Spring OAuth 2:对资源的公共访问

Question

如何在Spring Security OAuth-2 Rest应用程序中的特定URL中允许公共访问。

我有所有的URL开始与/rest/**安全，但想让/rest/about公开，所以我不需要用户进行身份验证来访问它。我尝试使用permitAll()，但它仍然需要请求中的令牌。这是我的HttpSecurity配置：

@Configuration
@EnableResourceServer
protected static class ResourceServerConfiguration extends
        ResourceServerConfigurerAdapter {

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources.resourceId(RESOURCE_ID);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/rest/about").permitAll()
                .antMatchers("/rest/**").authenticated()
                ;
    }
}

对/rest/about的GET请求仍返回401 Unauthorized - "error":"unauthorized","error_description":"Full authentication is required to access this resource"

Answer 1

找到答案了。我只需要添加anonymous()

public void configure(HttpSecurity http) throws Exception {
        http
                .anonymous().and()
                .authorizeRequests()
                .antMatchers("/rest/about").permitAll()
                .antMatchers("/rest/**").authenticated()
                ;
    }

答案来自：https://stackoverflow.com/a/25280897/256245