Question

我是春天安全的新手。我有两个用户角色，如Admin和Common Users。我想访问管理员用户访问的一些jsp，但问题是一旦用户注销，他/她仍然可以访问我在spring security config中限制的jsp页面。

让我知道我在这里做的是正确与否？

谢谢

spring_security.xml
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security.xsd">

    <http auto-config="true">
        <intercept-url pattern="/admin/**" access="ROLE_ADMIN" />
        <intercept-url pattern="/user/**" access="ROLE_USER" />

        <form-login login-page="/login" default-target-url="/welcome"
            authentication-failure-url="/loginfailed" />
        <logout logout-success-url="/logout" />
    </http>


    <beans:bean id="customUserDetailsService"
        class="com.nikunj.javabrains.services.CustomUserDetailsService"></beans:bean>

    <authentication-manager>
        <authentication-provider user-service-ref="customUserDetailsService">
        </authentication-provider>
    </authentication-manager>

// ------------------------------ 控制器

package com.nikunj.javabrains.controller;

import java.security.Principal;

import javax.servlet.http.HttpServletRequest;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.annotation.Secured;
import org.springframework.stereotype.Controller;
import org.springframework.ui.ModelMap;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;

import com.nikunj.javabrains.domain.User;
import com.nikunj.javabrains.services.UserService;

@Controller
public class UserController {

    @Autowired
    private UserService userService;

    @RequestMapping(value = "/welcome", method = RequestMethod.GET)
    public String printWelcome(ModelMap model, Principal principal,
            HttpServletRequest request) {

        String name = principal.getName(); // get logged in username
        model.addAttribute("username", name);
        model.addAttribute("message",
                "Spring Security login + database example");

        if (request.isUserInRole("ROLE_ADMIN")) {
            return "admin_page";
        }
        return "common_page";

    }

    @RequestMapping(value = "/login", method = RequestMethod.GET)
    public String login(ModelMap model) {

        return "login";

    }

    @RequestMapping(value = "/loginfailed", method = RequestMethod.GET)
    public String loginerror(ModelMap model) {

        model.addAttribute("error", "true");
        return "login";

    }

    @RequestMapping(value = "/logout", method = RequestMethod.GET)
    public String logout(ModelMap model) {

        return "login";

    }

    @RequestMapping("/regiPage")
    public String regiPage(@ModelAttribute("user") User user,
            BindingResult result) {

        return "registration";
    }

    @RequestMapping(value = "/saveUser", method = RequestMethod.POST)
    public String saveUserData(@ModelAttribute("user") User user,
            BindingResult result) {

        userService.addUser(user);
        return "login";

    }

}



    </beans:beans>

// ------------------------

CustomServiceClass

import com.nikunj.javabrains.dao.UserDao;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

@Service
@Transactional(readOnly=true)
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserDao userDAO;    

    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {

        com.nikunj.javabrains.domain.User domainUser = userDAO.getUser(username);

        boolean enabled = true;
        boolean accountNonExpired = true;
        boolean credentialsNonExpired = true;
        boolean accountNonLocked = true;

        System.out.println("*************************************");
        System.out.println(domainUser.getId());

        return new User(
                domainUser.getUsername(), 
                domainUser.getPassword(), 
                enabled, 
                accountNonExpired, 
                credentialsNonExpired, 
                accountNonLocked,
                getAuthorities(domainUser.getId())


        );



    }

    public Collection<? extends GrantedAuthority> getAuthorities(Integer role) {
        List<GrantedAuthority> authList = getGrantedAuthorities(getRoles(role));
        return authList;
    }

    public List<String> getRoles(Integer role) {

        List<String> roles = new ArrayList<String>();

        if (role.intValue() == 1) {
            roles.add("ROLE_ADMIN");
        } else {
            roles.add("ROLE_USER");
        }
        return roles;
    }

    public static List<GrantedAuthority> getGrantedAuthorities(List<String> roles) {
        List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();

        for (String role : roles) {
            authorities.add(new SimpleGrantedAuthority(role));
        }
        return authorities;
    }

}

// ---------------------------

@Controller
public class AdminController {

    @Autowired
    private UserService userService;

    @RequestMapping(value = "/admininput", method = RequestMethod.GET)
    public String login(ModelMap model) {
        System.out.println("*************************");
        return "admininputpage";
    }

}

Answer 1

好的，根据您上次的评论，每个人都在访问网址/admininput。

这是我期望的行为，因为没有为此URL模式定义安全规则。

在您的安全配置中，您可以定义以下规则：

<intercept-url pattern="/admin/**" access="ROLE_ADMIN" />
<intercept-url pattern="/user/**" access="ROLE_USER" />

此配置将要求所有具有URL模式/ admin / **的资源都使用角色ROLE_ADMIN登录，并且所有具有URL模式/ user / **的资源都将使用角色ROLE_USER登录。所有其他网址格式都是permitAll。

如果要限制该URL，则需要更改URL模式或添加拦截规则。 E.g。

将网址从/ admininput更改为/admin/input或/admin/admininput等

或者，添加显式拦截规则（或其他基于模式的规则）来覆盖此URL：

<intercept-url pattern="/admininput" access="ROLE_ADMIN" />

（虽然，对每个URL都有明确的拦截器规则不是一个好主意！所以最好在可能的情况下将URL更改为您已定义的约定）

Answer 2

您可以在注销后使用url .if destroy会话中的唯一会话ID或通过复制网址，在没有登录会话的登录URL的情况下无法访问URL。

Spring安全用户角色和访问jsp

2 个答案: