java-了解Spring Security中的allowAll()和anonymous()的区别

内容导读

互联网集市收集整理的这篇技术教程文章主要介绍了java-了解Spring Security中的allowAll()和anonymous()的区别，小编现在分享给大家，供广大互联网技能从业者学习和参考。文章包含1816字，纯文字阅读大概需要3分钟。

内容图文

我只想确保我正确地得到了这个信息,所以我会很感激您的答复.在我的configure-override中：

@Override
protected void configure(HttpSecurity http) throws Exception
{
    http.
        [...]
        permitAll()
        [...]
}

allowAll()允许任何请求,而：

anonymous()

将仅授予未登录用户的访问权限,但
在这两种情况下,默认情况下都会创建一个HttpSession对象.

那正确吗？

解决方法:

从春季documentation：

It’s generally considered good security practice to adopt a “deny-by-default” where you explicitly specify what is allowed and disallow everything else. Defining what is accessible to unauthenticated users is a similar situation, particularly for web applications. Many sites require that users must be authenticated for anything other than a few URLs (for example the home and login pages). In this case it is easiest to define access configuration attributes for these specific URLs rather than have for every secured resource. Put differently, sometimes it is nice to say ROLE_SOMETHING is required by default and only allow certain exceptions to this rule, such as for login, logout and home pages of an application. You could also omit these pages from the filter chain entirely, thus bypassing the access control checks, but this may be undesirable for other reasons, particularly if the pages behave differently for authenticated users.

This is what we mean by anonymous authentication.

和

Note that there is no real conceptual difference between a user who is “anonymously authenticated” and an unauthenticated user. Spring Security’s anonymous authentication just gives you a more convenient way to configure your access-control attributes.

使用.permitAll()将配置授权,以便在该特定路径上允许所有请求(来自匿名用户和登录用户).

.anonymous()表达式主要是指用户的状态(已登录或未登录).
基本上,直到用户被“认证”为止,它就是“匿名用户”.就像每个人都有“默认角色”一样.

内容总结

以上是互联网集市为您收集整理的java-了解Spring Security中的allowAll()和anonymous()的区别全部内容，希望文章能够帮你解决java-了解Spring Security中的allowAll()和anonymous()的区别所遇到的程序开发问题。 如果觉得互联网集市技术教程内容还不错，欢迎将互联网集市网站推荐给程序员好友。

内容备注

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 gblab@vip.qq.com 举报，一经查实，本站将立刻删除。

内容手机端