te')); return $arr; } /* 遍历用户所有主题 * @param $uid 用户ID * @param int $page 页数 * @param int $pagesize 每页记录条数 * @param bool $desc 排序方式 TRUE降序 FALSE升序 * @param string $key 返回的数组用那一列的值作为 key * @param array $col 查询哪些列 */ function thread_tid_find_by_uid($uid, $page = 1, $pagesize = 1000, $desc = TRUE, $key = 'tid', $col = array()) { if (empty($uid)) return array(); $orderby = TRUE == $desc ? -1 : 1; $arr = thread_tid__find($cond = array('uid' => $uid), array('tid' => $orderby), $page, $pagesize, $key, $col); return $arr; } // 遍历栏目下tid 支持数组 $fid = array(1,2,3) function thread_tid_find_by_fid($fid, $page = 1, $pagesize = 1000, $desc = TRUE) { if (empty($fid)) return array(); $orderby = TRUE == $desc ? -1 : 1; $arr = thread_tid__find($cond = array('fid' => $fid), array('tid' => $orderby), $page, $pagesize, 'tid', array('tid', 'verify_date')); return $arr; } function thread_tid_delete($tid) { if (empty($tid)) return FALSE; $r = thread_tid__delete(array('tid' => $tid)); return $r; } function thread_tid_count() { $n = thread_tid__count(); return $n; } // 统计用户主题数 大数量下严谨使用非主键统计 function thread_uid_count($uid) { $n = thread_tid__count(array('uid' => $uid)); return $n; } // 统计栏目主题数 大数量下严谨使用非主键统计 function thread_fid_count($fid) { $n = thread_tid__count(array('fid' => $fid)); return $n; } ?>spring security - Configuring SecurityFilterChain for different httpMethods - Stack Overflow

科技改变生活-雨落星辰 - 所有的伟大,都源于一个勇敢的开始

    最新消息：雨落星辰是一个专注网站SEO优化、网站SEO诊断、搜索引擎研究、网络营销推广、网站策划运营及站长类的自媒体原创博客
    你的位置： 首页>programmer>spring security - Configuring SecurityFilterChain for different httpMethods - Stack Overflow

    spring security - Configuring SecurityFilterChain for different httpMethods - Stack Overflow

    programmeradmin3浏览0评论

    I'm trying to get cors running. What I need is:

    Return 401 for all http methods except options when not providing credentials.

    The cors line does absolutely nothing. To my understanding, it should work.

      protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
        .csrf(AbstractHttpConfigurer::disable)
        .cors(Customizer.withDefaults())
        .authorizeHttpRequests(auth -> {
          try {
              auth.requestMatchers("/**").authenticated();
          } catch (final Exception e) {
            LOG.log(Level.SEVERE, "Unable to set up security chain.");
            throw new IllegalStateException(e);
          }
        })
        .httpBasic(withDefaults())
        .build();
  }

    This always returns 401. The httpMethod parameter is ignored

      protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
        .csrf(AbstractHttpConfigurer::disable)
        .cors(Customizer.withDefaults())
        .authorizeHttpRequests(auth -> {
          try {
              auth.requestMatchers("/**", HttpMethod.GET).authenticated();
              auth.requestMatchers("/**", HttpMethod.OPTIONS).permitAll();
          } catch (final Exception e) {
            LOG.log(Level.SEVERE, "Unable to set up security chain.");
            throw new IllegalStateException(e);
          }
        })
        .httpBasic(withDefaults())
        .build();
  }

    This one returns 200 for options and 500 principal not found instead of 401 for get

      protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
        .csrf(AbstractHttpConfigurer::disable)
        .cors(Customizer.withDefaults())
        .authorizeHttpRequests(auth -> {
          try {
            auth.requestMatchers("/**", HttpMethod.OPTIONS).permitAll()
                .requestMatchers("/**", HttpMethod.GET).authenticated();
          } catch (final Exception e) {
            LOG.log(Level.SEVERE, "Unable to set up security chain.");
            throw new IllegalStateException(e);
          }
        })
        .httpBasic(withDefaults())
        .build();
  }

    I'm trying to get cors running. What I need is:

    Return 401 for all http methods except options when not providing credentials.

    The cors line does absolutely nothing. To my understanding, it should work.

      protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
        .csrf(AbstractHttpConfigurer::disable)
        .cors(Customizer.withDefaults())
        .authorizeHttpRequests(auth -> {
          try {
              auth.requestMatchers("/**").authenticated();
          } catch (final Exception e) {
            LOG.log(Level.SEVERE, "Unable to set up security chain.");
            throw new IllegalStateException(e);
          }
        })
        .httpBasic(withDefaults())
        .build();
  }

    This always returns 401. The httpMethod parameter is ignored

      protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
        .csrf(AbstractHttpConfigurer::disable)
        .cors(Customizer.withDefaults())
        .authorizeHttpRequests(auth -> {
          try {
              auth.requestMatchers("/**", HttpMethod.GET).authenticated();
              auth.requestMatchers("/**", HttpMethod.OPTIONS).permitAll();
          } catch (final Exception e) {
            LOG.log(Level.SEVERE, "Unable to set up security chain.");
            throw new IllegalStateException(e);
          }
        })
        .httpBasic(withDefaults())
        .build();
  }

    This one returns 200 for options and 500 principal not found instead of 401 for get

      protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
        .csrf(AbstractHttpConfigurer::disable)
        .cors(Customizer.withDefaults())
        .authorizeHttpRequests(auth -> {
          try {
            auth.requestMatchers("/**", HttpMethod.OPTIONS).permitAll()
                .requestMatchers("/**", HttpMethod.GET).authenticated();
          } catch (final Exception e) {
            LOG.log(Level.SEVERE, "Unable to set up security chain.");
            throw new IllegalStateException(e);
          }
        })
        .httpBasic(withDefaults())
        .build();
  }
    • spring-security
    Share Improve this question asked 2 days ago user29693552user29693552 1 New contributor user29693552 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct. 1
    • CORS and authentication are not related. If you only want to accept OPTIONS that will be in the CORS config and authentication should be handled as you are. – Kieran Foot Commented 2 days ago
    Add a comment  | 

    1 Answer 1

    Reset to default 0

    I finally found the problem. I was using the wrong import. I used

    .springframework.http.HttpMethod.GET

    instead of jakarta.ws.rs.HttpMethod.GET which returned a string that was evaluated as pattern.

    与本文相关的文章

    发布评论

    评论列表(0)

    1. 暂无评论