我正在运行Spring Web和安全3.1。我需要从安全区域内的安全区域下载另一个本地页面。给出以下代码:
@Controller
@RequestMapping("/secure")
public class SecureArea {
@RequestMapping("/downloadMe.xhtml")
public String downloadMe(HttpServletRequest request, HttpServletResponse response) throws Exception {
// do stuff
return "myJsp";
}
@RequestMapping("/viewStuff")
public void viewStuff(HttpServletRequest request, HttpServletResponse response) throws Exception {
InputStream in = (new URL("http://"+request.getServerName()+":"+request.getServerPort()+"/secure/downloadMe.xhtml").openStream());
// read the input stream and do stuff with it, obviously returns my 401 page
}
}
由于spring安全性,viewStuff方法无法看到/downloadMe.xhtml页面。有什么方法可以将我的请求中的安全凭证放入新请求并下载downloadMe.xhtml。
* 必须以这种方式或具有相同结果的类似方式完成。我不能只调用downloadMe(请求,响应)。我需要从myJsp返回的数据以及随附的所有逻辑。
答案 0 :(得分:1)
解决了我自己的问题!我能够通过在我的请求中将JSESSIONID作为cookie传递来实现这一点。所以从我的问题代码开始,它看起来像这样:
@Controller
@RequestMapping("/secure")
public class SecureArea {
@RequestMapping("/downloadMe.xhtml")
public String downloadMe(HttpServletRequest request, HttpServletResponse response) throws Exception {
// do stuff
return "myJsp";
}
@RequestMapping("/viewStuff")
public void viewStuff(HttpServletRequest request, HttpServletResponse response) throws Exception {
URL url = new URL("http://"+request.getServerName()+":"+request.getServerPort()+"/secure/downloadMe.xhtml");
URLConnection con = url.openConnection();
con.setDoOutput(true);
// attach the session ID in the request
con.setRequestProperty("Cookie", "JSESSIONID="+request.getSession().getId());
con.connect();
InputStream in = con.getInputStream();
// read the input stream and do stuff with it, obviously returns my 401 page
}
}