Spring Boot 2.7升级后Swagger UI访问403权限问题求助

将Spring Boot从2.5版本升级到2.7版本后，接口（如https://localhost:8493/test/myendpoint）可正常访问并获取JSON数据，但访问https://localhost:8493/test/swagger-ui时出现403权限错误，提示「You don't have authorisation to view this page. HTTP ERROR 403」。相关配置如下：

SecurityConfig配置类 #

@Configuration 
@Order(Ordered.HIGHEST_PRECEDENCE)
@Data
public class SecurityConfig {


    @Value("${portal.required.role.name}")
    private String portalRoleName;

    @Value("${server.servlet.context-path}")
    private String servletContextPath;

    @Bean
    protected SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

        http
            .authorizeRequests()
                .antMatchers("/myendpoint/**").permitAll().and()
            .authorizeRequests().antMatchers("/myendpoint2/**").permitAll().and()
            .authorizeRequests().antMatchers(servletContextPath).hasAuthority(portalRoleName)
                .anyRequest().fullyAuthenticated();

        return http.build();
    }
}

SpringFoxConfig配置类 #

@Configuration
@EnableOpenApi
@Import(SpringDataRestConfiguration.class)
public class SpringFoxConfig {

    @Bean
    public WebMvcRequestHandlerProvider webMvcRequestHandlerProvider(Optional<ServletContext> servletContext, HandlerMethodResolver methodResolver, List<RequestMappingInfoHandlerMapping> handlerMappings) {
        handlerMappings = handlerMappings.stream().filter(rh -> rh.getClass().getName().contains("RequestMapping")).toList();
        return new WebMvcRequestHandlerProvider(servletContext, methodResolver, handlerMappings);
    }

    @Bean
    public Docket api() {
        return new Docket(DocumentationType.SWAGGER_2)
                .select()
                .apis(RequestHandlerSelectors.basePackage("mypackage"))
                .paths(PathSelectors.any())
                .build();
    }

}

依赖配置 #

<dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-devtools</artifactId>
            <scope>runtime</scope>
        </dependency>

         <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>

        <dependency>
            <groupId>org.postgresql</groupId>
            <artifactId>postgresql</artifactId>
            <version>42.2.6</version>
        </dependency>
    
        <!-- https://mvnrepository.com/artifact/org.hibernate/hibernate-envers -->
        <dependency>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-envers</artifactId>
        </dependency>

        <dependency>
            <groupId>com.h2database</groupId>
            <artifactId>h2</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <dependency>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-c3p0</artifactId>
            <version>5.4.4.Final</version>
        </dependency>

        <!--Swagger START-->
        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-boot-starter</artifactId>
            <version>3.0.0</version>
        </dependency>
        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-swagger-ui</artifactId>
            <version>3.0.0</version>
        </dependency>

        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-bean-validators</artifactId>
            <version>3.0.0</version>
        </dependency>
        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-swagger2</artifactId>
            <version>3.0.0</version>
        </dependency>
        <!--Swagger END-->

        <!-- JSONObject -->
        <dependency>
            <groupId>org.codehaus.jettison</groupId>
            <artifactId>jettison</artifactId>
            <version>1.5.0</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webflux</artifactId>
        </dependency>

    </dependencies>

properties文件配置 #

spring.mvc.pathmatch.matching-strategy= ANT_PATH_MATCHER

403错误的核心原因是Spring Security未对Swagger相关的静态资源和接口放行，结合Spring Boot 2.7与SpringFox 3.0.0的适配要求，需做以下修改：

1. 调整SecurityConfig，放行Swagger路径 #

在securityFilterChain方法中添加Swagger全量路径的放行规则，覆盖UI页面、API文档接口、静态资源等：

@Configuration 
@Order(Ordered.HIGHEST_PRECEDENCE)
@Data
public class SecurityConfig {

    @Value("${portal.required.role.name}")
    private String portalRoleName;

    @Value("${server.servlet.context-path}")
    private String servletContextPath;

    @Bean
    protected SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

        http
            .authorizeRequests()
                // 放行Swagger所有相关路径
                .antMatchers("/swagger-ui/**", "/v3/api-docs/**", "/swagger-resources/**", "/webjars/**").permitAll()
                .antMatchers("/myendpoint/**").permitAll()
                .antMatchers("/myendpoint2/**").permitAll()
                .antMatchers(servletContextPath).hasAuthority(portalRoleName)
                .anyRequest().fullyAuthenticated();

        return http.build();
    }
}

2. 简化Swagger依赖（可选但推荐） #

springfox-boot-starter已包含springfox-swagger-ui、springfox-swagger2等核心依赖，重复引入会造成冗余，可简化为：

<!--Swagger START-->
<dependency>
    <groupId>io.springfox</groupId>
    <artifactId>springfox-boot-starter</artifactId>
    <version>3.0.0</version>
</dependency>
<dependency>
    <groupId>io.springfox</groupId>
    <artifactId>springfox-bean-validators</artifactId>
    <version>3.0.0</version>
</dependency>
<!--Swagger END-->

3. 适配OpenAPI 3.0（可选） #

将Docket的文档类型改为OAS_30，同时补充API基础信息，提升文档可读性：

@Configuration
@EnableOpenApi
@Import(SpringDataRestConfiguration.class)
public class SpringFoxConfig {

    @Bean
    public WebMvcRequestHandlerProvider webMvcRequestHandlerProvider(Optional<ServletContext> servletContext, HandlerMethodResolver methodResolver, List<RequestMappingInfoHandlerMapping> handlerMappings) {
        handlerMappings = handlerMappings.stream().filter(rh -> rh.getClass().getName().contains("RequestMapping")).toList();
        return new WebMvcRequestHandlerProvider(servletContext, methodResolver, handlerMappings);
    }

    @Bean
    public Docket api() {
        return new Docket(DocumentationType.OAS_30)
                .select()
                .apis(RequestHandlerSelectors.basePackage("mypackage"))
                .paths(PathSelectors.any())
                .build()
                .apiInfo(apiInfo());
    }

    private ApiInfo apiInfo() {
        return new ApiInfoBuilder()
                .title("项目API文档")
                .description("接口功能与参数说明")
                .version("1.0")
                .build();
    }
}

4. 保留现有路径匹配配置 #

spring.mvc.pathmatch.matching-strategy=ANT_PATH_MATCHER配置无需修改，SpringFox 3.0.0不支持Spring Boot 2.6+默认的PATH_PATTERN_PARSER，该配置是必要的。

内容的提问来源于stack exchange，提问作者Octavia