Spring Boot+Spring Security配置异常：permitAll与addFilter失效求助

Alright, let's break down why your /users/register endpoint is getting stuck behind the JWT filter when it should be wide open. This is a common pitfall with Spring Security's filter chain ordering and path matching—here's how to fix it step by step.

1. Correct Your SecurityFilterChain Setup #

The core issue is likely that your security rules aren't properly excluding /users/register from authentication checks, or the JWT filter is being applied globally instead of selectively. Let's start with the main SecurityFilterChain bean, which controls all your access rules and filter ordering:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        // Disable CSRF if you're building a stateless API (common for JWT setups)
        .csrf(csrf -> csrf.disable())
        // Define request authorization rules—order matters here!
        .authorizeHttpRequests(auth -> auth
            // Let anyone hit the register endpoint without any filters
            .requestMatchers("/users/register").permitAll()
            // Allow unauthenticated access to login for credential checking
            .requestMatchers("/login").permitAll()
            // All other endpoints require a valid authenticated user
            .anyRequest().authenticated()
        )
        // Add your LoginFilter to handle /login requests
        .addFilterBefore(loginFilter(), UsernamePasswordAuthenticationFilter.class)
        // Add JWT filter ONLY for endpoints that need authorization
        .addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    
    return http.build();
}

Key Notes Here: #

• Order of Rules: Always put specific path rules (like /users/register) before general ones (like anyRequest()). Spring Security matches rules top to bottom, so if you put anyRequest() first, it'll override your permitAll rules.
• Filter Placement: Using addFilterBefore ensures your custom filters run in the right order relative to Spring's built-in filters.

2. Stop the JWT Filter from Intercepting Excluded Paths #

If your JWTAuthenticationFilter is annotated with @Component, it might be registered as a global filter (intercepting every request) instead of just being part of the security chain. Fix this with one of two approaches:

Option A: Use FilterRegistrationBean to Exclude Paths #

This lets you explicitly tell the filter which paths to ignore:

@Bean
public FilterRegistrationBean<JWTAuthenticationFilter> jwtFilterRegistration(JWTAuthenticationFilter jwtFilter) {
    FilterRegistrationBean<JWTAuthenticationFilter> registration = new FilterRegistrationBean<>(jwtFilter);
    // Apply to all paths except register and login
    registration.addUrlPatterns("/*");
    registration.addExcludeUrlPatterns("/users/register", "/login");
    return registration;
}

Option B: Skip Paths Inside the Filter #

If you prefer to handle it directly in the filter code, add a check at the start of doFilterInternal:

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    String requestPath = request.getRequestURI();
    
    // Bypass JWT check for register and login endpoints
    if ("/users/register".equals(requestPath) || "/login".equals(requestPath)) {
        filterChain.doFilter(request, response);
        return;
    }
    
    // Your existing JWT validation logic goes here
    // ...
}

3. Common Mistakes to Check #

• Global Filter Registration: If you have @Component on your JWTAuthenticationFilter but don't use FilterRegistrationBean to exclude paths, it'll run for every request—even the ones you want to skip. Either remove @Component (and only add it via the security chain) or use the registration bean.
• Path Matching Typos: Double-check that your path in the config matches exactly what's being requested. For example, if your endpoint is /users/register/ (with a trailing slash) but your config uses /users/register, the rule won't match. Use requestMatchers("/users/register/**") to cover subpaths if needed.
• CSRF Configuration: If you're not disabling CSRF for stateless APIs, it might block POST requests to /users/register—make sure to disable it if you're using JWT.

Test It Out #

Once you've updated the config, fire up your app and test:

• Hit /users/register with a POST request—you should get a response without any JWT-related errors.
• Test /login with valid credentials—your LoginFilter should process it as expected.
• Try accessing a protected endpoint (like /users/me) without a JWT—you should get an unauthorized response from the JWT filter.

内容的提问来源于stack exchange，提问作者Selva