Spring Security中permitAll()不生效，如何解决？

已配置SecurityFilterChain允许特定路径的POST请求，但发起请求时系统未识别目标路径，仍将请求交由安全过滤器处理，不符合预期。

当前SecurityFilterChain配置 #

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http
               .csrf().disable()
               .sessionManagement()
                   .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                   .and()
               .authorizeRequests()
                   .antMatchers(HttpMethod.POST, "/login").permitAll() 
                   .antMatchers("/v3/api-docs/**", "/swagger-ui.html", "/swagger-ui/**").permitAll()
                   .anyRequest().authenticated()
                   .and()
               .addFilterBefore(securityFilter, UsernamePasswordAuthenticationFilter.class)
        .build();
}

控制器代码 #

@RestController
@RequestMapping("/cadastrar")
public class CadastroController {

    @Autowired
    private CadastroService cadastroService;
    
    @PostMapping("/cadastro-usuario")
    @Transactional
    public ResponseEntity<Object> cadastrar(@RequestBody @Valid DadosCadastroUsuario dados ){
        try{
            cadastroService.cadastrarUsuario(dados);
            return ResponseEntity.status(HttpStatus.CREATED).header("Location", "/login").build();
        } catch (Exception e){
           return ResponseEntity.badRequest().body(e.getMessage());
        }
    }

    @PostMapping("/cadastro-loja")
    @Transactional
    public ResponseEntity<Object> cadastrar(@RequestBody @Valid DadosCadastroLoja dados) throws Exception {
        try{
            cadastroService.cadastrarLoja(dados);
            return ResponseEntity.status(HttpStatus.CREATED).header("Location", "/login").build();
        } catch (Exception e) {
            return ResponseEntity.badRequest().body(e.getMessage());
        }
    }
}

请求信息 #

发起请求的URL为：https://localhost:443/cadastrar/cadastro-usuario，已确认请求路径与控制器配置一致。

解决方案 #

问题原因 #

SecurityFilterChain配置中未对/cadastrar/**路径的POST请求设置放行规则，导致该路径被anyRequest().authenticated()拦截，进入安全过滤器处理流程。

修改后的配置代码 #

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http
               .csrf().disable()
               .sessionManagement()
                   .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                   .and()
               .authorizeRequests()
                   // 新增/cadastrar/**的POST请求放行规则
                   .antMatchers(HttpMethod.POST, "/login", "/cadastrar/**").permitAll() 
                   .antMatchers("/v3/api-docs/**", "/swagger-ui.html", "/swagger-ui/**").permitAll()
                   .anyRequest().authenticated()
                   .and()
               .addFilterBefore(securityFilter, UsernamePasswordAuthenticationFilter.class)
        .build();
}

关键说明 #

• 在antMatchers(HttpMethod.POST, ...)中添加/cadastrar/**，即可放行所有以/cadastrar/开头的POST请求，覆盖控制器中/cadastrar/cadastro-usuario和/cadastrar/cadastro-loja两个接口。
• Spring Security的规则匹配按配置顺序执行，需将具体放行规则放在anyRequest()之前，否则会被全局认证规则覆盖。

内容的提问来源于stack exchange，提问作者Javed386