Spring Boot 3.0.2从项目外文件夹提供图片时出现403错误求助

将图片存储在Spring Boot项目文件夹外的目录，尝试通过http://localhost:8080/image.ext访问时收到403错误：

Access to localhost was denied You don't have authorization to view this page. HTTP ERROR 403

• application.properties配置

  spring.web.resources.static-locations=file:/home/path/to/my/folder/images/
  

• 创建静态资源配置类（实现WebMvcConfigurer或继承WebMvcConfigurationSupport）

  @Configuration
  public class ServeStaticConfig implements WebMvcConfigurer {
      public  void serveStaticResourceHAndler(ResourceHandlerRegistry registry){
          registry.addResourceHandler("/**").addResourceLocations("file:/home/path/to/my/folder/images/");
      }
  }
  

  若给方法添加@Override注解，会提示：

  Method does not override method from its superclass
  

• 将上述资源处理器方法放入主@SpringBootApplication类，无效果
• SecurityConfig中配置路径放行
  配置代码：

  @Bean
  public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
  
      http.cors()
              .and()
              .csrf()
              .disable();
  
      http.authorizeHttpRequests()
              .requestMatchers("/swagger-ui/**",
                      "/v3/api-docs/**",
                      "/home/path/to/my/folder/images/**")
              .permitAll()
              .anyRequest()
              .authenticated()
              .and()
              .sessionManagement()
              .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
              .and()
              .authenticationProvider(authenticationProvider)
              .addFilterBefore(
                      jwtAuthFilter,
                      UsernamePasswordAuthenticationFilter.class);
  
      http.headers().frameOptions().disable();
  
      return http.build();
  }
  

  访问http://localhost:8080/home/path/to/my/folder/images/image.ext时提示‘Endpoint not found’
• 改用.requestMatchers("/**")放行，仍无效
• 已检查Linux系统下图片文件夹及文件的权限

问题根源 #

1. 静态资源配置类方法错误：自定义的serveStaticResourceHAndler方法名拼写错误，且未正确重写WebMvcConfigurer接口的addResourceHandlers方法，导致静态资源映射规则未被Spring加载。
2. Security配置路径不匹配：Security中放行的是物理磁盘路径，而非映射后的请求路径，导致权限拦截逻辑失效；同时因静态资源映射未生效，请求无法被正确路由到资源处理器，直接触发403。

可行解决方案 #

1. 正确配置静态资源映射 #

修改ServeStaticConfig类，严格按照WebMvcConfigurer接口规范重写方法：

@Configuration
public class ServeStaticConfig implements WebMvcConfigurer {
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        // 映射所有根路径请求到外部图片目录
        registry.addResourceHandler("/**")
                .addResourceLocations("file:/home/path/to/my/folder/images/");
    }
}

注意：方法名必须为addResourceHandlers，且添加@Override注解，确保Spring能识别并应用该映射规则。

2. 修正Security放行路径 #

在SecurityConfig中放行映射后的请求路径（即你实际用来访问图片的路径）：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

    http.cors()
            .and()
            .csrf()
            .disable();

    http.authorizeHttpRequests()
            .requestMatchers("/swagger-ui/**",
                    "/v3/api-docs/**",
                    "/**") // 放行所有静态资源请求（适配根路径访问图片的场景）
            .permitAll()
            .anyRequest()
            .authenticated()
            .and()
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .authenticationProvider(authenticationProvider)
            .addFilterBefore(
                    jwtAuthFilter,
                    UsernamePasswordAuthenticationFilter.class);

    http.headers().frameOptions().disable();

    return http.build();
}

若需更严谨的权限控制，可给图片请求添加特定前缀：

// 静态资源配置调整
registry.addResourceHandler("/images/**")
        .addResourceLocations("file:/home/path/to/my/folder/images/");
// Security配置调整
.requestMatchers("/swagger-ui/**", "/v3/api-docs/**", "/images/**")

此时访问路径为http://localhost:8080/images/image.ext

3. 验证外部目录权限 #

确保Spring Boot进程拥有目标目录的读取权限，Linux下可执行以下命令：

# 给目录添加读权限
chmod +r /home/path/to/my/folder/images/
# 给目录下所有文件添加读权限
chmod +r /home/path/to/my/folder/images/*
# 若需要，调整目录所属用户组（假设Spring Boot运行用户为springuser）
chown -R springuser:springuser /home/path/to/my/folder/images/

内容的提问来源于stack exchange，提问作者M Nouman