Spring Boot控制器单个接口返回401 Unauthorized问题求助

你的getDoctorBySpecality接口返回401 Unauthorized的核心原因是Spring Security路径匹配规则不匹配实际请求路径，同时控制器中存在PathVariable参数名不匹配的小问题（虽不直接导致401，但会引发后续错误），具体修复步骤如下：

1. 修复Security配置的路径匹配规则 #

在你的Security配置中，/api/doctors/get-specialty/是精确匹配结尾带斜杠的空路径，无法匹配带参数的请求（比如/api/doctors/get-specialty/cardiology）。虽然/api/doctors/**理论上覆盖所有医生接口，但路径匹配的优先级和斜杠处理逻辑可能导致该请求未被正确授权。

方案一：修改单独的路径规则为通配符形式 #

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http.csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll()
                .requestMatchers("/api/patients/get/**").hasAnyRole("DOCTOR","PATIENT","ADMIN")
                .requestMatchers("/api/patients/**").hasAnyRole("PATIENT","DOCTOR","ADMIN") 
                // 修改为带通配符的路径，匹配所有该路径下的请求
                .requestMatchers("/api/doctors/get-specialty/**").hasAnyRole("DOCTOR","PATIENT","ADMIN")
                .requestMatchers("/api/doctors/**").hasAnyRole("DOCTOR","PATIENT","ADMIN")
                .anyRequest().authenticated()
            )
            .cors(Customizer.withDefaults())
            .httpBasic(Customizer.withDefaults())
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)
            .build();
}

方案二：删除单独的路径规则（更简洁） #

由于/api/doctors/**已经覆盖所有医生相关接口，包括get-specialty，可以直接删除这条单独的规则：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http.csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll()
                .requestMatchers("/api/patients/get/**").hasAnyRole("DOCTOR","PATIENT","ADMIN")
                .requestMatchers("/api/patients/**").hasAnyRole("PATIENT","DOCTOR","ADMIN") 
                // 直接通过/api/doctors/**统一处理所有医生接口授权
                .requestMatchers("/api/doctors/**").hasAnyRole("DOCTOR","PATIENT","ADMIN")
                .anyRequest().authenticated()
            )
            .cors(Customizer.withDefaults())
            .httpBasic(Customizer.withDefaults())
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)
            .build();
}

2. 修复控制器中PathVariable参数名不匹配问题 #

你的控制器路径变量是{speciality}，但方法参数是String specialty，名称不一致会导致Spring无法正确绑定参数，后续会返回400错误，需要修正：

方案一：统一路径变量和参数名 #

//get doctors by Specialty
@GetMapping("/get-specialty/{specialty}") // 路径变量名改为specialty，与参数名一致
public ResponseEntity<List<DoctorDTO>> getDoctorBySpecality(@PathVariable String specialty) {
    List<DoctorDTO> doctors = doctorService.getDoctorBySpecality(specialty);
    return ResponseEntity.ok(doctors);
}

方案二：指定PathVariable的名称 #

//get doctors by Specialty
@GetMapping("/get-specialty/{speciality}")
public ResponseEntity<List<DoctorDTO>> getDoctorBySpecality(@PathVariable("speciality") String specialty) { // 显式指定路径变量名
    List<DoctorDTO> doctors = doctorService.getDoctorBySpecality(specialty);
    return ResponseEntity.ok(doctors);
}

修复逻辑说明 #

• Security路径匹配问题是导致401的直接原因：原规则无法匹配带参数的请求，导致请求未被正确授权；修改通配符或删除冗余规则后，请求会被/api/doctors/**规则正确覆盖，使用与其他接口相同的权限逻辑。
• PathVariable参数名不匹配虽不导致401，但会引发后续参数绑定错误，必须同步修复以保证接口正常运行。

内容的提问来源于stack exchange，提问作者Jeppy