인증없이 Swagger URL에 액세스 할 수 있도록 Spring Security를 ​​설정하는 방법

Question

내 프로젝트에 Spring Security가 있습니다. 주요 문제 : http://localhost:8080/api/v2/api-docs에 swagger URL에 액세스 할 수 없습니다. 누락되었거나 잘못된 승인 헤더가 표시됩니다.

@Configuration 
@EnableSwagger2 
public class SwaggerConfig { 

@Bean 
public Docket api() { 
    return new Docket(DocumentationType.SWAGGER_2).select() 
      .apis(RequestHandlerSelectors.any()) 
      .paths(PathSelectors.any()) 
      .build() 
      .apiInfo(apiInfo()); 
} 

private ApiInfo apiInfo() { 
    ApiInfo apiInfo = new ApiInfo("My REST API", "Some custom description of API.", "API TOS", "Terms of service", "myeaddress@company.com", "License of API", "API license URL"); 
    return apiInfo; 
} 

appconfig가 :

@Configuration 
@EnableWebMvc 
@ComponentScan(basePackages = { "com.musigma.esp2" }) 
@Import(SwaggerConfig.class) 
public class AppConfig extends WebMvcConfigurerAdapter { 

// ========= Overrides =========== 

@Override 
public void addInterceptors(InterceptorRegistry registry) { 
    registry.addInterceptor(new LocaleChangeInterceptor()); 
} 

@Override 
public void addResourceHandlers(ResourceHandlerRegistry registry) { 
    registry.addResourceHandler("swagger-ui.html") 
     .addResourceLocations("classpath:/META-INF/resources/"); 

    registry.addResourceHandler("/webjars/**") 
     .addResourceLocations("classpath:/META-INF/resources/webjars/"); 
} 

web.xml의 항목 :

Screenshot of the browser window 내 pom.xml 파일은 항목

<dependency> 
     <groupId>io.springfox</groupId> 
     <artifactId>springfox-swagger2</artifactId> 
     <version>2.4.0</version> 
    </dependency> 

    <dependency> 
     <groupId>io.springfox</groupId> 
     <artifactId>springfox-swagger-ui</artifactId> 
     <version>2.4.0</version> 
    </dependency> 

SwaggerConfig 다음이

<context-param> 
    <param-name>contextConfigLocation</param-name> 
    <param-value> 
     com.musigma.esp2.configuration.AppConfig 
     com.musigma.esp2.configuration.WebSecurityConfiguration 
     com.musigma.esp2.configuration.PersistenceConfig 
     com.musigma.esp2.configuration.ACLConfig 
     com.musigma.esp2.configuration.SwaggerConfig 
    </param-value> 
</context-param> 

WebSecurityConfig : 트릭을 할해야 당신의 WebSecurityConfiguration 클래스에이 추가

@Configuration 
@EnableWebSecurity 
@EnableGlobalMethodSecurity(prePostEnabled = true) 
@ComponentScan(basePackages = { "com.musigma.esp2.service", "com.musigma.esp2.security" }) 
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { 
@Override 
    protected void configure(HttpSecurity httpSecurity) throws Exception { 
     httpSecurity 
     .csrf() 
      .disable() 
     .exceptionHandling() 
      .authenticationEntryPoint(this.unauthorizedHandler) 
      .and() 
     .sessionManagement() 
      .sessionCreationPolicy(SessionCreationPolicy.STATELESS) 
      .and() 
     .authorizeRequests() 
      .antMatchers("/auth/login", "/auth/logout").permitAll() 
      .antMatchers("/api/**").authenticated() 
      .anyRequest().authenticated(); 

     // custom JSON based authentication by POST of {"username":"<name>","password":"<password>"} which sets the token header upon authentication 
     httpSecurity.addFilterBefore(loginFilter(), UsernamePasswordAuthenticationFilter.class); 

     // custom Token based authentication based on the header previously given to the client 
     httpSecurity.addFilterBefore(new StatelessTokenAuthenticationFilter(tokenAuthenticationService), UsernamePasswordAuthenticationFilter.class); 
    } 
} 

Answer 1

.

@Configuration 
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { 

    @Override 
    public void configure(WebSecurity web) throws Exception { 
     web.ignoring().antMatchers("/v2/api-docs", "/configuration/ui", "/swagger-resources", "/configuration/security", "/swagger-ui.html", "/webjars/**"); 
    } 

} 

Answer 2

/configuration/** 및/swagger-resources/**로 업데이트되었으며 저에게 효과적이었습니다.

@Override 
public void configure(WebSecurity web) throws Exception { 
    web.ignoring().antMatchers("/v2/api-docs", "/configuration/ui", "/swagger-resources/**", "/configuration/**", "/swagger-ui.html", "/webjars/**"); 

} 

Answer 3

스프링 부트 2.0.0.M7 + 스프링 보안 + 스프링스 2.8.0을 사용하여 동일한 문제가 발생했습니다. 그리고 Swagger UI 리소스에 대한 공개 액세스를 허용하는 다음 보안 구성을 사용하여이 문제를 해결했습니다. \t \t \t \t .antMatchers ("/ V2/API-문서", "/ 구성/UI", "/ 자신감-자원"당신은 자신감-UI를 사용하는 경우

@Configuration 
@EnableWebSecurity 
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true) 
public class SecurityConfiguration extends WebSecurityConfigurerAdapter { 

    private static final String[] AUTH_WHITELIST = { 
      // -- swagger ui 
      "/v2/api-docs", 
      "/swagger-resources", 
      "/swagger-resources/**", 
      "/configuration/ui", 
      "/configuration/security", 
      "/swagger-ui.html", 
      "/webjars/**" 
      // other public endpoints of your API may be appended to this array 
    }; 


    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http. 
       // ... here goes your custom security configuration 
       authorizeRequests(). 
       antMatchers(AUTH_WHITELIST).permitAll(). // whitelist Swagger UI resources 
       // ... here goes your custom security configuration 
       antMatchers("/**").authenticated(); // require authentication for any endpoint that's not whitelisted 
    } 

} 

Answer 4

@Override 
    protected void configure(HttpSecurity http) throws Exception { 
    http 
    .csrf().disable() 
    .authorizeRequests() 
     .antMatchers("/api/**").authenticated() 
     .anyRequest().permitAll() 
     .and() 
    .httpBasic().and() 
    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS); 
}