Spring Boot 3中/public/info端点免鉴权配置无效问题求助

我希望/public/info端点无需认证即可访问，但当前访问时总是被重定向到Keycloak登录页面。

我的application.yaml配置 #

spring:
  application:
    name: team1
  security:
    oauth2:
      client:
        provider:
          # provider name used for registration
          demo:
            # Keycloak realm URL: "{keycloak-url}/realms/{realm-name}"
            issuer-uri: 
        registration:
          # client-id from Keycloak client configuration
          demo-client:
            # provider from above
            provider: demo
            # client-id from Keycloak client configuration
            client-id:
            client-secret:
            scope: openid
            authorization-grant-type: authorization_code
            redirect-uri:

server:
  port: 8080

我的SecurityConfiguration代码 #

@Configuration
@EnableWebSecurity
class SecurityConfiguration{

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> {
                authorize.requestMatchers("/public/info").permitAll();
                authorize.anyRequest().authenticated();}
            ).oauth2Login(Customizer.withDefaults());
        return http.build();
    }
   
}

/public/info端点实现 #

@GetMapping(path = "/public/info")
public String hello() {
    return "Hello";
}

我的build.gradle配置（可能版本存在问题） #

plugins {
    id 'java'
    id 'org.springframework.boot' version '3.3.0'
    id 'io.spring.dependency-management' version '1.1.5'
}

group = 'at.ac.fhwn'
version = '0.0.1-SNAPSHOT'

java {
    toolchain {
        languageVersion = JavaLanguageVersion.of(21)
    }
}

repositories {
    mavenCentral()
}

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter'
    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'org.springframework.boot:spring-boot-starter-oauth2-client'
    implementation 'org.springframework.boot:spring-boot-starter-security'
    testImplementation 'org.springframework.boot:spring-boot-starter-test'
    testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
}

tasks.named('test') {
    useJUnitPlatform()
}

从以下几个角度排查修复：

1. 调整Security配置规则细节 #

Spring Security按规则顺序匹配，确保permitAll优先级高于全局认证规则。同时，可忽略该端点的CSRF检查（GET请求默认不受CSRF限制，但避免潜在冲突）：

修改后的SecurityConfiguration：

@Configuration
@EnableWebSecurity
class SecurityConfiguration {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.ignoringRequestMatchers("/public/info"))
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/public/info").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2Login(Customizer.withDefaults());
        return http.build();
    }
}

2. 确认端点路径匹配 #

检查控制器的@GetMapping路径是否与请求匹配，若应用配置了server.servlet.context-path，需在requestMatchers中加上对应前缀（比如/app/public/info）。

3. 验证版本兼容性 #

Spring Boot 3.3.0与Java 21兼容，依赖管理插件已对齐版本。可清理缓存后重新构建：

./gradlew clean build

4. 排查Keycloak配置影响 #

即使Keycloak配置项为空，OAuth2 Client过滤器仍可能生效。检查是否存在其他SecurityFilterChain Bean，或配置文件中是否有强制全局认证的设置。

测试验证 #

重启应用后访问http://localhost:8080/public/info，应直接返回Hello，不再跳转Keycloak登录页。

内容的提问来源于stack exchange，提问作者nikolardlvc