Springcloud Gateway 整合 Spring Security 配置与踩坑

1. Security 配置与踩坑

由于 SpringCloud Gateway 基于WebFlux 并且不兼容SpringMVC，因此对于Security的配置方式也跟普通SpringBoot项目中的配置方式不同。

在Gateway项目中使用的WebFlux，是不能和Spring-Web混合使用的。

1.1 在Gateway中 Security 配置类不应该使用 @EnableWebSecurity 而是应该使用 @EnableWebFluxSecurity，并且配置方式也不同

1. 例如: 常见的配置方式 @EnableWebSecurity

     @EnableWebSecurity
      @EnableGlobalMethodSecurity(prePostEnabled = true) //启用方法级的权限认证
      public class SecurityConfig extends WebSecurityConfigurerAdapter {
      
          @Override
          protected void configure(HttpSecurity httpSecurity) throws Exception {
              ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry = httpSecurity
                      .authorizeRequests();
              registry.antMatchers(HttpMethod.OPTIONS)
                      .permitAll();
              // 任何请求需要身份认证
              registry.antMatchers("/**").permitAll()
                      .and().csrf().disable();
      
          }
      }
   

2. 例如：在Gateway中应该使用 WebFlux 的配置方式

   @EnableWebSecurity
   @EnableWebFluxSecurity
   @EnableGlobalMethodSecurity(prePostEnabled = true) 
   public class SecurityConfig2 {
   
       /**
        * 配置方式要换成 WebFlux的方式
        */
       @Bean
       public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity httpSecurity) {
           httpSecurity
                   .authorizeExchange().pathMatchers(HttpMethod.OPTIONS).permitAll()
                       // 任何请求需要身份认证
                   .pathMatchers("/**").permitAll().and()
                   .csrf().disable();
           return httpSecurity.build();
       }
   }
   
   

1.2 Gateway 中导入 spring-boot-starter-web 也会报错

1. 报错信息如下：

    **********************************************************
   
       Spring MVC found on classpath, which is incompatible with Spring Cloud Gateway at this time. Please remove spring-boot-starter-web dependency.
   
       **********************************************************
   
           
       ***************************
       APPLICATION FAILED TO START
       ***************************
   
       Description:
   
       Parameter 0 of method modifyRequestBodyGatewayFilterFactory in org.springframework.cloud.gateway.config.GatewayAutoConfiguration required a bean of type 'org.springframework.http.codec.ServerCodecConfigurer' that could not be found.
   
   
       Action:
   
       Consider defining a bean of type 'org.springframework.http.codec.ServerCodecConfigurer' in your configuration.
   
   
       Process finished with exit code 1
   

2. 解决方案

1.3. 附： pom.xml 示例

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0modelVersion>
    <parent>
        <groupId>org.springframework.bootgroupId>
        <artifactId>spring-boot-starter-parentartifactId>
        <version>2.3.2.RELEASEversion>
        <relativePath/> 
    parent>
    
    <groupId>com.test.examplegroupId>
    <artifactId>gatewayartifactId>
    <version>0.0.1-SNAPSHOTversion>
    <name>gatewayname>
    
    <description>Demo project for Spring Bootdescription>
    <properties>
        <java.version>1.8java.version>
        <spring-cloud.version>Hoxton.SR6spring-cloud.version>
    properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.cloudgroupId>
            <artifactId>spring-cloud-starter-gatewayartifactId>
        dependency>

        <dependency>
            <groupId>org.springframework.bootgroupId>
            <artifactId>spring-boot-starter-securityartifactId>
        dependency>


        <dependency>
            <groupId>org.springframework.bootgroupId>
            <artifactId>spring-boot-starter-testartifactId>
            <scope>testscope>
            <exclusions>
                <exclusion>
                    <groupId>org.junit.vintagegroupId>
                    <artifactId>junit-vintage-engineartifactId>
                exclusion>
            exclusions>
        dependency>
    dependencies>
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.cloudgroupId>
                <artifactId>spring-cloud-dependenciesartifactId>
                <version>${spring-cloud.version}version>
                <type>pomtype>
                <scope>importscope>
            dependency>
        dependencies>
    dependencyManagement>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.bootgroupId>
                <artifactId>spring-boot-maven-pluginartifactId>
            plugin>
        plugins>
    build>

project>