仅仅存在一个空的
WebSecurityConfigurerAdapter
就会破坏我的应用程序的OAuth2功能。$ curl -i -X POST -H "Content-Type: application/json" -H "Authorization: Bearer 27f9e2b7-4441-4c03-acdb-7e7dc358f783" -d '{"apiKey": "key", "tag": "tag"}' localhost:8080/isTagAvailable
HTTP/1.1 302
Location: http://localhost:8080/error
当我期望时
$ curl -i -X POST -H "Content-Type: application/json" -H "Authorization: Bearer 27f9e2b7-4441-4c03-acdb-7e7dc358f783" -d '{"apiKey": "key", "tag": "tag"}' localhost:8080/isTagAvailable
HTTP/1.1 401
{"error":"invalid_token","error_description":"Invalid access token: 27f9e2b7-4441-4c03-acdb-7e7dc358f783"}
为了让Oauth2起作用,我必须注释掉整个类。即使只注释掉configure
方法也不起作用。为什么?
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/robots.txt").permitAll()
.and()
.authorizeRequests()
.antMatchers("/isTagAvailable").hasRole("USER")
// .anyRequest().authenticated()
.and()
.httpBasic().disable();
}
}