springboot,springSecurity中POST请求404
SpringSecuritySpringBoot 请求 post 404
2023-09-14 08:57:51 时间
解决方案:
方式一.服务后台配置
1.直接禁用csrf保护。在configure(HttpSecurity http)方法中添加 http.csrf().disable();
2.重写csrf保护策略。
在configure(HttpSecurity http)方法中添加 http.csrf().requireCsrfProtectionMatcher(requestMatcher());
新增处理类
package com.levenx.config.security; import org.springframework.security.web.util.matcher.RequestMatcher; import javax.servlet.http.HttpServletRequest; import java.util.ArrayList; import java.util.List; import java.util.regex.Pattern; /** * Created by 乐闻 on 2018/9/11. */ public class CsrfSecurityRequestMatcher implements RequestMatcher { private Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$"); @Override public boolean matches(HttpServletRequest request) { List<String> unExecludeUrls = new ArrayList<>(); //unExecludeUrls.add("/api/test");//(不允许post请求的url路径)此处根据自己的需求做相应的逻辑处理 if (unExecludeUrls != null && unExecludeUrls.size() > 0) { String servletPath = request.getServletPath(); request.getParameter(""); for (String url : unExecludeUrls) { if (servletPath.contains(url)) { return true; } } } return allowedMethods.matcher(request.getMethod()).matches(); } }
或者允许通过:
RequestMatcher requestMatcher = new CsrfSecurityRequestMatcher(); http.csrf().requireCsrfProtectionMatcher(requestMatcher);
其中CsrfSecurityRequestMatcher自己实现RequestMatcher
public class CsrfSecurityRequestMatcher implements RequestMatcher { private Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$"); @Override public boolean matches(HttpServletRequest request) { List<String> execludeUrls = new ArrayList<>(); execludeUrls.add("sys/getSecCode.do");//允许post请求的url路径,这只是简单测试,具体要怎么设计这个csrf处理,看个人爱好 if (execludeUrls != null && execludeUrls.size() > 0) { String servletPath = request.getServletPath(); request.getParameter(""); for (String url : execludeUrls) { if (servletPath.contains(url)) { return false; } } } return !allowedMethods.matcher(request.getMethod()).matches(); } }
相关文章
- JavaWeb-SpringSecurity使用短信验证码登陆
- JavaWeb-SpringSecurity记住我功能
- JavaWeb-SpringSecurity图片验证ImageCode
- JavaWeb-SpringSecurity自定义登陆配置
- JavaWeb-SpringSecurity实现需求-判断请求是否以html结尾
- JavaWeb-SpringSecurity自定义登陆页面
- JavaWeb-SpringSecurity在数据库中查询登陆用户
- JavaWeb-SpringSecurity初认识
- SpringBoot ( 七 ) :springboot + mybatis 多数据源最简解决方案
- boke练习: springboot整合springSecurity出现的问题,传递csrf
- boke练习: springboot整合springSecurity出现的问题,post,delete,put无法使用
- 【异常】记一次因修复漏洞扫描导致SpringSecurity出现的循环依赖问题
- 【异常】SpringSecurity登录失败:Full authentication is required to access this resource
- SpringBoot 异常回滚 事务的使用___Springboot @Transactional 事务不回滚
- 基于注解SpringAOP,AfterReturning,Before,Around__springboot工程 @Around 简单的使用__SpringBoot:AOP 自定义注解实现日志管理
- SpringBoot升级到2.0后默认时间格式变化_springboot接收date类型参数
- 详解比springSecurity和shiro更简单优雅的轻量级Sa-Token框架,比如登录认证,权限认证,单点登录,OAuth2.0,分布式Session会话,微服务网关鉴权
- SpringSecurity是如何玩弄过滤器链的
- SpringSecurity坑
- SpringBoot实例②springboot+jdbcTemplate小例子实现增删查改
- 【异常】记一次因修复漏洞扫描导致SpringSecurity出现的循环依赖问题
- 【异常】SpringSecurity登录失败:Full authentication is required to access this resource
- 基于SpringCloud+redis+Springsecurity实现的微信小程序外卖系统
- springboot使用jxls导出excel___(万能通用模板)--- SpringBoot导入、导出Excel文件___SpringBoot整合EasyExcel模板导出Excel