H2 console and Spring Security - permitAll() not working

问题

I'm creating rest api and implemented Spring Security - everything works fine but I want (for now, when I'm still developing) to be able for anyone without authorization to open localhost:8080/console. My code:

@Override
protected void configure(HttpSecurity http) throws Exception {
    // allow everyone to register an account; /console is just for testing
    http.authorizeRequests().antMatchers("/register", "/console").permitAll();

    http.authorizeRequests().anyRequest().fullyAuthenticated();

    // making H2 console working
    http.headers().frameOptions().disable();

    /*
    https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html#when-to-use-csrf-protection
    for non-browser APIs there is no need to use csrf protection
    */
    http.csrf().disable();
}

And what is really strange - localhost:8080/register doesn't need any authentication but /console returns:

{
"timestamp": 1485876313847,
"status": 403,
"error": "Forbidden",
"message": "Access Denied",
"path": "/console"
}

Anyone knows how to fix it?

回答1:

I have a similar configuration like this. Can you try that?

http
    .authorizeRequests()
        .antMatchers("/register").permitAll()
        .and()
    .authorizeRequests()
        .antMatchers("/console/**").permitAll();

回答2:

had same issue, in my case:

csrf().ignoringAntMatchers("/h2-console/**")

final WebSecurityConfigurerAdapter:

http.authorizeRequests().antMatchers("/").permitAll()
            .and()
            .authorizeRequests().antMatchers("/h2-console/**").permitAll()
            .and()
            .headers().frameOptions().disable()
            .and()
            .csrf().ignoringAntMatchers("/h2-console/**")
            .and()
            .cors().disable();

回答3:

I solved my problem by:

http.headers().frameOptions().disable();

来源：https://stackoverflow.com/questions/41961270/h2-console-and-spring-security-permitall-not-working

标签

java

Spring

spring-security