关于使用 Java Config 的 Spring Security 匿名访问的困惑
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/22385205/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Confusion around Spring Security anonymous access using Java Config
提问by user2145809
I am using the following Java Config with Spring Security:
我在 Spring Security 中使用以下 Java 配置：
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.anyRequest().authenticated()
.and()
.httpBasic();
}
Based on this configuration, all requests are authenticated. When you hit a controller without being authenticated, the AnonymousAuthenticationFilterwill create an Authentication object for you with username=anonymousUser, role=ROLE_ANONYMOUS.
基于此配置，所有请求都经过身份验证。当您在未通过身份验证的情况下点击控制器时，AnonymousAuthenticationFilter将为您创建一个 Authentication 对象username=anonymousUser, role=ROLE_ANONYMOUS。
I am trying to provide anonymous access to a a specific controller method and have tried to use each of the following:
我正在尝试提供对特定控制器方法的匿名访问，并尝试使用以下各项：
@Secured("ROLE_ANONYMOUS")@Secured("IS_AUTHENTICATED_ANONYMOUSLY")
@Secured("ROLE_ANONYMOUS")@Secured("IS_AUTHENTICATED_ANONYMOUSLY")
When the controller methods get invoked, the following response is given: "HTTP Status 401 - Full authentication is required to access this resource"
当控制器方法被调用时，给出以下响应：“HTTP 状态 401 - 访问此资源需要完全身份验证”
Can someone help me understand why we are receiving this message and why ROLE_ANONYMOUS/IS_AUTHENTICATED_ANONYMOUSLYdon't seem to work using this configuration?
有人可以帮助我理解为什么我们会收到此消息以及为什么ROLE_ANONYMOUS/IS_AUTHENTICATED_ANONYMOUSLY似乎无法使用此配置工作吗？
Thanks,
JP
谢谢，
JP
回答by anttix
Your security configuration is blocking all unauthenticated requests. You should allow access to the controller with
您的安全配置阻止了所有未经身份验证的请求。您应该允许访问控制器
.antMatchers("/mycontroller").permitAll()
See also:
也可以看看：
