Spring Web Security中HTTP 403 Forbidden错误排查（本地免认证测试）

问题详情 #

尝试访问以下定义的Controller接口：

@GetMapping(value = "/central-cloud-connector/api/v1/connector/version", produces = "application/json")

Controller完整代码：

@GetMapping(value = "/central-cloud-connector/api/v1/connector/version", produces = "application/json")
public String getVersion() {
  // 方法体    
}

访问后返回403禁止错误：

{
"timestamp": "2023-04-16T18:27:13.550+00:00",
"status": 403,
"error": "Forbidden",
"path": "/central-cloud-connector/api/v1/connector/version"
}

需求：本地环境测试时，绕过强制安全验证访问该接口。

环境信息 #

项目使用的Spring Security依赖版本：

implementation 'org.springframework.security:spring-security-web:5.8.2'
implementation 'org.springframework.security:spring-security-core:5.8.2'
implementation 'org.springframework.security:spring-security-config:5.8.2'

SecurityConfiguration类的核心配置：

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
            .securityMatcher("/central-cloud-connector/**")
            .authorizeHttpRequests((authz) -> authz.anyRequest().authenticated())
            .cors().disable()
            .csrf().disable();
    return http.build();
}

Spring Security日志片段：

Set SecurityContextHolder to AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=null], Granted Authorities=[ROLE_ANONYMOUS]]
Request requested invalid session id 00212494548EA206FE728C5ED4BB5E57
Invoking ExceptionTranslationFilter (10/11)
Invoking AuthorizationFilter (11/11)
Checking authorization on SecurityContextHolderAwareRequestWrapper[ org.springframework.security.web.header.HeaderWriterFilter$HeaderWriterRequest@42a59089] using org.springframework.security.authorization.AuthenticatedAuthorizationManager@635ed42a
Sending AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=null], Granted Authorities=[ROLE_ANONYMOUS]] to authentication entry point since access is denied

已尝试的无效方案 #

添加以下配置到properties文件，但问题未解决：

security.basic.enable= false   
management.security.enabled= false

排查与解决建议 #

1. 修改SecurityFilterChain，放行指定接口
   在authorizeHttpRequests中添加针对目标接口的放行规则，注意规则顺序（permitAll必须放在anyRequest()之前）：

   @Bean
   public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
       http
               .securityMatcher("/central-cloud-connector/**")
               .authorizeHttpRequests((authz) -> authz
                       .antMatchers("/central-cloud-connector/api/v1/connector/version").permitAll()
                       .anyRequest().authenticated())
               .cors().disable()
               .csrf().disable();
       return http.build();
   }
   

2. 仅在本地环境生效的放行配置
   为避免影响生产环境，结合Spring Profiles实现环境隔离：

   • 激活本地profile（如配置spring.profiles.active=local）
   • 修改配置类，通过条件判断添加放行规则：

     @Bean
     public SecurityFilterChain filterChain(HttpSecurity http, @Value("${spring.profiles.active}") String activeProfile) throws Exception {
         http
                 .securityMatcher("/central-cloud-connector/**")
                 .authorizeHttpRequests((authz) -> {
                     if ("local".equals(activeProfile)) {
                         authz.antMatchers("/central-cloud-connector/api/v1/connector/version").permitAll();
                     }
                     authz.anyRequest().authenticated();
                 })
                 .cors().disable()
                 .csrf().disable();
         return http.build();
     }
     

3. 废弃配置说明
   你尝试的security.basic.enable=false和management.security.enabled=false是Spring Boot 1.x的配置，在Spring Boot 2.x及以上版本已完全失效，无需再配置。

4. 权限逻辑说明
   从日志看，请求已被识别为匿名用户，但当前配置要求所有请求必须认证（authenticated()）——这里的认证指用户通过AuthenticationManager完成正式认证，匿名用户属于特殊的未认证状态，因此必须显式通过permitAll放行目标接口。

内容的提问来源于stack exchange，提问作者Prabal Rakshit