您好我正在尝试在我的应用程序上配置Spring安全性。但是一旦我输入用户名和密码并提交表单,我就会收到错误
HTTP Status 404 - /j_spring_security_check The requested resource is not available.
以下是我的配置文件:
的web.xml
<filter-mapping>
<filter-name>CharacterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/applicationContext.xml,/WEB-INF/taskTracker-app.xml,/WEB-INF/taskTracker-servlet.xml,/WEB-INF/taskTracker-security.xml</param-value>
</context-param>
<servlet>
<servlet-name>taskTracker</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<load-on-startup>2</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>taskTracker</servlet-name>
<url-pattern>*.html</url-pattern>
</servlet-mapping>
的TaskTracker-servlet.xml中
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tx="http://www.springframework.org/schema/tx"
xmlns:aop="http://www.springframework.org/schema/aop" xmlns:dwr="http://www.directwebremoting.org/schema/spring-dwr"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/aop
http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
http://www.springframework.org/schema/tx
http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
http://www.directwebremoting.org/schema/spring-dwr
http://www.directwebremoting.org/schema/spring-dwr-2.0.xsd">
<bean id="TaskTrackerLoginController"
class="org.springframework.web.servlet.mvc.ParameterizableViewController">
<property name="viewName">
<value>/taskTracker/sign-in</value>
</property>
</bean>
<bean id="TaskTrackerErrorController"
class="org.springframework.web.servlet.mvc.ParameterizableViewController">
<property name="viewName">
<value>/taskTracker/error</value>
</property>
</bean>
<bean id="WelcomeController" class="com.tracker.web.controllers.WelcomeController">
<property name="BusinessLogic">
<ref bean="BusinessLogic" />
</property>
<property name="viewName">
<value>/taskTracker/welcome</value>
</property>
</bean>
<bean id="nonSecurePageMappings"
class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">
<property name="mappings">
<props>
<prop key="/taskTracker/sign-in.html">TaskTrackerLoginController</prop>
<prop key="/taskTracker/error.html">TaskTrackerErrorController</prop>
</props>
</property>
</bean>
<bean id="PageMappings"
class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">
<property name="mappings">
<props>
<prop key="/taskTracker/welcome.html">WelcomeController</prop>
</props>
</property>
</bean>
<bean id="viewResolver"
class="org.springframework.web.servlet.view.InternalResourceViewResolver">
<property name="viewClass">
<value>org.springframework.web.servlet.view.JstlView</value>
</property>
<property name="prefix">
<value>/WEB-INF/jsp/</value>
</property>
<property name="suffix">
<value>.jsp</value>
</property>
</bean>
</beans>
的TaskTracker-security.xml文件
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<bean id="SecurityService" class="com.tracker.web.security.SecurityService">
<property name="BusinessLogic">
<ref bean="BusinessLogic" />
</property>
</bean>
<security:http access-denied-page="/taskTracker/tracker/error.html" auto-config="false">
<security:session-management invalid-session-url="/taskTracker/sign-in.html">
</security:session-management>
<security:form-login login-page="/taskTracker/sign-in.html" default-target-url="/taskTracker/welcome.html"
always-use-default-target="false" authentication-failure-url="/taskTracker/sign-in.html?error=1" />
<security:logout invalidate-session="true" logout-success-url="/taskTracker/sign-in.html" />
<security:intercept-url pattern="/taskTracker/sign-in.html*" filters="none" />
<security:intercept-url pattern="/taskTracker/welcome.html*" />
</security:http>
<security:authentication-manager>
<security:authentication-provider user-service-ref="SecurityService" />
</security:authentication-manager>
</beans>
的TaskTracker-app.xml中
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tx="http://www.springframework.org/schema/tx"
xmlns:aop="http://www.springframework.org/schema/aop" xmlns:dwr="http://www.directwebremoting.org/schema/spring-dwr"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/aop
http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
http://www.springframework.org/schema/tx
http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
http://www.directwebremoting.org/schema/spring-dwr
http://www.directwebremoting.org/schema/spring-dwr-2.0.xsd">
<bean id="userDao" class="com.tracker.data.dao.jdbc.UserJdbcDao">
<property name="dataSource">
<ref bean="dataSource" />
</property>
</bean>
<bean id="BusinessLogic" class="com.tracker.business.logic.TrackerBusinessLogicImpl">
<property name="userLogic">
<ref bean="userLogic" />
</property>
</bean>
<bean id="userLogic" class="com.tracker.business.logic.user.UserLogic">
<property name="userDao">
<ref bean="userDao" />
</property>
</bean>
</beans>
SecurityService.java
package com.tracker.web.security;
import org.apache.log4j.Logger;
import org.springframework.dao.DataAccessException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import com.tracker.business.logic.TrackerBusinessLogic;
import com.tracker.business.model.User;
public class SecurityService implements UserDetailsService {
private final static Logger log = Logger.getLogger(SecurityService.class);
private TrackerBusinessLogic trackerBusinessLogic;
public UserDetails loadUserByUsername(String username)
throws UsernameNotFoundException, DataAccessException {
String errMsg = "User with username: " + username;
User user = trackerBusinessLogic.loadUser(username);
if(user!=null) {
// user has been loaded
} else {
log.error("User with username: " + username + " not found");
}
return user;
}
public TrackerBusinessLogic getBusinessLogic() {
return trackerBusinessLogic;
}
public void setBusinessLogic(TrackerBusinessLogic trackerBusinessLogic) {
this.trackerBusinessLogic = trackerBusinessLogic;
}
}
登录-in.jsp
<html lang="en-US">
<head>
<title>Login</title>
</head>
<body>
<div class="login">
<h1>Task Tracker Login</h1>
<form action="/j_spring_security_check" method="post">
<input type="text" name="j_username" value="" placeholder="Username" required="required" />
<input type="password" name="j_password" placeholder="Password" required="required" />
<input type="hidden" name="referrer" value="${param.referrer}" />
<input type="submit" value="Let me in." class="btn btn-primary btn-block btn-large">
</form>
</div>
</body>
</html>
请帮助我,我在这里缺少什么。谢谢。
答案 0 :(得分:8)
在您的sign-in.jsp
中,您需要更改您要提交登录请求的URL
,您可以按以下方式更改:
<c:url value="/j_spring_security_check" var="loginUrl" />
并在表单操作中使用它:
<form action="${loginUrl}" method="post">
login-processing-url
属性默认为/j_spring_security_check
,并指定登录表单(应包括username
和password
)应提交的网址,使用HTTP帖子。
答案 1 :(得分:2)
我在/ j_spring_security_check
之前添加$ {request.contextPath}时修复了该错误答案 2 :(得分:2)
与此特定问题无关(但与“j_spring_security_check 404”问题有关)。认为它可能有助于任何人尝试用弹簧4解决相同的问题,即使所有设置都是正确的。
从Spring 4开始,spring默认启用了csrf,因此首先检查csrf是否已禁用,如果这解决了“j_spring_security_check 404”问题。
<http>
<!-- ... -->
<csrf disabled="true"/>
</http>
这仅用于测试,如果它确实有效,则再次启用它,因为这些天禁用csrf对于web-app来说不是一个好主意。所以删除
<csrf disabled="true" />
line(默认情况下启用'coz crsf),并在您的身份验证输入表单中添加一个csrf令牌字段:
<form action="${loginUrl}" method="post">
<input ... />
<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
</form>
OR
<form action="${loginUrl}?${_csrf.parameterName}=${_csrf.token}" method="post"> .... </form>