Java 仅允许使用 Spring Boot 3 从本地主机

发布于09月12日

我在Spring Boot 2中找到了一个允许请求的cookbook:

@Override
public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/**")
            .access("hasIpAddress('127.0.0.1') or hasIpAddress('::1') or isAuthenticated()")  // 127.0.0.1 and localhost do not need to authenticate on any url
            .anyRequest().authenticated()
            .and()
            .formLogin()
            .permitAll();
}

然而，我无法找到如何在Spring Boot3中实现它，在那里没有access个接受字符串的方法，我也没有找到相应的AuthorizationManager实现来做我需要的事情.

如何在Spring Boot3中只允许本地主机？

推荐答案

根据documentation

您应该这样做:

  @Bean
  public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

       ...
        IpAddressMatcher hasIpAddress = new IpAddressMatcher("127.0.0.1");
        
        request.authorizeHttpRequests(requestMatcherRegistry -> {
          requestMatcherRegistry.requestMatchers("/path/**").access(((authentication, object) ->
              new AuthorizationDecision(hasIpAddress.matches(object.getRequest()))
          ));
          requestMatcherRegistry.anyRequest().denyAll();
        });
    ...
    return request.build();