未配置Spring Security的Spring Boot REST接口如何用Postman测试？

我创建了一个基于Spring Boot的Web REST API，仅引入spring-boot-starter-security依赖后，应用启动日志如下：

2023-10-27T15:06:17.219-04:00  WARN 19172 --- [           main] .s.s.UserDetailsServiceAutoConfiguration : 

Using generated security password: db6773b8-f34d-4675-b9bd-c6921cf8b79e

This generated password is for development use only. Your security configuration must be updated before running your application in production.

2023-10-27T15:06:17.282-04:00  INFO 19172 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 1 endpoint(s) beneath base path '/actuator'
2023-10-27T15:06:17.302-04:00  INFO 19172 --- [           main] o.s.s.web.DefaultSecurityFilterChain     : Will secure any request with [org.springframework.security.web.session.DisableEncodeUrlFilter@773cc551, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@5cbaafbd, org.springframework.security.web.context.SecurityContextHolderFilter@772589ed, org.springframework.security.web.header.HeaderWriterFilter@2ef3efcc, org.springframework.web.filter.CorsFilter@4f0f56f5, org.springframework.security.web.csrf.CsrfFilter@2a045e85, org.springframework.security.web.authentication.logout.LogoutFilter@3f910f36, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@7ffb0bb4, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@2bb118ae, org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter@6edb093f, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@11e75942, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@c040c8d, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@4917992b, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@7f5c4ff8, org.springframework.security.web.access.ExceptionTranslationFilter@640028f2, org.springframework.security.web.access.intercept.AuthorizationFilter@c6653e]

目前我未对Spring Security框架做任何配置，请问此时能否通过Postman轻松测试该REST接口？

可以测试，但需要遵循Spring Security默认自动配置规则提供认证信息，具体操作如下：

1. 默认认证凭据 #

Spring Security自动生成了一个默认用户：

• 用户名：user
• 密码：启动日志中输出的db6773b8-f34d-4675-b9bd-c6921cf8b79e（应用每次重启都会生成新密码）

2. Postman测试步骤 #

针对GET请求 #

在Postman中打开请求的Authorization选项卡：

• 认证类型选择Basic Auth
• 输入用户名user和日志中的密码
• 直接发送请求即可通过认证

针对POST/PUT/DELETE等修改类请求 #

默认开启了CSRF保护，直接发送这类请求会返回403 Forbidden，有两种解决方式：

方式一：临时关闭CSRF（仅用于开发测试）

创建一个Spring Security配置类，关闭CSRF保护：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .httpBasic();
        return http.build();
    }
}

修改后重启应用，即可用Basic Auth直接发送POST/PUT/DELETE请求。

方式二：携带CSRF Token（无需修改配置）

1. 先发送一个GET请求，从响应的Cookie中获取XSRF-TOKEN值
2. 在POST/PUT/DELETE请求的Headers中添加X-XSRF-TOKEN，值为获取到的Token
3. 同时配置Basic Auth凭据，再发送请求即可

内容的提问来源于stack exchange，提问作者K.Nicholas