spring security permit无效

Question

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .cors().and()
                .csrf().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                .authorizeRequests()
                    .antMatchers("/home/**")
                    .permitAll()
                    .and()
                .authorizeRequests()
                    .anyRequest()
                    .authenticated()
                    .and()
                .addFilterBefore(new JwtAuthenticationFilter(this.jwtProperties, authenticationManagerBean(), jwtTokenUtil), RequestCacheAwareFilter.class)
                .addFilterBefore(new ExceptionHandlerFilter(), JwtAuthenticationFilter.class)
                .authenticationProvider(jwtAuthenticationProvider())
                .authenticationProvider(loginAuthenticationProvider());
    }

使用了 permitAll 允许路径，但是/home/test请求仍然被拦截了

Answer 1

这个代码是按照循序执行的，你换成这样看看呢

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .cors().and()
        .csrf().disable()
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()

        .authorizeRequests()
        .anyRequest()
        .authenticated()
        .and()
        .authorizeRequests()
        .antMatchers("/home/**")
        .permitAll()
        .and()
        .addFilterBefore(new JwtAuthenticationFilter(this.jwtProperties, authenticationManagerBean(), jwtTokenUtil), RequestCacheAwareFilter.class)
        .addFilterBefore(new ExceptionHandlerFilter(), JwtAuthenticationFilter.class)
        .authenticationProvider(jwtAuthenticationProvider())
        .authenticationProvider(loginAuthenticationProvider());
}

将anyRequest【任何请求】authenticated【通过身份验证】放在前面，将匹配home/**放在后面