Spring Security中permitAll接口遇Basic Auth返回401问题求助

一、该行为是否合理？ #

此行为属于Spring Security的预期逻辑。当你启用httpBasic()配置后，BasicAuthenticationFilter会对所有请求生效——即使某个接口设置了permitAll（仅跳过授权校验），只要请求携带了Basic Auth凭证，过滤器就会尝试执行认证校验。

如果凭证无效（比如用户名/密码错误），会抛出AuthenticationException，进而触发你自定义的MyAuthenticationEntryPoint，最终返回401未授权响应。而不携带凭证时，过滤器不会执行认证逻辑，permitAll规则直接生效，接口正常返回预期结果。

二、如何修改该行为？ #

方案1：拆分SecurityFilterChain，为permitAll接口单独配置 #

通过多个SecurityFilterChain bean，为/health单独配置禁用HttpBasic的规则，避免认证过滤器对其生效：

// 优先处理/health的配置
@Bean
@Order(1)
public SecurityFilterChain healthSecurityFilterChain(HttpSecurity http) throws Exception {
    http
        .antMatcher("/health")
        .authorizeRequests()
        .anyRequest().permitAll()
        .and()
        .csrf().disable()
        .cors()
        .and()
        // 禁用HttpBasic和表单登录
        .httpBasic().disable()
        .formLogin().disable();
    
    return http.build();
}

// 处理其他需要认证的接口
@Bean
@Order(2)
public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .anyRequest().authenticated()
        .and()
        .httpBasic().authenticationEntryPoint(entryPoint)
        .and()
        .csrf().disable()
        .cors()
        .and()
        .formLogin().disable();
    
    return http.build();
}

方案2：让WebSecurity忽略指定路径的所有安全过滤器 #

如果/health不需要任何Spring Security处理（包括CORS、CSRF等），可以直接让WebSecurity忽略该路径：

@Bean
public WebSecurityCustomizer webSecurityCustomizer() {
    return web -> web.ignoring().antMatchers(HttpMethod.GET, "/health");
}

方案3：修改自定义AuthenticationEntryPoint，跳过permitAll路径的401响应 #

在自定义认证入口点中判断请求路径，若为/health则直接放行，不返回401：

public class MyAuthenticationEntryPoint implements AuthenticationEntryPoint{

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response,
        AuthenticationException authException) throws IOException, ServletException {
        
        // 对/health路径跳过认证失败处理
        if ("/health".equals(request.getRequestURI())) {
            response.setStatus(HttpServletResponse.SC_OK);
            return;
        }
        
        ResponseData responseData = new ResponseData();
        responseData.setResponseStatus(HttpStatus.UNAUTHORIZED.getReasonPhrase());
        responseData.setErrorMessage(new ArrayList<>(Arrays.asList("Not authorized to access")));
        responseData.setResponseCode(HttpServletResponse.SC_UNAUTHORIZED);

        ObjectMapper mapper = new ObjectMapper();
        mapper.configure(JsonParser.Feature.ALLOW_COMMENTS, true);
        String jsonResponse = mapper.writeValueAsString(responseData);
        PrintWriter printWriter = response.getWriter(); 
        printWriter.append(jsonResponse);
        printWriter.flush();
        printWriter.close();
    }
}

内容的提问来源于stack exchange，提问作者Smith