如何根据RequestURI禁用Spring Security执行，规避configure方法触发？

要让/auth/findRealm请求完全绕过Spring Security的过滤器链（不进入configure方法的逻辑），你需要使用Spring Security的ignoring()方法，而非permitAll()。原因是permitAll()仅在授权环节允许请求通过，但请求仍会经过整个Security过滤器链，包括你配置的OAuth2资源服务器逻辑，这会触发AuthenticationManagerResolver的调用，进而引发问题。

修改后的SecurityConfig代码 #

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
public class SecurityConfig {
    private final AuthenticationEntryPoint authenticationEntryPoint;
    private final AuthenticationEntryPoint tokenAuthenticationEntryPoint;
    private final AuthenticationManagerResolver authenticationManagerResolver;

    public SecurityConfig(
            @Qualifier("customAuthenticationEntryPoint") AuthenticationEntryPoint authenticationEntryPoint,
            @Qualifier("tokenAuthenticationEntryPoint") AuthenticationEntryPoint tokenAuthenticationEntryPoint,
            AuthenticationManagerResolver authenticationManagerResolver) {
        this.authenticationEntryPoint = authenticationEntryPoint;
        this.tokenAuthenticationEntryPoint = tokenAuthenticationEntryPoint;
        this.authenticationManagerResolver = authenticationManagerResolver;
    }

    @Bean
    public SecurityFilterChain configure(HttpSecurity http) throws Exception {
        // 优先配置忽略规则，让目标请求完全绕过Security过滤器链
        http.ignoring().antMatchers("/auth/findRealm");

        http
                .cors().and()
                .authorizeRequests()
                .anyRequest().authenticated()
                .and().exceptionHandling()
                .authenticationEntryPoint(authenticationEntryPoint)
                .and()
                .oauth2ResourceServer().authenticationEntryPoint(tokenAuthenticationEntryPoint)
                .authenticationManagerResolver(request -> authenticationManagerResolver.resolveAuthenticationManager(request));
        return http.build();
    }
}

额外注意事项 #

• CORS配置：被ignoring()的路径不会经过Spring Security的CORS过滤器，若需对该路径启用CORS，需在Spring MVC层面配置（比如使用@CrossOrigin注解或全局CORS配置类）。
• 规则顺序：ignoring()的配置必须放在其他Security规则之前，确保优先生效。

内容的提问来源于stack exchange，提问作者kernel