Java Spring Boot登录和角色问题

Question

我正在使用Java Spring Boot编写一个基本的Web应用程序，目前在我的数据库中的用户角色和对应用程序不同部分的访问方面存在问题。用户可以具有角色"ADMIN“或"USER”。这两个角色之间的唯一区别是管理员可以访问"/register“页面，而角色用户中的其他人则不能。我已经在下面发布了我的http configure方法的代码，但我不确定哪里出错了。我希望所有用户都能够访问登录页面，只有管理员才能访问"/register“页面。我遇到的问题是，由于某些原因，到目前为止，我的应用程序的"/home“页面甚至不需要登录就可以看到。使用下面的内容登录时未强制执行。

package bcoreHW.security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.PasswordEncoder;

import bcoreHW.service.UserService;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    UserService userService;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers( // allow users access to any files in js, css, and img directories
                    "/login",
                    "/js/**",
                    "/css/**",
                    "/img/**")
                .permitAll()
                .antMatchers("/register")
                .hasRole("ADMIN")
                .and()
            .formLogin()
                .loginPage("/login")
                .defaultSuccessUrl("/home")
                .permitAll()
                .and()
            .logout()
                .permitAll();
        }

//  @Autowired
//  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
//      auth
//          .inMemoryAuthentication()
//          .withUser("test")
//          .password("hello")
//          .roles("USER");
//      }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder);
    }
}

但是，如果我将configure()方法更改为下面的方法，至少会强制用户登录，并且从那里获得的权限在“单击”的基础上是正确的，但是我仍然能够转到地址栏并在用户角色下搜索"/register“，这就是我尝试实现我发布的第一段代码的原因。这两种方法都还没有奏效，希望能得到一些帮助。

package bcoreHW.security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.PasswordEncoder;

import bcoreHW.service.UserService;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    UserService userService;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //@formatter:off
        http
            .authorizeRequests()
                .antMatchers( // allow users access to any files in js, css, and img directories
                    "/login",
                    "/js/**",
                    "/css/**",
                    "/img/**")
                .permitAll()
            .anyRequest().
                authenticated()
                .and()
            .formLogin()
                .loginPage("/login")
                .defaultSuccessUrl("/home")
                .permitAll()
                .and()
            .logout()
                .permitAll();
        }

//  @Autowired
//  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
//      auth
//          .inMemoryAuthentication()
//          .withUser("test")
//          .password("hello")
//          .roles("USER");
//      }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder);
    }
}

Answer 1

确保将具有角色的用户存储为数据库中的ROLE_ADMIN和ROLE_USER

 @Override
    public void configure(HttpSecurity http) throws Exception {

        http
            .csrf().disable()
            .authorizeRequests()
            .antMatchers( "/login", "/js/**", "/css/**", "/img/**").permitAll() // allow users access to any files in js, css, and img directories
            .antMatchers("/register").hasRole("ADMIN")
            .anyRequest().authenticated()
            .and()
            .formLogin().loginPage("/login")
            .defaultSuccessUrl("/home").permitAll()
            .and()
            .logout().permitAll();
}