Question

我正在尝试添加安全性配置，以允许访问现有应用程序的不同角色。该应用程序现在正在运行一个登录页面，该页面在数据库中搜索登录名和密码，并提供对每种角色的访问权限，但是现在我想限制某些角色对某些页面的访问。

我创建了一个新类WebSecurityConfig，它从WebSecurityConfigurerAdapter开始扩展：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/**").permitAll()
                .antMatchers("/css/**","/js/**","/img/**","/html/**").permitAll()
                .antMatchers("/webjars/**").permitAll()
                .antMatchers("/ws/**").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login").passwordParameter("pwd").usernameParameter("login")
                .permitAll()
            .and()
                .logout()
                .permitAll();          
    }
}

我试图在限制页面之前使用该代码运行应用程序，但是它不起作用，我也不知道为什么。我想我缺少了一些东西，但找不到解决方法。

谢谢。

这是控制台输出。

DEBUG o.a.c.http11.InternalNioInputBuffer - Received [POST /login HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Content-Length: 57
Cache-Control: max-age=0
Origin: http://localhost:8080
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Referer: http://localhost:8080/
Accept-Encoding: gzip, deflate, br
Accept-Language: es-ES,es;q=0.9
Cookie: JSESSIONID=84EB0B71EBA3D1A8646BD85AC97B2FA4; JSESSIONID=86BB75F3F05FF03573FBDA095231E676

login=1&pwd=11&_csrf=540de3b5-7baa-4720-ac37-968e1317a777]
DEBUG o.a.catalina.connector.CoyoteAdapter - The variable [uriBC] has value [/login]
DEBUG o.a.catalina.connector.CoyoteAdapter - The variable [semicolon] has value [-1]
DEBUG o.a.catalina.connector.CoyoteAdapter - The variable [enc] has value [utf-8]
DEBUG o.a.t.u.http.LegacyCookieProcessor - Cookies: Parsing b[]: JSESSIONID=84EB0B71EBA3D1A8646BD85AC97B2FA4; JSESSIONID=86BB75F3F05FF03573FBDA095231E676
DEBUG o.a.catalina.connector.CoyoteAdapter -  Requested cookie session id is 84EB0B71EBA3D1A8646BD85AC97B2FA4
DEBUG o.a.c.a.AuthenticatorBase - Security checking request POST /login
DEBUG org.apache.catalina.realm.RealmBase -   No applicable constraints defined
DEBUG o.a.c.a.AuthenticatorBase -  Not subject to any constraint
DEBUG o.apache.tomcat.util.http.Parameters - Set encoding to UTF-8
DEBUG o.apache.tomcat.util.http.Parameters - Start processing with input [login=1&pwd=11&_csrf=540de3b5-7baa-4720-ac37-968e1317a777]
DEBUG o.s.b.w.f.OrderedRequestContextFilter - Bound request context to thread: org.apache.catalina.connector.RequestFacade@e3f1c10
DEBUG o.s.c.s.ReloadableResourceBundleMessageSource - Loading properties [messages.properties] with encoding 'UTF-8'
DEBUG o.s.c.s.ReloadableResourceBundleMessageSource - No properties file found for [classpath:messages_es] - neither plain properties nor XML
DEBUG o.s.c.s.ReloadableResourceBundleMessageSource - No properties file found for [classpath:messages_es_ES] - neither plain properties nor XML
DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'delegatingApplicationListener'
DEBUG o.s.b.w.f.OrderedRequestContextFilter - Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade@e3f1c10
DEBUG o.a.c.http11.InternalNioInputBuffer - Received [GET /login?error HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Referer: http://localhost:8080/
Accept-Encoding: gzip, deflate, br
Accept-Language: es-ES,es;q=0.9
Cookie: JSESSIONID=84EB0B71EBA3D1A8646BD85AC97B2FA4; JSESSIONID=86BB75F3F05FF03573FBDA095231E676

]

Answer 1

已解决。我只需要一个CustomUserDetailService类。

谢谢。

在现有的Spring Boot应用程序中添加安全配置时出错

1 个答案: