访问Swagger UI时出现403 Forbidden错误的排查求助

我在Spring Boot 3.1.4项目中配置了Spring Security白名单端点，/auth/login和/auth/signup能正常访问，但浏览器访问Swagger UI时一直报403 Forbidden错误。使用的SpringDoc版本是OpenAPI Starter WebMVC UI 2.2.0，以下是我的配置代码，求帮忙排查问题。

SecurityConfig类代码 #

package com.navyug.security.authn.config;

import static org.springframework.security.config.Customizer.withDefaults;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import com.navyug.security.authn.service.UserServiceImpl;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {

    @Autowired
    private UserServiceImpl userDetailsServiceImpl;

    private static final String[] AUTH_WHITELIST = { "/v2/api-docs", "/v3/api-docs", "/swagger-resources",
            "/swagger-resources/**", "/swagger-ui.html", "/swagger-ui/**", "/webjars/**", "/api-docs.yaml", "/ws",
            "auth/login", "auth/signup", "/", "/*.js", "/*.ico", "/*.json", "/*.png", "/*.jpg", "/*.txt*", "/*.css" };

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(configurer -> configurer.requestMatchers(AUTH_WHITELIST).permitAll())
                .httpBasic(withDefaults()).csrf((csrf) -> csrf.disable());

        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }

    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();

        authProvider.setUserDetailsService(userDetailsServiceImpl);
        authProvider.setPasswordEncoder(passwordEncoder());

        return authProvider;
    }
}

application.properties配置 #

springdoc.api-docs.path=/api-docs
springdoc.swagger-ui.path=/swagger-ui.html
springdoc.swagger-ui.enabled=true
springdoc.swagger-ui.with-credentials=false

问题排查与修复 #

• 核心缺失：API文档路径未放行
  配置文件中指定了springdoc.api-docs.path=/api-docs，但白名单里只包含/api-docs.yaml，漏掉了/api-docs这个Swagger UI依赖的核心接口，导致拉取文档时被拦截，触发403错误。

• 路径不规范：缺少前缀斜杠
  白名单中的auth/login和auth/signup未加开头的/，虽然当前能访问，但属于不规范写法，建议修正为/auth/login、/auth/signup避免潜在问题。

• 修正后的白名单数组
  更新AUTH_WHITELIST，补充/api-docs并修正路径前缀：

  private static final String[] AUTH_WHITELIST = { 
      "/v2/api-docs", "/v3/api-docs", "/swagger-resources",
      "/swagger-resources/**", "/swagger-ui.html", "/swagger-ui/**", 
      "/webjars/**", "/api-docs", "/api-docs.yaml", "/ws",
      "/auth/login", "/auth/signup", "/", "/*.js", "/*.ico", 
      "/*.json", "/*.png", "/*.jpg", "/*.txt*", "/*.css" 
  };
  

• 额外验证
  确认SecurityFilterChain配置中，除白名单外的其他请求是否需要认证，当前配置仅放行白名单，符合预期。httpBasic启用不影响Swagger访问，若无需基础认证可移除该配置。

内容的提问来源于stack exchange，提问作者nisshar