Spring Boot POST请求跳转登录页，@PreAuthorize注解失效排查

云原生阿岚

2026-6-21

Spring Security接口权限问题排查与解决

问题描述

我正在开发集成Spring Security的Spring Boot应用，在保护特定接口时遇到问题：已认证用户无法通过POST /api/v1/users/{userId}/home/books/create接口创建书籍。

问题现象

调用该接口时始终返回200 OK，但响应为包含‘please sign in’的HTML页面；
已在Postman中使用Basic Authentication，携带拥有USER角色的有效凭证；
接口方法已标注@PreAuthorize("hasRole('USER')")，用户应具备对应角色。

已实现代码

控制器代码

package com.example.spring_security_course.controller;

import com.example.spring_security_course.entity.Book;
import com.example.spring_security_course.entity.UserEntity;
import com.example.spring_security_course.service.BookService;
import com.example.spring_security_course.service.UserServices;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.web.bind.annotation.*;

import java.util.List;

@RestController
@RequestMapping("/api/v1/users")
public class BookController {

    @Autowired
    private BookService bookService;

    @Autowired
    private UserServices userServices;

    @GetMapping
    public ResponseEntity<List<Book>> getAllBooks() {
        List<Book> books = bookService.findAllBooks();
        return ResponseEntity.ok(books);
    }

    @GetMapping("/{userId}/home/books")
    public ResponseEntity<List<Book>> getAllUserBooks(@PathVariable Long userId) {
        try {
            UserEntity user = userServices.findUserById(userId);
            List<Book> books = bookService.getAllBookByUser(user);
            return ResponseEntity.ok(books);
        } catch (Exception e) {
            return ResponseEntity.status(403).build();
        }
    }

    @GetMapping("/{id}")
    public ResponseEntity<Book> getBookById(@PathVariable Long id) {
        Book book = bookService.findBookById(id);
        return ResponseEntity.ok(book);
    }

    @PreAuthorize("hasRole('USER')")
    @PostMapping("/{userId}/home/books/create")
    public ResponseEntity<Book> createBook(@RequestBody Book book, @PathVariable Long userId) {
        UserEntity authenticatedUser = getAuthenticatedUser();

        UserEntity user = userServices.findUserById(userId);

        if (user != null && authenticatedUser != null && user.getId().equals(authenticatedUser.getId())) {
            book.setUser(user);
            Book createdBook = bookService.saveBook(book);
            return ResponseEntity.ok(createdBook);
        } else {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
        }
    }

    private UserEntity getAuthenticatedUser() {
        Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        if (principal instanceof UserDetails) {
            String username = ((UserDetails) principal).getUsername();
            return userServices.findByUsername(username);
        }
        return null;
    }
}

安全配置代码

package com.example.spring_security_course.security;

import com.example.spring_security_course.service.UserDetailsManagerService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig {

    @Autowired
    private UserDetailsManagerService userDetailsManagerService;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http.csrf(csrf -> csrf.disable())
                   .headers(headers -> headers.frameOptions().disable())
                   .authorizeHttpRequests(auth -> {
                       auth.requestMatchers("/register/**").permitAll();
                       auth.requestMatchers("/api/v1/users/**").hasAnyRole("USER", "ADMIN");
                       auth.requestMatchers("/admin/**").hasRole("ADMIN");
                       auth.requestMatchers("/users/**").hasRole("USER");
                       auth.anyRequest().authenticated();
                   })
                   .formLogin(form -> form.permitAll())
                   .build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setUserDetailsService(userDetailsManagerService);
        provider.setPasswordEncoder(passwordEncoder());
        return provider;
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }
}

已尝试的排查步骤

验证UserDetailsManagerService返回的用户角色正确；
确认安全配置已通过@EnableGlobalMethodSecurity(prePostEnabled = true)开启方法级安全；
检查日志未发现明显异常。

咨询问题

我的安全配置或控制器代码是否存在问题导致该现象？
还有哪些调试步骤可排查@PreAuthorize注解未生效的原因？
如何确保Spring Security能正确识别已认证用户的角色？

问题解答

1. 代码中的问题分析

核心问题：未启用HTTP Basic认证

你的安全配置中只配置了formLogin，但没有启用Basic Authentication，导致Postman发送的Basic Auth凭证不被Spring Security识别，系统认为用户未认证，从而重定向到登录页面（返回带"please sign in"的HTML）。

其他潜在问题

@PreAuthorize注解虽然开启了，但如果用户未被正确认证，注解逻辑根本不会执行；
接口中额外的用户ID校验是合理的，但前提是用户已经完成认证。

2. 调试步骤建议

开启Spring Security debug日志：在application.properties中添加logging.level.org.springframework.security=DEBUG，查看认证流程的详细日志，确认凭证是否被解析、用户角色是否被正确加载；
校验Authentication对象：在getAuthenticatedUser()方法中添加日志，打印SecurityContextHolder.getContext().getAuthentication()的完整信息，包括isAuthenticated()状态和getAuthorities()列表；
测试接口权限匹配：临时修改安全配置，将/api/v1/users/**设置为permitAll()，然后调用接口，查看是否能正常进入方法逻辑，排除路由匹配问题；
验证角色前缀：Spring Security的hasRole()默认会给角色添加ROLE_前缀，确认你的用户角色存储时是否带前缀（比如数据库中是ROLE_USER还是USER）。如果存储的是USER，可以改用hasAuthority('USER')或者配置rolePrefix去掉默认前缀。

3. 确保角色被正确识别的方法

统一角色前缀：要么在存储用户角色时添加ROLE_前缀，要么在安全配置中修改默认前缀：

@Bean
public GrantedAuthorityDefaults grantedAuthorityDefaults() {
    return new GrantedAuthorityDefaults(""); // 去掉默认的ROLE_前缀
}

校验UserDetails的getAuthorities()：在UserDetailsManagerService的loadUserByUsername()方法中，确保返回的UserDetails对象包含正确的GrantedAuthority列表，比如：

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    UserEntity user = userRepository.findByUsername(username)
        .orElseThrow(() -> new UsernameNotFoundException("User not found"));
    return User.builder()
        .username(user.getUsername())
        .password(user.getPassword())
        .authorities(user.getRoles().stream()
            .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName())) // 或直接用role.getName()如果已带前缀
            .toArray(GrantedAuthority[]::new))
        .build();
}

启用Basic认证：在安全配置中添加httpBasic()：

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http.csrf(csrf -> csrf.disable())
               .headers(headers -> headers.frameOptions().disable())
               .authorizeHttpRequests(auth -> {
                   auth.requestMatchers("/register/**").permitAll();
                   auth.requestMatchers("/api/v1/users/**").hasAnyRole("USER", "ADMIN");
                   auth.requestMatchers("/admin/**").hasRole("ADMIN");
                   auth.requestMatchers("/users/**").hasRole("USER");
                   auth.anyRequest().authenticated();
               })
               .formLogin(form -> form.permitAll())
               .httpBasic(Customizer.withDefaults()) // 添加这行启用Basic认证
               .build();
}

内容的提问来源于stack exchange，提问作者kasim alshaikh ali

Spring Boot POST请求跳转登录页，@PreAuthorize注解失效排查

问题描述 #

问题现象 #

已实现代码 #

控制器代码

安全配置代码

已尝试的排查步骤 #

咨询问题 #

问题解答 #

1. 代码中的问题分析 #