Spring安全配置错误

Question

我试图为actuator端点启用基本的http身份验证，同时保留api端点的jwt身份验证。为此，我尝试了以下配置：

  @Override
  public void configure(HttpSecurity http) throws Exception {
    http.csrf()
        .disable()
        .anonymous()
        .disable()
        .sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        .and()
        .antMatcher("/service/actuator/**")
        .httpBasic()
        .and()
        .authorizeRequests()
        .antMatchers("/service/api/**")
        .authenticated()
        .anyRequest()
        .authenticated()
        .and()
        .exceptionHandling()
        .authenticationEntryPoint(restAuthenticationEntryPoint);

    http.addFilterBefore(jwtTokenFilter, UsernamePasswordAuthenticationFilter.class);
  }

但是，我似乎也可以对actuator端点使用JWT令牌和基本auth，而对所有api端点也不进行身份验证。我把命令搞砸了吗？有更好的方法吗？

Answer 1

下面这句话对我有用

  @Override
  public void configure(HttpSecurity http) throws Exception {
    http.csrf()
        .disable()
        .anonymous()
        .disable()
        .sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        .and()
        .authorizeRequests()
        .antMatchers("/service/actuator/**")
        .permitAll()
        .and()
        .httpBasic()
        .and()
        .authorizeRequests()
        .antMatchers("/service/api/**")
        .authenticated()
        .anyRequest()
        .authenticated()
        .and()
        .exceptionHandling()
        .authenticationEntryPoint(restAuthenticationEntryPoint);

    http.addFilterBefore(jwtTokenFilter, UsernamePasswordAuthenticationFilter.class);
  }