我在春天有一个使用spring安全性的Web应用程序,当我尝试执行它所说的应用程序时
This webpage has a redirect loop
这是我security-context.xml
之后添加此内容我得到此异常
<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns="http://www.springframework.org/schema/security"
xmlns:b="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<!-- HTTP security configurations -->
<http use-expressions="true">
<form-login login-processing-url="/resources/j_spring_security_check"
login-page="/login" authentication-failure-url="/login?login_error=t" />
<logout logout-url="/resources/j_spring_security_logout" />
<intercept-url pattern="/**" access="isAuthenticated()" />
<intercept-url pattern="/login*" access="permitAll()" />
<intercept-url pattern="/resources/**" access="permitAll()" />
</http>
<!-- Configure Authentication mechanism -->
<authentication-manager alias="authenticationManager">
<authentication-provider>
<user-service>
<user name="admin" password="admin" authorities="RIGHT_LIST,RIGHT_CANCEL,RIGHT_CREATE,RIGHT_UPDATE" />
<user name="antony" password="antony" authorities="RIGHT_LIST,RIGHT_CANCEL,RIGHT_CREATE,RIGHT_UPDATE" />
<user name="rod" password="rod" authorities="RIGHT_LIST,RIGHT_CREATE"/>
</user-service>
</authentication-provider>
</authentication-manager>
<global-method-security secured-annotations="enabled" pre-post-annotations="enabled">
<expression-handler ref="expHandler"/>
</global-method-security>
<b:bean id="expHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
<b:property name="permissionEvaluator">
<b:bean class="com.anto.springsec.security.CreateContactPermissionEvaluator"/>
</b:property>
</b:bean>
</b:beans>
我有一个login.jsp和另外一个createContact.jsp
这是我的家庭控制器:
package com.anto.springsec.controllers;
import java.text.DateFormat;
import java.util.Date;
import java.util.Locale;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
/**
* Handles requests for the application home page.
*/
@Controller
public class HomeController {
private static final Logger logger = LoggerFactory.getLogger(HomeController.class);
/**
* Simply selects the home view to render by returning its name.
*/
@RequestMapping(value = "/login", method = RequestMethod.GET)
public String home(Locale locale, Model model) {
logger.info("Welcome home! The client locale is {}.", locale);
Date date = new Date();
DateFormat dateFormat = DateFormat.getDateTimeInstance(DateFormat.LONG, DateFormat.LONG, locale);
String formattedDate = dateFormat.format(date);
model.addAttribute("serverTime", formattedDate );
return "login";
}
}
请帮我解决这个问题。
答案 0 :(得分:13)
我认为intercept-url
的顺序在这里很重要,而且/**
模式似乎也在吞噬/login
和/resources
。
试试这个: -
<http pattern="/resources/**" security="none"/>
<http pattern="/login" security="none"/>
<http use-expressions="true">
<form-login login-processing-url="/resources/j_spring_security_check"
login-page="/login" authentication-failure-url="/login?login_error=t" />
<logout logout-url="/resources/j_spring_security_logout" />
<intercept-url pattern="/**" access="isAuthenticated()" />
</http>
此配置与我现有的一个项目非常相似。
<强>更新强>
这是我目前在项目中使用的配置: -
<security:http pattern="/resources/**" security="none"/>
<security:http pattern="/login" security="none"/>
<security:http pattern="/error/**" security="none"/>
<security:http auto-config="true">
<security:form-login login-page="/login"
authentication-failure-url="/login?login_error=1"
default-target-url="/"
always-use-default-target="true"/>
<security:logout logout-success-url="/"/>
<security:intercept-url pattern="/**" access="ROLE_USER"/>
</security:http>
<强> 13年3月19日强>
要在security
代码中使用http
属性,您需要Spring Security 3.1 ...请参阅http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#new-3.1-ns
答案 1 :(得分:2)
试试这个
更改
<intercept-url pattern="/login*" access="permitAll()" />
到
<intercept-url pattern="/login*" access="IS_AUTHENTICATED_ANONYMOUSLY" />
或
<intercept-url pattern="/login*" access="isAnonymous()" />
如果你有表达式,我认为你必须使用isAnonymous()
intercept-url元素,表示匿名用户可以使用任何登录页面请求。否则,请求将与模式/ **匹配,并且无法访问登录页面本身!这是一个常见的配置错误,将导致应用程序中出现无限循环。 Read more from here