSFilter");
        HttpServletResponse response = (HttpServletResponse) resp;
        HttpServletRequest request = (HttpServletRequest) req;
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Headers", "authorization, Content-Type");
        
        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);
        } else {
            chain.doFilter(req, resp);
        }
    }
}

O interessante é que se eu fizer um Request, para qualquer API, o console não imprimi Chamou HttpSecurity parece que as configurações de WebSecurityConfigurerAdapter não estão sendo aplicadas.

Saída do console, apos um Request: inserir a descrição da imagem aqui

adicionou 378 caracteres ao conteúdo
Fonte Link
Dup
  • 164
  • 2
  • 8

Pesquisando achei muitos artigos, e a grande maioria sugerem desta forma:

https://www.baeldung.com/spring-security-expressions

https://www.baeldung.com/security-none-filters-none-access-permitAll

https://docs.spring.io/spring-security/site/docs/current/reference/html/jc.html

Por que não esta funcionando ? tentei diversas maneiras, todas seguindo documentações.

Pesquisando achei muitos artigos, e a grande maioria sugerem desta forma:

https://www.baeldung.com/spring-security-expressions

https://www.baeldung.com/security-none-filters-none-access-permitAll

https://docs.spring.io/spring-security/site/docs/current/reference/html/jc.html

Por que não esta funcionando ? tentei diversas maneiras, todas seguindo documentações.

Fonte Link
Dup
  • 164
  • 2
  • 8

.antMatchers().permitAll() parece não funcionar

Habilitei spring-security em meu projeto, e agora todas as API precisa de autenticação, perfeito era isso que eu precisava.

Porem quero que apenas uma API não precise de autenticação. Tentei utilizar .authorizeRequests() .antMatchers(HttpMethod.GET, "/usuario/informacoes/**") .permitAll()

mas isso não funciona e continuo recebendo:

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<oauth>
<error_description>
Full authentication is required to access this resource
</error_description>
<error>unauthorized</error>
</oauth>

Estou com o seguinte codigo:

WebSecurityConfigurerAdapter


import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;



@EnableWebSecurity
@EnableAuthorizationServer
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
        return super.authenticationManager();
    }
    
    protected void configure(HttpSecurity http, WebSecurity web) throws Exception {
        http
            .authorizeRequests()
            .antMatchers(HttpMethod.GET, "/usuario/informacoes/**")
            .permitAll()
            .anyRequest().authenticated()
            .and().csrf().disable();
    }
    
    @Override
    public void configure(WebSecurity web) throws Exception {
        web
            .ignoring().antMatchers("/favicon.ico");
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}

API

@RestController
@RequestMapping("/usuario")

@RequestMapping(value = "/informacoes/{id}", method = RequestMethod.GET)
    public ResponseEntity<Object[]> informacoesUsuario(@Valid @PathVariable("id") Long id) throws Exception {
        
        Object[] response = usuarioServices.informacoesUsuario(id);
                
        return ResponseEntity.status(HttpStatus.OK).body(response);
    }

pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.1.5.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.mfac</groupId>
    <artifactId>mfac</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>mfac</name>
    <description>mfac - rest</description>

    <properties>
        <java.version>12</java.version>
    </properties>

    <dependencies>

        <!-- Segurança | Início -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-oauth2-client</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        
        <dependency>
            <groupId>org.springframework.security.oauth.boot</groupId>
            <artifactId>spring-security-oauth2-autoconfigure</artifactId>
            <version>2.1.4.RELEASE</version>
        </dependency>       

        <!-- Segurança | Fim -->




        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>
        
        
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-devtools</artifactId>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>