Spring Security permitAll开放页面权限 解除token验证的问题

使用Spring Security做权限认证，通常有些页面需要开放某些页面不需要权限验证，比喻登录页面，注册页面等，也就是无论你什么权限（包括访客）都能访问到页面，要让某个页面设置所有权限都能访问也很简单

1.Spring Security设置开放某个页面访问权限

@Configuration
public class ResourceServerConfigurer extends ResourceServerConfigurerAdapter {

@Override
public void configure(HttpSecurity http) throws Exception {
    //开放接口
    http.authorizeRequests()
            .antMatchers("/fileCallback").permitAll()
            .anyRequest()
            .authenticated();
}

}

2.已经开放权限的页面token验证问题

按照上面设置了某个页面可以开放访问，但是问题是：如果访问这个页面还是带了token,或者header 中 携带 Authorization Bearer xxxx，就会验证这个token,如果验证失败，不好意思虽然开放了访问权限，但是token验证失败，还是不能访问，所以设置了开放权限相当于没有设置，那么怎么解决？

3.解决方法

其实这也怪不得spring security，你都携带验证信息了，表示你需要框架验证你的权限

那么我们只能去掉这个验证信息

spring-security的认证为一系列过滤器链。我们只需定义一个比OAuth2AuthenticationProcessingFilter更早的过滤器拦截指定请求，去除header中的Authorization Bearer xxxx即可

添加PermitAuthenticationFilter类
添加PermitAuthenticationFilter类拦截指定请求，清空header中的Authorization Bearer xxxx

@Component(“permitAuthenticationFilter”)
@Slf4j
public class PermitAuthenticationFilter extends OncePerRequestFilter {

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {

    log.info("当前访问的地址:{}", request.getRequestURI());
    if ("/permitAll".equals(request.getRequestURI())) {

        request = new HttpServletRequestWrapper(request) {
            private Set<String> headerNameSet;

            @Override
            public Enumeration<String> getHeaderNames() {
                if (headerNameSet == null) {
                    // first time this method is called, cache the wrapped request's header names:
                    headerNameSet = new HashSet<>();
                    Enumeration<String> wrappedHeaderNames = super.getHeaderNames();
                    while (wrappedHeaderNames.hasMoreElements()) {
                        String headerName = wrappedHeaderNames.nextElement();
                        if (!"Authorization".equalsIgnoreCase(headerName)) {
                            headerNameSet.add(headerName);
                        }
                    }
                }
                return Collections.enumeration(headerNameSet);
            }

            @Override
            public Enumeration<String> getHeaders(String name) {
                if ("Authorization".equalsIgnoreCase(name)) {
                    return Collections.<String>emptyEnumeration();
                }
                return super.getHeaders(name);
            }

            @Override
            public String getHeader(String name) {
                if ("Authorization".equalsIgnoreCase(name)) {
                    return null;
                }
                return super.getHeader(name);
            }
        };

    }
    filterChain.doFilter(request, response);

}

}

添加PermitAllSecurityConfig配置
添加PermitAllSecurityConfig配置用于配置PermitAuthenticationFilter

@Component(“permitAllSecurityConfig”)
public class PermitAllSecurityConfig extends SecurityConfigurerAdapter<DefaultSecurityFilterChain,HttpSecurity> {

@Autowired
private Filter permitAuthenticationFilter;

@Override
public void configure(HttpSecurity http) throws Exception {
    http.addFilterBefore(permitAuthenticationFilter, OAuth2AuthenticationProcessingFilter.class);
}

}
复制代码

修改MerryyouResourceServerConfig，增加对制定路径的授权

@Override
public void configure(HttpSecurity http) throws Exception {

    // @formatter:off
    http.formLogin()
            .successHandler(appLoginInSuccessHandler)//登录成功处理器
            .and()
            .apply(permitAllSecurityConfig)
            .and()
            .authorizeRequests()
            .antMatchers("/user").hasRole("USER")
            .antMatchers("/forbidden").hasRole("ADMIN")
            .antMatchers("/permitAll").permitAll()
            .anyRequest().authenticated().and()
            .csrf().disable();

    // @formatter:ON
}