Spring Boot 3中结合Basic Auth与IP限制保护端点的实现问题

在Spring Boot 3（对应Spring Security 6+）中，authorizeHttpRequests()的access()方法不再支持SpEL字符串表达式，必须传入AuthorizationManager<RequestAuthorizationContext>。要实现/test端点同时满足Basic Auth认证通过和特定IP访问的要求，不能用两个独立的SecurityFilterChain（会导致条件被绕过），需要将两个条件组合到同一个授权逻辑中，以下是两种可行方案：

方案一：使用AuthorizationManagers组合内置授权器 #

利用Spring Security提供的AuthorizationManagers.allOf()方法，将“认证通过”和“IP匹配”两个授权逻辑组合，只有两者同时满足才允许访问：

import org.springframework.security.authorization.AuthorizationDecision;
import org.springframework.security.authorization.AuthorizationManager;
import org.springframework.security.authorization.AuthorizationManagers;
import org.springframework.security.web.access.intercept.RequestAuthorizationContext;
import org.springframework.security.web.util.matcher.IpAddressMatcher;
import jakarta.servlet.http.HttpServletRequest;

// 定义IP匹配的授权器
private AuthorizationManager<RequestAuthorizationContext> hasIpAddress(String ipAddress) {
    IpAddressMatcher ipAddressMatcher = new IpAddressMatcher(ipAddress);
    return (authentication, context) -> {
        HttpServletRequest request = context.getRequest();
        return new AuthorizationDecision(ipAddressMatcher.matches(request));
    };
}

@Bean
SecurityFilterChain combinedSecurityFilterChain(HttpSecurity http) throws Exception {
    // 获取内置的“认证通过”授权器
    AuthorizationManager<RequestAuthorizationContext> authenticatedAuthManager = AuthorizationManagers.authenticated();
    // 获取自定义的IP匹配授权器
    AuthorizationManager<RequestAuthorizationContext> ipAuthManager = hasIpAddress("127.0.0.1");
    // 组合两个授权器：必须同时满足
    AuthorizationManager<RequestAuthorizationContext> combinedAuthManager = AuthorizationManagers.allOf(authenticatedAuthManager, ipAuthManager);

    http
        .authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/test").access(combinedAuthManager)
            .anyRequest().permitAll()
        )
        .csrf().disable()
        .httpBasic(); // 启用Basic Auth认证

    return http.build();
}

方案二：自定义AuthorizationManager实现组合逻辑 #

如果需要更灵活的逻辑控制（比如调整判断顺序、添加额外校验），可以直接自定义一个AuthorizationManager，在其中同时判断认证状态和IP：

import org.springframework.security.authorization.AuthorizationDecision;
import org.springframework.security.authorization.AuthorizationManager;
import org.springframework.security.web.access.intercept.RequestAuthorizationContext;
import org.springframework.security.web.util.matcher.IpAddressMatcher;
import jakarta.servlet.http.HttpServletRequest;

@Bean
SecurityFilterChain combinedSecurityFilterChain(HttpSecurity http) throws Exception {
    AuthorizationManager<RequestAuthorizationContext> combinedAuthManager = (authentication, context) -> {
        // 第一步：判断是否已通过认证
        boolean isAuthenticated = authentication != null && authentication.isAuthenticated();
        if (!isAuthenticated) {
            return new AuthorizationDecision(false);
        }

        // 第二步：判断请求IP是否匹配
        HttpServletRequest request = context.getRequest();
        IpAddressMatcher ipMatcher = new IpAddressMatcher("127.0.0.1");
        boolean isIpAllowed = ipMatcher.matches(request);
        
        return new AuthorizationDecision(isIpAllowed);
    };

    http
        .authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/test").access(combinedAuthManager)
            .anyRequest().permitAll()
        )
        .csrf().disable()
        .httpBasic();

    return http.build();
}

注意事项 #

• 不要定义两个独立的SecurityFilterChain：Spring Security会按Bean的加载顺序匹配过滤器链，第一个匹配的链会先处理请求，导致其中一个条件被跳过（比如先匹配IP过滤链，会直接允许符合IP的请求，不检查Basic Auth）。
• IpAddressMatcher支持CIDR格式，比如192.168.1.0/24，可以批量配置允许的IP段。

内容的提问来源于stack exchange，提问作者Yakimget