This repository was archived by the owner on May 31, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 4k
This repository was archived by the owner on May 31, 2022. It is now read-only.
requestMatchers() with permitAll is not working #1539
Copy link
Copy link
Open
Description
Hi all,
I am try to given permission for any request. so i have added these code
http.requestMatchers()
.antMatchers("/login", "/oauth/authorize").and().authorizeRequests().anyRequest()
.permitAll().and().formLogin().permitAll()
.and().csrf().disable().httpBasic().disable();
I got filter chain in my console
o.s.s.web.DefaultSecurityFilterChain : Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/css/**'], Ant [pattern='/js/**'], Ant [pattern='/images/**'], Ant [pattern='/webjars/**'], Ant [pattern='/**/favicon.ico'], Ant [pattern='/error']]], []
2018-12-11 14:51:07.748 INFO 4584 --- [ main] o.s.s.web.DefaultSecurityFilterChain : Creating filter chain: org.springframework.boot.actuate.autoconfigure.ManagementWebSecurityAutoConfiguration$LazyEndpointPathRequestMatcher@351a39e7, []
2018-12-11 14:51:08.151 INFO 4584 --- [ main] o.s.s.web.DefaultSecurityFilterChain : Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/oauth/token'], Ant [pattern='/oauth/token_key'], Ant [pattern='/oauth/check_token']]], [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@383ce871, org.springframework.security.web.context.SecurityContextPersistenceFilter@60d33834, org.springframework.security.web.header.HeaderWriterFilter@4c16522b, org.springframework.security.web.authentication.logout.LogoutFilter@57ba286d, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@6ba68981, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@618f0ba, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@3278324f, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@4f0e935d, org.springframework.security.web.session.SessionManagementFilter@655e2908, org.springframework.security.web.access.ExceptionTranslationFilter@2bfd3970, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@53a517e9]
2018-12-11 14:51:08.225 INFO 4584 --- [ main] o.s.s.web.DefaultSecurityFilterChain : Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/login'], Ant [pattern='/oauth/authorize']]], [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@7497c5d9, org.springframework.security.web.context.SecurityContextPersistenceFilter@5bfe65df, org.springframework.security.web.header.HeaderWriterFilter@71fcff54, org.springframework.security.web.authentication.logout.LogoutFilter@64c9a84b, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@595ebb98, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@4c31ec8f, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@3b95678b, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@2d0529f2, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@3cce689c, org.springframework.security.web.session.SessionManagementFilter@1fffd548, org.springframework.security.web.access.ExceptionTranslationFilter@36dada39, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@798cf0a0]
2018-12-11 14:51:08.283 INFO 4584 --- [ main] o.s.s.web.DefaultSecurityFilterChain : Creating filter chain: org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfiguration$NotOAuthRequestMatcher@71e4af7b, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@72a4b564, org.springframework.security.web.context.SecurityContextPersistenceFilter@574c8a2a, org.springframework.security.web.header.HeaderWriterFilter@6fd0b8ab, org.springframework.security.web.authentication.logout.LogoutFilter@4aecb548, org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter@71f164d6, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@4bf30a35, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@218cf600, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@5fde6b8c, org.springframework.security.web.session.SessionManagementFilter@18ae64b5, org.springframework.security.web.access.ExceptionTranslationFilter@722dd1df, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@bc9bd00]
2018-12-11 14:51:08.296 INFO 4584 --- [ main] o.s.s.web.DefaultSecurityFilterChain : Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/**']]], [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@11620d7b, org.springframework.security.web.context.SecurityContextPersistenceFilter@3e010e07, org.springframework.security.web.header.HeaderWriterFilter@653ddea5, org.springframework.security.web.authentication.logout.LogoutFilter@43948dc8, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@7553d28b, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@2f822222, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@24411981, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@4bd4960e, org.springframework.security.web.session.SessionManagementFilter@6ae1ba63, org.springframework.security.web.access.ExceptionTranslationFilter@735c49cc, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@4bcaa38c]
But why i am getting ?
<oauth>
<error_description>
Full authentication is required to access this resource
</error_description>
<error>unauthorized</error>
</oauth>
If i have changed into
http.authorizeRequests().antMatchers("/login","/oauth/authorize").authenticated()
.and()
.authorizeRequests()
.anyRequest().permitAll()
.and()
.formLogin().loginPage("/login").permitAll()
.and()
.csrf().disable();
I got
Response :
Invalid response received.
Thanks in advance.