package com.example.security;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
* @author Joe
@EnableWebSecurity
public class ExtWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring()
// Spring Security should completely ignore URLs starting with /resources/
.antMatchers("/resources/**");
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/public/**").permitAll()
.antMatchers("/admin/**").hasRole("ADMIN")
.and()
// Possibly more configuration ...
.formLogin() // enable form based log in
// set permitAll for all URLs associated with Form Login
.permitAll();
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
// enable in memory based authentication with a user named "user" and "admin"
auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
.and().withUser("admin").password("password").roles("USER", "ADMIN");
// Possibly more overridden methods ...
添加对应URL的接口
package com.example;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@SpringBootApplication
@RestController
public class UIApplication {
public static void main(String[] args) {
SpringApplication.run(UIApplication.class, args);
@GetMapping("/public/hello")
public ResponseEntity<?> home() {
return ResponseEntity.ok("Hello Every one!");
@GetMapping("/admin/hello")
public ResponseEntity<?> admin() {
return ResponseEntity.ok("Hello Admin!");
/public/hello 可以随意访问，/admin/hello 需要登录用户有admin的role。用user登录会抛出403的错误。
配置中加了.formLogin().permitAll() 未登录用户会直接重定向至OOTB的登录页面。去掉.formLogin().permitAll() 后直接访问/admin/hello会直接抛出403， 而非401 （这点笔者暂时未能理解，未登录应该抛出401 才对，如果系统中加了授权需要区分这两个状态）(什么场景不需要formLogin？用户如何登陆？满足这个场景的web app往往不是单体，可能是某个微服务，提供restful services)。
这里要明白一点：一旦定制，OOTB的行为就会受影响，尽管看似你没有改.
比如：不加.formLogin().permitAll() 就会导致没有登录提示框出现，访问需要授权的服务会直接抛出403
关于如何配置login的page等参考：Java Configuration and Form Login
Spring Boot CORS 解决Trick：
官方示例中只提到了 WebMvcConfigurerAdapter， 然而大部分程序都有WebSecurityConfigurerAdapter 相关的配置
@Configuration
@EnableWebSecurity
public class HrWebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http.cors().and().authorizeRequests().antMatchers("/hr/**").authenticated();
上面代码的：http.cors() 非常重要, 这里java doc拷贝出来
Adds a CorsFilter to be used. If a bean by the name of corsFilter is provided, that CorsFilter is used. Else if corsConfigurationSource is defined, then that CorsConfiguration is used. Otherwise, if Spring MVC is on the classpath a HandlerMappingIntrospector is used.
从注解上可以看出来，我们需要一个corsFilter：
@Bean
public CorsFilter corsFilter() {
final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
final CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true);
config.addAllowedOrigin("*");
config.addAllowedHeader("*");
config.addAllowedMethod("OPTIONS");
config.addAllowedMethod("HEAD");
config.addAllowedMethod("GET");
config.addAllowedMethod("PUT");
config.addAllowedMethod("POST");
config.addAllowedMethod("DELETE");
config.addAllowedMethod("PATCH");
source.registerCorsConfiguration("/**", config);
return new CorsFilter(source);
如果用到了zuul， 上面的配置也不能生效。
stackoverflow 这个issue
(zuul 用在apigateway的时候，其他微服务不需要有CORS)
Ticket on GitHub
