Spring Security httpBasic认证异常及多过滤器配置问题咨询

一、HTTP Basic认证失效问题解决 #

切换到httpBasic()后私有接口无需认证即可访问，大概率是Security规则配置顺序错误或规则覆盖导致认证逻辑未生效。Spring Security的规则匹配是从上到下执行，匹配到第一条规则后就停止处理，必须确保公开接口的放行规则优先于私有接口的认证规则。

正确配置示例（基于废弃WebSecurityConfigurerAdapter后的SecurityFilterChain） #

1. 配置内存用户信息：

@Bean
public UserDetailsService userDetailsService() {
    UserDetails testUser = User.withUsername("user")
            .password("{noop}123456") // {noop}表示明文密码，仅用于测试
            .roles("USER")
            .build();
    return new InMemoryUserDetailsManager(testUser);
}

2. 核心SecurityFilterChain配置：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        // 先定义公开接口规则：允许所有人访问
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/public/**").permitAll()
            // 剩余所有请求（包括/private/**）必须认证
            .anyRequest().authenticated()
        )
        // 启用HTTP Basic认证
        .httpBasic(Customizer.withDefaults())
        // 禁用表单登录（如果不需要的话）
        .formLogin(form -> form.disable());
    
    return http.build();
}

3. 额外检查点：
   • 确保WebSecurityCustomizer没有误将/private/**加入忽略列表，否则会跳过所有Security过滤器：

   @Bean
   public WebSecurityCustomizer webSecurityCustomizer() {
       return web -> web.ignoring().requestMatchers("/static/**"); // 仅忽略静态资源
   }
   

二、针对特定URL配置多个过滤器 #

WebSecurityConfigurerAdapter废弃后，通过SecurityFilterChain结合addFilterBefore/After/At方法，或使用FilterRegistrationBean来实现特定URL的多过滤器配置。

方式1：在Security过滤器链内配置（需经过Security认证上下文） #

假设你有两个自定义过滤器PrivateApiFilterA和PrivateApiFilterB，仅对/private/**生效：

1. 定义自定义过滤器：

public class PrivateApiFilterA extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        // 自定义逻辑：比如日志记录、参数校验
        filterChain.doFilter(request, response);
    }
}

public class PrivateApiFilterB extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        // 自定义逻辑：比如权限细粒度校验
        filterChain.doFilter(request, response);
    }
}

2. 注册过滤器并绑定到特定URL：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/public/**").permitAll()
            .anyRequest().authenticated()
        )
        .httpBasic(Customizer.withDefaults())
        // 将FilterA放在BasicAuthenticationFilter之前，仅对/private/**生效
        .addFilterBefore(new PrivateApiFilterA(), BasicAuthenticationFilter.class)
            .requestMatcher("/private/**")
        // 将FilterB放在FilterA之后，仅对/private/**生效
        .addFilterAfter(new PrivateApiFilterB(), PrivateApiFilterA.class)
            .requestMatcher("/private/**");
    
    return http.build();
}

// 注册过滤器Bean（如果需要依赖注入的话）
@Bean
public PrivateApiFilterA privateApiFilterA() {
    return new PrivateApiFilterA();
}

@Bean
public PrivateApiFilterB privateApiFilterB() {
    return new PrivateApiFilterB();
}

方式2：Servlet容器级别配置（独立于Security链） #

如果过滤器不需要依赖Security上下文，可通过FilterRegistrationBean直接绑定到特定URL，优先级高于Security过滤器链：

@Bean
public FilterRegistrationBean<PrivateApiFilterA> filterARegistration() {
    FilterRegistrationBean<PrivateApiFilterA> registration = new FilterRegistrationBean<>();
    registration.setFilter(new PrivateApiFilterA());
    registration.addUrlPatterns("/private/**");
    registration.setOrder(1); // 数值越小，执行顺序越靠前
    return registration;
}

@Bean
public FilterRegistrationBean<PrivateApiFilterB> filterBRegistration() {
    FilterRegistrationBean<PrivateApiFilterB> registration = new FilterRegistrationBean<>();
    registration.setFilter(new PrivateApiFilterB());
    registration.addUrlPatterns("/private/**");
    registration.setOrder(2);
    return registration;
}

内容的提问来源于stack exchange，提问作者JPV