Question

尝试将Spring Security引入我的webapp时遇到问题。这是我的web.xml：

<welcome-file-list>
    <welcome-file>index.html</welcome-file>
</welcome-file-list>

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
        classpath:application-context.xml
        classpath:web-context.xml
        classpath:security-context.xml
    </param-value>
</context-param>

<context-param>
    <param-name>defaultHtmlEscape</param-name>
    <param-value>true</param-value>
</context-param>

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<listener>
    <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
</listener>

<servlet>
    <servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value></param-value>
    </init-param>
    <load-on-startup>2</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
    <url-pattern>/services/*</url-pattern>
</servlet-mapping>

<servlet-mapping>
    <servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
    <url-pattern>/admin</url-pattern>
</servlet-mapping>

<filter>
    <filter-name>encodingFilter</filter-name>
    <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
    <init-param>
        <param-name>encoding</param-name>
        <param-value>UTF-8</param-value>
    </init-param>
    <init-param>
        <param-name>forceEncoding</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>

<filter-mapping>
    <filter-name>encodingFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>

<session-config>
    <session-timeout>30</session-timeout>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

<!-- Spring Security config -->
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

security-context.xml：

<security:http auto-config='true'>
    <security:intercept-url pattern="/admin.html" />
    <security:http-basic />
</security:http>
<security:http pattern="/services/**" security="none" />
<security:authentication-manager>
    <security:authentication-provider>
        <security:user-service>
            <security:user name="admin" password="analyzer4321"
                authorities="ROLE_ADMIN" />
        </security:user-service>
    </security:authentication-provider>
</security:authentication-manager>

当我尝试运行服务器时，我在启动时遇到此异常：

java.lang.IllegalArgumentException: A universal match pattern ('/**')
is defined before other patterns in the filter chain, causing them to be ignored.
Please check the ordering in your <security:http> namespace or 
FilterChainProxy bean configuration.

我不知道我做错了什么。有什么建议吗？

Answer 1

security-context.xml文件中的此部分：

<security:http auto-config='true'>
    <security:intercept-url pattern="/admin.html" />
    <security:http-basic />
</security:http>

在此（第二个）之前处理（因为它们的顺序）：

<security:http pattern="/services/**" security="none" />

第一部分说明：限制对/admin.html的访问，并允许免费访问任何其他页面。

第二部分没用。它说：允许访问与/services/**匹配的所有页面。但第一部分已经允许这样做。

您可以删除第二部分，或将其放在第一部分之前。

有关使用多个<http>代码的详细信息，请参阅Spring Security Reference。

BTW，<intercept-url>标记通常具有access属性。我不确定<intercept-url>是否可以在没有access的情况下使用。有关详细信息，请参阅here。

Answer 2

Spring安全性占用的第一个模式来自pattern属性中的http标记。如果http标记中未声明pattern属性，则默认为<security:http pattern="/**"> intercept-url标签属性总是在第二位占用，即在de http模式标签之后。如果您有两个或更多的http标记，则应始终使用值声明pattern属性，以便不发生冲突

通用匹配模式（＆＃39; / **＆＃39;）在其他模式之前定义

2 个答案: