Spring SecurityConfig 不起作用

Posted 2023-02-26

技术标签:

【中文标题】Spring SecurityConfig 不起作用【英文标题】：Spring SecurityConfig not working 【发布时间】：2017-04-22 04:35:36 【问题描述】：

我已经玩了一段时间了，但它似乎与我的项目无关。

这是我上次编辑时的文件。我已全部许可，因此我可以测试该文件是否正常工作。当我不包含任何身份验证时，我仍然收到 401 错误。

知道我错过了什么吗？

package org.springframework.security.samples.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;

@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter 

    @Autowired
    @Override
    protected void configure(HttpSecurity http) throws Exception 
        http.authorizeRequests().anyRequest().permitAll();

编辑

这是我启动应用程序时的安全调试日志

2016-12-07 23:24:48.673 DEBUG 15640 --- [           main] eGlobalAuthenticationAutowiredConfigurer : Eagerly initializing org.springframework.boot.autoconfigure.security.SpringBootWebSecurityConfiguration=org.springframework.boot.autoconfigure.security.SpringBootWebSecurityConfiguration$$EnhancerBySpringCGLIB$$60c02dff@68fc9167    
2016-12-07 23:24:48.827 DEBUG 15640 --- [           main] edFilterInvocationSecurityMetadataSource : Adding web access control expression 'hasAnyRole('ROLE_USER')', for org.springframework.security.web.util.matcher.AnyRequestMatcher@1
2016-12-07 23:24:48.834 DEBUG 15640 --- [           main] o.s.s.w.a.i.FilterSecurityInterceptor    : Validated configuration attributes
2016-12-07 23:24:48.835 DEBUG 15640 --- [           main] o.s.s.w.a.i.FilterSecurityInterceptor    : Validated configuration attributes

这是我进行其余调用时的安全调试日志

2016-12-07 23:29:19.114[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Checking match of request : '/users'; against '/css/**'
[2m2016-12-07 23:29:19.114[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Checking match of request : '/users'; against '/js/**'
[2m2016-12-07 23:29:19.114[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Checking match of request : '/users'; against '/images/**'
[2m2016-12-07 23:29:19.114[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Checking match of request : '/users'; against '/webjars/**'
[2m2016-12-07 23:29:19.114[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Checking match of request : '/users'; against '/**/favicon.ico'
[2m2016-12-07 23:29:19.114[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Checking match of request : '/users'; against '/error'
[2m2016-12-07 23:29:19.114[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.web.util.matcher.OrRequestMatcher [0;39m [2m:[0;39m Trying to match using Ant [pattern='/**']
[2m2016-12-07 23:29:19.114[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Request '/users' matched by universal pattern '/**'
[2m2016-12-07 23:29:19.114[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.web.util.matcher.OrRequestMatcher [0;39m [2m:[0;39m matched
[2m2016-12-07 23:29:19.115[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m /users at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
[2m2016-12-07 23:29:19.116[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m /users at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
[2m2016-12-07 23:29:19.118[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m /users at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'
[2m2016-12-07 23:29:19.119[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m /users at position 4 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
[2m2016-12-07 23:29:19.119[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.web.util.matcher.OrRequestMatcher [0;39m [2m:[0;39m Trying to match using Ant [pattern='/logout', GET]
[2m2016-12-07 23:29:19.120[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Request 'POST /users' doesn't match 'GET /logout
[2m2016-12-07 23:29:19.120[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.web.util.matcher.OrRequestMatcher [0;39m [2m:[0;39m Trying to match using Ant [pattern='/logout', POST]
[2m2016-12-07 23:29:19.120[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Checking match of request : '/users'; against '/logout'
[2m2016-12-07 23:29:19.120[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.web.util.matcher.OrRequestMatcher [0;39m [2m:[0;39m Trying to match using Ant [pattern='/logout', PUT]
[2m2016-12-07 23:29:19.120[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Request 'POST /users' doesn't match 'PUT /logout
[2m2016-12-07 23:29:19.120[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.web.util.matcher.OrRequestMatcher [0;39m [2m:[0;39m Trying to match using Ant [pattern='/logout', DELETE]
[2m2016-12-07 23:29:19.120[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Request 'POST /users' doesn't match 'DELETE /logout
[2m2016-12-07 23:29:19.120[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.web.util.matcher.OrRequestMatcher [0;39m [2m:[0;39m No matches found
[2m2016-12-07 23:29:19.120[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m /users at position 5 of 11 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
[2m2016-12-07 23:29:19.120[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m /users at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
[2m2016-12-07 23:29:19.120[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m /users at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
[2m2016-12-07 23:29:19.121[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m /users at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
[2m2016-12-07 23:29:19.123[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.a.AnonymousAuthenticationFilter [0;39m [2m:[0;39m Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9055e4a6: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@957e: RemoteIpAddress: 127.0.0.1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
[2m2016-12-07 23:29:19.123[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m /users at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
[2m2016-12-07 23:29:19.123[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m /users at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
[2m2016-12-07 23:29:19.123[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m /users at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
[2m2016-12-07 23:29:19.124[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.a.i.FilterSecurityInterceptor   [0;39m [2m:[0;39m Secure object: FilterInvocation: URL: /users; Attributes: [hasAnyRole('ROLE_USER')]
[2m2016-12-07 23:29:19.124[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.a.i.FilterSecurityInterceptor   [0;39m [2m:[0;39m Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055e4a6: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@957e: RemoteIpAddress: 127.0.0.1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
[2m2016-12-07 23:29:19.128[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.access.vote.AffirmativeBased      [0;39m [2m:[0;39m Voter: org.springframework.security.web.access.expression.WebExpressionVoter@6175291d, returned: -1
[2m2016-12-07 23:29:19.134[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.a.ExceptionTranslationFilter    [0;39m [2m:[0;39m Access is denied (user is anonymous); redirecting to authentication entry point

org.springframework.security.access.AccessDeniedException: Access is denied
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124) ~[spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) ~[spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:115) ~[spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:169) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:121) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177) [spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:89) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:77) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.4.RELEASE.jar:4.3.4.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:108) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:349) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:784) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:802) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1410) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [na:1.8.0_112]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [na:1.8.0_112]
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.6.jar:8.5.6]
    at java.lang.Thread.run(Unknown Source) [na:1.8.0_112]

[2m2016-12-07 23:29:19.135[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.a.ExceptionTranslationFilter    [0;39m [2m:[0;39m Calling Authentication entry point.
[2m2016-12-07 23:29:19.135[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36mo.s.s.w.header.writers.HstsHeaderWriter [0;39m [2m:[0;39m Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@5e6187fd
[2m2016-12-07 23:29:19.135[0;39m [32mDEBUG[0;39m [35m15640[0;39m [2m---[0;39m [2m[nio-8080-exec-1][0;39m [36ms.s.w.c.SecurityContextPersistenceFilter[0;39m [2m:[0;39m SecurityContextHolder now cleared, as request processing completed

【问题讨论】：

@kuhajeyan 我没有 web.xml，我只有 pom.xml 我正在使用 Spring boot 4 【参考方案1】：

可能我错过了什么。我不知道你为什么在 Spring Boot 中使用 @EnableWebMvcSecurity，它已被弃用，但这不是重点。

如果您使用 Spring Boot 并希望创建一个允许每次调用的安全配置，您可以这样做：

@EnableWebSecurity
@Configuration
class WebSecurityConfig extends WebSecurityConfigurerAdapter 

    @Override
    protected void configure(HttpSecurity http) throws Exception 
        http.authorizeRequests().anyRequest().permitAll();

【讨论】：

【参考方案2】：

你没有禁用默认的安全配置，所以Spring Boot使用的是默认的安全配置，见Spring Boot Reference Guide：

默认安全配置在SecurityAutoConfiguration 和从那里导入的类中实现（SpringBootWebSecurityConfiguration 用于 Web 安全，AuthenticationManagerConfiguration 用于身份验证配置，这也与非 Web 应用程序相关）。要完全关闭默认的 Web 应用程序安全配置，您可以添加一个带有 @EnableWebSecurity 的 bean（这不会禁用身份验证管理器配置或执行器的安全性）。要自定义它，您通常使用WebSecurityConfigurerAdapter 类型的外部属性和bean（例如，添加基于表单的登录）。要关闭身份验证管理器配置，您可以添加 AuthenticationManager 类型的 bean，或者通过将 AuthenticationManagerBuilder 自动装配到您的 @Configuration 类中的一个方法中来配置全局 AuthenticationManager。 Spring Boot 示例中有几个安全应用程序可帮助您开始使用常见用例。

您在 Web 应用程序中开箱即用的基本功能是：
具有内存存储和单个用户的 AuthenticationManager bean（有关用户属性，请参见 SecurityProperties.User）。常见静态资源位置（/css/**、/js/**、/images/**、/webjars/** 和 **/favicon.ico）的忽略（不安全）路径。所有其他端点的 HTTP 基本安全性。发布到 Spring 的 ApplicationEventPublisher 的安全事件（成功和不成功的身份验证和访问被拒绝）。 Spring Security 提供的常见底层特性（HSTS、XSS、CSRF、缓存）默认开启。
以上所有内容都可以使用外部属性 (security.*) 打开和关闭或修改。要覆盖访问规则而不更改任何其他自动配置的功能，请添加 WebSecurityConfigurerAdapter 类型的 @Bean 和 @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)，并对其进行配置以满足您的需求。

另见spring-boot-sample-web-secure：

@Configuration
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter 

    @Override
    protected void configure(HttpSecurity http) throws Exception 
        http.authorizeRequests().anyRequest().fullyAuthenticated().and().formLogin()
                .loginPage("/login").failureUrl("/login?error").permitAll().and()
                .logout().permitAll();
    

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception 
        auth.inMemoryAuthentication().withUser("admin").password("admin")
                .roles("ADMIN", "USER").and().withUser("user").password("user")
                .roles("USER");

【讨论】：

【参考方案3】：

尽量忽略它：

@Override
        public void configure(WebSecurity web) throws Exception 
            web.ignoring().antMatchers("/**");

【讨论】：

以上是关于Spring SecurityConfig 不起作用的主要内容，如果未能解决你的问题，请参考以下文章

尽管有 SecurityConfig，但 Spring Security 会阻止 POST 请求

Spring OAuth2 中的 HMACSHA512 不起作用

UnsatisfiedDependencyException：创建名为“securityConfig”的 bean 时出错

使用dwr后，javaweb设置的session超时失效，web.xml和tomcat设置都不起作

创建名为“securityConfig”的 bean 时出错：注入自动装配的依赖项失败

我的Android进阶之旅------>Android中ListView中嵌套(ListView)控件时item的点击事件不起作的问题解决方法