Spring Security配置排查：无需认证端点无法开放问题

以下是针对你的代码可能存在的问题及修复方案：

1. 默认登录表单与自定义路由冲突 #

Spring Security默认会提供/login路径的内置登录页，这会覆盖你自定义的/login控制器路由，导致无法访问自己的登录页面。需要在配置中禁用默认表单登录：

httpSecurity
    .csrf(AbstractHttpConfigurer::disable)
    .formLogin(AbstractHttpConfigurer::disable) // 新增此行，禁用默认登录表单逻辑
    .authorizeHttpRequests(req ->
            req.requestMatchers("/", "/login", "/register").permitAll()
               .requestMatchers("/auth/**").permitAll()
               .anyRequest().authenticated()
    )
    // 其余配置保持不变

2. JWT过滤器未跳过开放路径 #

你的JWT过滤器会拦截所有请求，若过滤器内部未添加开放路径的跳过逻辑，即使配置了permitAll，未携带Token的请求也会被拦截返回401。需在JwtAuthenticationFilter的doFilterInternal方法中添加路径判断：

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    String path = request.getRequestURI();
    // 定义无需认证的路径列表
    List<String> allowedPaths = Arrays.asList("/", "/login", "/register", "/auth/**");
    
    // 匹配到开放路径则直接放行
    for (String allowedPath : allowedPaths) {
        if (new AntPathRequestMatcher(allowedPath).matches(request)) {
            filterChain.doFilter(request, response);
            return;
        }
    }
    
    // 原有JWT校验逻辑...
}

3. 未明确放行POST请求（可选） #

如果登录、注册涉及表单提交（POST请求），当前配置仅放行GET请求，需补充指定HTTP方法：

.authorizeHttpRequests(req ->
        req.requestMatchers(HttpMethod.GET, "/", "/login", "/register").permitAll()
           .requestMatchers(HttpMethod.POST, "/login", "/register", "/auth/**").permitAll()
           .anyRequest().authenticated()
)

4. 静态资源未放行（若页面依赖） #

如果主页、登录页用到CSS、JS、图片等静态资源，这些路径也需要加入放行列表，否则页面样式会加载失败：

.requestMatchers("/css/**", "/js/**", "/images/**", "/fonts/**").permitAll()

修改后的完整Security配置示例 #

package com.shapesynergy.dietworkout.config;

import lombok.RequiredArgsConstructor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import static org.springframework.security.config.http.SessionCreationPolicy.STATELESS;

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfiguration {
    private final JwtAuthenticationFilter jwtAuthenticationFilter;
    private final AuthenticationProvider authenticationProvider;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
                .csrf(AbstractHttpConfigurer::disable)
                .formLogin(AbstractHttpConfigurer::disable)
                .authorizeHttpRequests(req ->
                        req.requestMatchers(HttpMethod.GET, "/", "/login", "/register").permitAll()
                           .requestMatchers(HttpMethod.POST, "/login", "/register", "/auth/**").permitAll()
                           .requestMatchers("/css/**", "/js/**", "/images/**").permitAll()
                           .anyRequest().authenticated()
                )
                .sessionManagement(session -> session.sessionCreationPolicy(STATELESS))
                .authenticationProvider(authenticationProvider)
                .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
        return httpSecurity.build();
    }
}

内容的提问来源于stack exchange，提问作者Maciej Szuwarowski