我有Spring MVC + Spring Security项目。
<http auto-config="true" access-denied-page="/security/accessDenied" use-expressions="true" disable-url-rewriting="true">
...
<intercept-url pattern="/dashboard/myaccount/**" access="hasAnyRole('ROLE_PERSON', 'ROLE_DEALER')"/>
...
<form-login login-page="/security/login" authentication-failure-url="/security/login?error=true"
default-target-url="/security/success" username-parameter="email"
password-parameter="secret"/>
<logout invalidate-session="true" logout-success-url="/index" logout-url="/security/logout"/>
如果用户进入登录页面,如果成功将被重定向到“/ security / success”,我在控制器中用会话对象(记录用户ID,......等)做更多的事情
我的问题是当一个GUEST用户要去/ dashboard / myaccount(需要AUTH)时,他被重定向到LOGIN页面(我不想要,我更喜欢抛出404)。之后Spring Security没有重定向到/ security / success。而是重定向到/ dashboard / myaccount。
如果GUEST尝试访问AUTH页面,我宁愿找到一种方法来完全禁用此重定向到登录页面。
有办法吗?
TNX
答案 0 :(得分:13)
我们添加了一个新的authenticationEntryPoint:
<http auto-config="true" access-denied-page="/security/accessDenied" use-expressions="true"
disable-url-rewriting="true" entry-point-ref="authenticationEntryPoint"/>
<beans:bean id="authenticationEntryPoint" class="a.b.c..AuthenticationEntryPoint">
<beans:constructor-arg name="loginUrl" value="/security/login"/>
</beans:bean>
public class AuthenticationEntryPoint extends LoginUrlAuthenticationEntryPoint {
public AuthenticationEntryPoint(String loginUrl) {
super(loginUrl);
}
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
response.sendError(403, "Forbidden");
}
}
答案 1 :(得分:5)
发现:always-use-default-target =“true”
我这样,我的控制器功能总是在任何登录后被调用。
答案 2 :(得分:4)
在SpringSecurity 4的带注释配置中,您可以执行以下操作:
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
// ....
http.exceptionHandling().authenticationEntryPoint(new AuthenticationEntryPoint() {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response,
AuthenticationException authException) throws IOException, ServletException {
if (authException != null) {
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
response.getWriter().print("Unauthorizated....");
}
}
});
// ....
}
}