在 Spring Security 中禁用匿名时，所有 url 都会自动发出 403

有一个使用Spring Security的Spring Boot项目。

授权过程通过会话，成功授权后，应用程序保存cookie信息。
对于/login并且/logout我将 url 访问设置为permitAll，并将 url 的其余部分绘制为已验证。

当用户在未经授权的情况下敲击安全 url 时，它表示anonymousUser正在运行。
调试时，很明显，如果Spring Security没有收到来自授权用户的请求，那么它会自动替换为anonymousUser。

作为Spring Security Configuration中的一个解决方案，我关闭了http.build匿名访问 ( anonymous.disable())，但是这样我的所有 url，包括那些，/login都/logout属于403 Forbidden.

怎么回事？如何解决问题？

@Configuration
@EnableWebSecurity
public class SecurityConfiguration {

    public static final String SESSION_ATTRIBUTE = "JSESSIONID";

    @Bean
    public SessionRegistry sessionRegistry() {
        return new SessionRegistryImpl();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration)
            throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }

    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return (web) -> web.ignoring()
                .antMatchers("/v3/api-docs/**")
                .antMatchers("configuration/**")
                .antMatchers("/swagger*/**")
                .antMatchers("/webjars/**")
                .antMatchers("/swagger-ui/**");
    }

    @Bean
    public CorsConfiguration corsConfiguration() {
        CorsConfiguration corsConfiguration = new CorsConfiguration();
        corsConfiguration.setAllowCredentials(true);
        corsConfiguration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
        corsConfiguration.setAllowedOriginPatterns(List.of("*:[*]"));
        corsConfiguration.setAllowedHeaders(List.of("*"));
        corsConfiguration.setExposedHeaders(List.of("*"));
        corsConfiguration.setMaxAge(1000L);
        return corsConfiguration;
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .cors().configurationSource(cors -> corsConfiguration()).and()
                .csrf().disable()
                .anonymous().disable()
                .httpBasic().disable()
                .logout().invalidateHttpSession(true).deleteCookies(SESSION_ATTRIBUTE)
                .and()
                .authorizeRequests()
                .antMatchers("/api/authentication/login", "/api/authentication/logout").permitAll()
                .antMatchers("/api/file/*", "/api/report/*", "/api/user/information/*").authenticated();

        return http.build();
    }
}

构建.gradle：

dependencies {
    implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: '2.7.2'
    implementation group: 'org.springframework.boot', name: 'spring-boot-starter-jdbc', version: '2.7.2'
    implementation group: 'org.springframework.boot', name: 'spring-boot-starter-security', version: '2.7.2'
    implementation group: 'org.springframework.boot', name: 'spring-boot-starter-validation', version: '2.7.2'

    implementation group: 'com.microsoft.sqlserver', name: 'mssql-jdbc', version: '9.4.1.jre16'

    implementation group: 'org.json', name: 'json', version: '20220320'

    implementation group: 'org.springdoc', name: 'springdoc-openapi-ui', version: '1.6.10'

    implementation group: 'javax.xml.bind', name: 'jaxb-api', version: '2.3.1'

    compileOnly 'org.projectlombok:lombok:1.18.24'

    annotationProcessor 'org.projectlombok:lombok:1.18.24'
}