[SPRING] Spring Boot 401 Unauthorized 보안 기능 없음

Spring Boot 401 Unauthorized 보안 기능 없음

나는 Spring Security를 ​​사용하지 않았지만 인증을 요청하고있다.

URL에 대한 예외 (http : // localhost : 8080 / SpringJob / ExecuteJob) :

{
    "timestamp": 1500622875056,
    "status": 401,
    "error": "Unauthorized",
    "message": "Bad credentials",
    "path": "/SPPA/ExecuteSPPAJob"
}
----below log details
2017-07-21 13:15:35.210  INFO 19828 --- [nio-8080-exec-1] o.a.c.c.C.[Tomcat].[localhost].[/SpringJob]   : Initializing Spring FrameworkServlet 'dispatcherServlet'
2017-07-21 13:15:35.210 [http-nio-8080-exec-1] INFO 
                    o.a.c.c.C.[.[localhost].[/SpringJob]-Initializing Spring FrameworkServlet 'dispatcherServlet' 
2017-07-21 13:15:35.211  INFO 19828 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : FrameworkServlet 'dispatcherServlet': initialization started
2017-07-21 13:15:35.211 [http-nio-8080-exec-1] INFO 
                    o.s.web.servlet.DispatcherServlet-FrameworkServlet 'dispatcherServlet': initialization started 
2017-07-21 13:15:35.494  INFO 19828 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : FrameworkServlet 'dispatcherServlet': initialization completed in 282 ms
2017-07-21 13:15:35.494 [http-nio-8080-exec-1] INFO 
                    o.s.web.servlet.DispatcherServlet-FrameworkServlet 'dispatcherServlet': initialization completed in 282 ms 

application-dev.xml

#Spring Boot based configurations
management.security.enabled: "false"
spring.autoconfigure.exclude:  "org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration"
spring.batch.job.enabled: false
server.contextPath: /SpringJob

build.gradle snippet

plugins {
    id 'jacoco'
    id 'org.sonarqube' version '2.5'
}

apply plugin: 'java'
apply plugin: 'eclipse'
apply plugin: 'idea'
apply plugin: 'org.springframework.boot'
apply plugin: "no.nils.wsdl2java"
apply plugin: 'jacoco'
apply plugin: "org.sonarqube"
dependencies {
    compile("org.springframework.boot:spring-boot-starter-web")
    compile("org.springframework.boot:spring-boot-starter-batch")
    compile("org.springframework.boot:spring-boot-starter-mail")
    //compile("org.springframework.boot:spring-boot-devtools")
    compile group: 'org.apache.commons', name: 'commons-lang3', version: '3.5'
    compile group: 'org.apache.cxf', name: 'cxf-spring-boot-starter-jaxws', version: '3.1.10'
    compile group: 'org.apache.cxf', name: 'cxf-rt-ws-security', version: '3.1.10'
    compile("org.springframework.boot:spring-boot-starter-actuator")
    testCompile('org.springframework.boot:spring-boot-starter-test')
}

제어 장치

@Controller
@EnableAutoConfiguration
@EnableBatchProcessing
public class MyController {
    @Autowired
    JobLauncher jobLauncher;

    @RequestMapping("/ExecuteJob")
    @ResponseBody
    public String callPrelegalJob(@RequestParam("user") String userName, @RequestParam("password") String password) {
        log.info("Job is to be launched from controller...");
}
}

해결법

1. ==============================

   1.application.properties 파일에 아래 행을 추가하십시오.

   application.properties 파일에 아래 행을 추가하십시오.

   security.basic.enable: false
   security.ignored=/**
   

   스프링 박사에 따르면, security.ignored =

2. ==============================

   2.최신 버전의 Spring Boot (v2.1.0.RELEASE)에서 보안 문제를 제거하는 가장 쉬운 방법은 다음과 같이 "WebSecurityConfig.java"를 프로젝트에 추가하는 것입니다.

   최신 버전의 Spring Boot (v2.1.0.RELEASE)에서 보안 문제를 제거하는 가장 쉬운 방법은 다음과 같이 "WebSecurityConfig.java"를 프로젝트에 추가하는 것입니다.

   import org.springframework.context.annotation.Configuration;
   import org.springframework.security.config.annotation.web.builders.HttpSecurity;
   import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
   import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
   
   @EnableWebSecurity
   @Configuration
   public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
   
       @Override
       protected void configure(HttpSecurity http) throws Exception {
           http.csrf().disable();
       }
   
   }
   

   물론 이는 사이트 간 요청 위조에 대한 보호 기능을 제거하므로이 기능은 단순한 읽기 전용 끝점에만 적합합니다.

3. ==============================

   3.

       if we use CXF security & Spring boot security it gives this issues.
       Comment out dependency i.e disable the spring boot security then it allows.
   
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>      
        </dependency>
   
       to enable this we have to write custom security
   
   
   Or add below config
   
   @Configuration
   public class SecurityConfig extends WebSecurityConfigurerAdapter {
       @Override
       protected void configure(HttpSecurity http) throws Exception {
           http.authorizeRequests().anyRequest().permitAll();
       }
   }
   

4. ==============================

   4.인증을 사용하지 못하게하는 정확한 방법은 나를 찾을 수 없습니다. 그러나 작동중인 액추에이터 의존성을 제거하십시오.

   인증을 사용하지 못하게하는 정확한 방법은 나를 찾을 수 없습니다. 그러나 작동중인 액추에이터 의존성을 제거하십시오.

   compile("org.springframework.boot:spring-boot-starter-actuator")
   

from https://stackoverflow.com/questions/45232071/springboot-401-unauthorized-even-with-out-security by cc-by-sa and MIT license