Spring Security中requestMatchers的permitAll对"/"路径不生效问题

针对你遇到的配置requestMatchers("/", "/hello").permitAll()后，根路径localhost:8080/仍被要求登录的问题，可通过以下几种方式排查修复：

1. 使用Spring MVC匹配器确保路径匹配准确 #

Spring Security默认的requestMatchers采用Ant风格路径匹配，可能和Spring MVC的路径解析逻辑存在差异。改用MvcRequestMatcher可以确保和Spring MVC的路径处理逻辑一致，避免匹配失效：

import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.config.Customizer;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public MvcRequestMatcher.Builder mvc(HandlerMappingIntrospector introspector) {
        return new MvcRequestMatcher.Builder(introspector);
    }

    @Bean
    public SecurityFilterChain web(HttpSecurity http, MvcRequestMatcher.Builder mvc) throws Exception {
        return http
                .authorizeHttpRequests(auth -> {
                    auth.requestMatchers(mvc.pattern("/"), mvc.pattern("/hello")).permitAll();
                    auth.anyRequest().authenticated();
                })
                .formLogin(Customizer.withDefaults())
                .build();
    }
}

2. 放行根路径关联的静态资源 #

Spring Boot默认会将根路径/映射到classpath:static/index.html，如果你的首页是静态HTML文件，需要同时放行静态资源路径和index.html：

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.config.Customizer;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain web(HttpSecurity http) throws Exception {
        return http
                .authorizeHttpRequests(auth -> {
                    auth.requestMatchers("/", "/hello", "/index.html", "/static/**").permitAll();
                    auth.anyRequest().authenticated();
                })
                .formLogin(Customizer.withDefaults())
                .build();
    }
}

3. 排查多配置冲突问题 #

如果项目中存在多个SecurityFilterChain Bean，优先级较低的配置可能被覆盖。可通过@Order注解指定当前配置的优先级，确保其生效：

@Configuration
@EnableWebSecurity
@Order(1) // 数值越小优先级越高
public class SecurityConfig {
    // 配置内容...
}

4. 清除浏览器缓存测试 #

浏览器可能缓存了之前的登录会话Cookie，导致修改配置后仍跳转到登录页。建议使用隐私模式访问，或清除浏览器缓存后再进行测试。

内容的提问来源于stack exchange，提问作者Seungje Mun