Question

使用基于GWT的Web应用程序实现spring security。我找到。除了以下事实外，一切都按预期正常工作：

我打开了login.jsp并提供了有效的用户登录凭据。提交后，它成功重定向到主页。现在，当我在地址栏中编辑login.jsp的URL时......令人惊讶的是它允许打开我的login.jsp，但据我所知...它不应该允许返回login.jsp直到＆amp;除非我已登录。

可能是我的security-context.xml文件配置不正确。

下面是我的security-application-context.xml

<?xml version="1.0" encoding="UTF-8"?>

<!-- - Sample namespace-based configuration - -->

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
                        http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
                        http://www.springframework.org/schema/security
                        http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">

    <global-method-security secured-annotations="enabled">
    </global-method-security>

    <beans:bean id="customAuthenticationProcessingFilter"
        class="edu.authentication.CustomAuthenticationProcessingFilter">
        <custom-filter position="AUTHENTICATION_PROCESSING_FILTER" />
        <beans:property name="defaultTargetUrl" value="/Home.html?gwt.codesvr=127.0.0.1:9997" />
        <beans:property name="authenticationFailureUrl" value="/login.jsp?login_error=1" /> 
        <beans:property name="authenticationManager" ref="authenticationManager" />
    </beans:bean>

    <beans:bean id="authenticationProcessingFilterEntryPoint"
        class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
        <beans:property name="loginFormUrl" value="/login.jsp" />
        <beans:property name="forceHttps" value="false" />
    </beans:bean>

    <beans:bean id="customUserDetailsService"
        class="edu.authentication.CustomUserDetailsService">
        <beans:property name="urmService" ref="urmService" />
    </beans:bean>

    <http auto-config="false" entry-point-ref="authenticationProcessingFilterEntryPoint">

    <intercept-url pattern="/login.jsp*" filters="none" />
        <intercept-url pattern="/forgot_password.jsp*" filters="none" />
        <intercept-url pattern="/forgotPasswordServlet.do*" filters="none" />

    <intercept-url pattern="/myApp/**" access="IS_AUTHENTICATED_FULLY"/>
        <intercept-url pattern="/gwt/**" access="IS_AUTHENTICATED_FULLY"/>
        <intercept-url pattern="/*.html" access="IS_AUTHENTICATED_FULLY"/>

    <logout logout-url="/j_spring_security_logout"
            invalidate-session="true" logout-success-url="/login.jsp?loggedout=true"/>
    </http>

    <authentication-manager alias="authenticationManager" />

    <authentication-provider user-service-ref="customUserDetailsService">
        <password-encoder hash="md5" />
    </authentication-provider>

</beans:beans>

任何帮助/建议都会非常适合..

Answer 1

Spring Security中没有内容阻止您在登录后查看登录页面。您可以通过在登录页面顶部添加以下代码来阻止登录用户登录页面。

<%@ taglib prefix='sec' uri='http://www.springframework.org/security/tags' %>
<sec:authorize ifNotGranted="ROLE_ANONYMOUS">
  <% response.sendRedirect("/mainpage.jsp"); %>
</sec:authorize>

逻辑是，如果用户未登录，则Spring Security将为他们创建一个匿名身份验证对象，并为他们提供ROLE_ANONYMOUS角色。因此，您只需检查用户是否具有该角色，如果不是，您可以假设他们已登录并将其重定向到应用程序的主页面。

Answer 2

或者，您可以创建Servlet过滤器：

public class LoginPageFilter implements Filter
{
   public void init(FilterConfig filterConfig) throws ServletException   {
   }

   public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,   FilterChain filterChain) throws IOException, ServletException
   {
       HttpServletRequest request = (HttpServletRequest) servletRequest;
       HttpServletResponse response = (HttpServletResponse) servletResponse;

       if(request.getUserPrincipal() != null){ //If user is already authenticated
           response.sendRedirect("");// or, forward using RequestDispatcher
       } else{
           filterChain.doFilter(servletRequest, servletResponse);
       }
   }

   public void destroy() {
   }
}

的web.xml：

LoginPageFilter com.xxx.xx.LoginPageFilter

<filter-mapping>
    <filter-name>LoginPageFilter</filter-name>
    <url-pattern>/login</url-pattern>
</filter-mapping>

已登录用户的Spring安全重定向问题

2 个答案: