问题
We recently upgraded from Spring Boot 1.4.1 to 1.5.2. One of the features of 1.5.2 is that if Spring Security is part of the package then it is protected by basic auth. I am unable to access the /h2-console even after basic auth. It throws 403 forbidden.
application.yml:
spring:
datasource:
driver-class-name: org.h2.Driver
url: jdbc:h2:file:../app-db/app_db;AUTO_SERVER=TRUE
username: sa
password: sa
initialize: false
jpa:
hibernate:
ddl-auto: validate
show-sql: true
database-platform: org.hibernate.dialect.H2Dialect
h2:
console:
enabled: true
settings:
web-allow-others: true
allowed:
resources: /h2-console/**
I have even explicitly allowed /h2-console/**
httpSecurity.authorizeRequests()
.antMatchers(allowedResources)
.permitAll()
I keep getting 403 when trying to access localhost:8080/h2-console.
I tried many settings as well as putting:
management.security.enabled=true
security.basic.enabled=true
But I am unable to access the h2-console.
回答1:
Spring security blocks /h2-console (or the path you configured in your application.yaml) path for H2 database.
To access the H2 console just add the below code to your WebSecurityConfigurerAdapter.
@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/").permitAll()
.antMatchers("/h2-console/**").permitAll();
http.csrf().disable();
http.headers().frameOptions().disable();
}
}
Don't use this configuration in a production environment. =)
回答2:
Since H2 has it's own authentication provider, you can skip the Spring Security for the path of h2 console entirely in the same way that you do for your static content.
In order to do that, in your Spring security config, you have to override the configuration method which takes an instance of org.springframework.security.config.annotation.web.builders.WebSecurity as a parameter instead of the one which takes an instance of org.springframework.security.config.annotation.web.builders.HttpSecurity
@Override
public void configure(WebSecurity web) throws Exception {
web
.ignoring()
.antMatchers("/h2-console/**");
}
If you're using h2 in a production environment, make sure you set up the proper security measures (things like, setting a non-obvious path, good password, ip white list) for your h2 console.
回答3:
@Configuration
@ConditionalOnClass(WebSecurityConfigurerAdapter.class)
@ConditionalOnBean(ObjectPostProcessor.class)
@ConditionalOnProperty(prefix = "security.basic", name = "enabled", matchIfMissing = true)
static class H2ConsoleSecurityConfiguration
As you can see the source code in spring boot, if you enable the basic, the spring boot will load spring security configuration H2ConsoleSecurityConfigurer with order SecurityProperties.BASIC_AUTH_ORDER - 10, and the authentication is base on your configuration in security. This is the default security configuration:
public void configure(HttpSecurity http) throws Exception {
String path = this.console.getPath();
String antPattern = path.endsWith("/")?path + "**":path + "/**";
HttpSecurity h2Console = http.antMatcher(antPattern);
h2Console.csrf().disable();
h2Console.httpBasic();
h2Console.headers().frameOptions().sameOrigin();
// the default role is `USER` and `management.security.roles`
String[] roles = (String[])this.security.getUser().getRole().toArray(new String[0]);
// this value is base `security.basic.authorize-mode`, `role`, 'authenticated' and `none`
SecurityAuthorizeMode mode = this.security.getBasic().getAuthorizeMode();
if(mode != null && mode != SecurityAuthorizeMode.ROLE) {
if(mode == SecurityAuthorizeMode.AUTHENTICATED) {
((AuthorizedUrl)http.authorizeRequests().anyRequest()).authenticated();
}
} else {
((AuthorizedUrl)http.authorizeRequests().anyRequest()).hasAnyRole(roles);
}
}
and you can also create a new configuration to override the default one.
@Configuration
// before the default configuration
@Order(SecurityProperties.BASIC_AUTH_ORDER - 11)
class CustomH2ConsoleSecurityConfigurer extends WebSecurityConfigurerAdapter {
@Autowired
private H2ConsoleProperties console;
@Override
public void configure(HttpSecurity http) throws Exception {
String path = this.console.getPath();
String antPattern = (path.endsWith("/") ? path + "**" : path + "/**");
HttpSecurity h2Console = http.antMatcher(antPattern);
h2Console.csrf().disable();
h2Console.httpBasic();
h2Console.headers().frameOptions().sameOrigin();
// config as you like
http.authorizeRequests().anyRequest().permitAll();
}
}
回答4:
I enabled debug logging and saw this:
o.s.s.w.a.i.FilterSecurityInterceptor : Secure object: FilterInvocation: URL: /h2-console/; Attributes: [hasAnyRole('ROLE_USER','ROLE_ACTUATOR')]
2017-05-05 13:16:09.304 DEBUG 90365 --- [nio-8080-exec-2] o.s.s.w.a.i.FilterSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@33d2af72: Principal: org.springframework.security.ldap.userdetails.LdapUserDetailsImpl@7371d5f4: Dn: cn=XYZ,ou=XYZ,ou=Active,ou=ABC_USERS,dc=internal,dc=organization,dc=com; Username: uname; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; CredentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 86EF50EF548ED4DBCE4D661AEC93F88C; Granted Authorities: ROLE_ADMIN
2017-05-05 13:16:09.305 DEBUG 90365 --- [nio-8080-exec-2] o.s.s.access.vote.AffirmativeBased : Voter: org.springframework.security.web.access.expression.WebExpressionVoter@51d3d69, returned: -1
2017-05-05 13:16:09.305 DEBUG 90365 --- [nio-8080-exec-2] o.s.s.w.a.ExceptionTranslationFilter : Access is denied (user is not anonymous); delegating to AccessDeniedHandler
I realize that my user does not have the ROLE_USER. I was assuming ROLE_ADMIN > ROLE_USER but I still need to understand this a little better.
I updated my settings to:
security:
basic:
enabled: true
authorize-mode: NONE
I am able to access the /h2-console/** now.
回答5:
I want to provide configuration similar to what is proposed by @argoth, but a bit more production ready :)
@Profile("h2") // to make sure it is active only if h2 profile is active
@Configuration
@ConditionalOnProperty( //to make sure it is active if console is enabled
value="spring.h2.console.enabled",
havingValue = "true",
matchIfMissing = false)
public class H2SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
// this may not be required, depends on your app configuration
http.authorizeRequests()
// we need config just for console, nothing else
.antMatchers("/h2_console/**").permitAll();
// this will ignore only h2-console csrf, spring security 4+
http.csrf().ignoringAntMatchers("/h2-console/**");
//this will allow frames with same origin which is much more safe
http.headers().frameOptions().sameOrigin();
}
}
In fact there was similar configuration done in boot 1.3 which was called H2ConsoleSecurityConfiguration, but now it's gone: Old class
github discussion
Upd. very important note here! When you have multiple WebSecurityConfigurerAdapter they may conflict with each other, so if you have another WebSecurityConfigurerAdapter in your code, you will need to somehow merge them. To give you more details on why there will be a conflict, it will happen due to each adapter setting up it's own filter chain, and every request will have to pass both filter chains. If one of the chains forbids frameOptions and other doesn't the request won't pass the first chain.. That said, please, be careful with multiple configurers..
回答6:
I also encountered the same problem when I'm using spring security. Please note the below configuration in the application.properties
spring.h2.console.enabled=true
spring.h2.console.path=/h2
spring.datasource.url=jdbc:h2:file:~/test
spring.datasource.username=sa
spring.datasource.password=
spring.datasource.driver-class-name=org.h2.Driver
In the security configuration under the configure method I've included the following and I'm able to access the h2 console.
.antMatchers( "/h2/**").permitAll()
回答7:
This also helps for me
#H2 database
datasource:
url: jdbc:h2:mem:mytestdb;INIT=RUNSCRIPT FROM 'classpath:/data.sql'
driverClassName: org.h2.Driver
username: sa
password: sa
main:
allow-bean-definition-overriding: true
h2:
console:
enabled: true
path: /h2-console
settings:
web-allow-others: true
allowed:
resources: /h2-console/**
security:
basic:
enabled: true
authorize-mode: NONE
来源：https://stackoverflow.com/questions/43794721/spring-boot-h2-console-throws-403-with-spring-security-1-5-2