Question

我正在阅读官方的春季文档示例：

在没有它的情况下向应用程序添加spring安全性：http://docs.spring.io/spring-security/site/docs/3.2.x/guides/helloworld.html

创建自定义登录 http://docs.spring.io/spring-security/site/docs/3.2.x/guides/form.html

并成功为我的应用添加了安全性。但是，当我去添加自定义登录时，文档会讨论依赖关系“因为我们的项目将messages-jc项目添加为依赖项......”所以我将其添加到我的pom中。由于我添加了它，它会抛出一个错误，如下所示。

如果我排除我的SecurityWebApplicationInitializer然后运行应用程序，我可以删除此错误，但是系统没有正确地重定向到登录页面，并且登录页面无法正常工作（我使用th：if和none if if语句工作就像所有if语句都是真的一样，即使我说：if =“false”）。如果我删除了jc-messages依赖项，那么它会正确重定向，但登录页面仍然无法正常工作并尝试登录会引发invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN错误。

似乎安全类被多次注册时会触发错误，但是当我拿走SecurityWebApplicationInitializer时，没有任何东西正在注册该类。我觉得有一些基本的东西我缺少，因为我遵循一个简单的教程，但我无法弄清楚它是什么。除了是一个春天的问题，我唯一能想到的另一件事就是Thymeleaf出了问题，这使得登录页面无法正常工作。

感谢任何帮助！

SecurityWebApplicationInitializer.java

public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {

    public SecurityWebApplicationInitializer() {
        super(SecurityConfig.class);
    }
}

pom.xml 注释掉其他依赖项以隔离springframework依赖性问题

<dependencies>
        <!-- ... other dependency elements ... -->
    <!--    <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>3.2.4.RELEASE</version>
        </dependency> -->
    <!-- <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>3.2.4.RELEASE</version>
        </dependency> -->
     <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-samples-messages-jc</artifactId>
            <version>3.2.4.RELEASE</version>
            <scope>compile</scope>
        </dependency> 
        <dependency>
            <groupId>jstl</groupId>
            <artifactId>jstl</artifactId>
            <version>1.2</version>
        </dependency>
    </dependencies>

SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
              .antMatchers("/res/**").permitAll()
              .anyRequest().authenticated()
              .and()
            .formLogin()
              .loginPage("/loginSpring.html")
              .permitAll();
    }
}

loginSpring.html

<html xmlns:th="http://www.thymeleaf.org" xmlns:tiles="http://www.thymeleaf.org">
  <head>
    <title tiles:fragment="title">Messages : Create</title>
  </head>
  <body>
    <div tiles:fragment="content">
        <form name="f" th:action="@{/login}" method="post">               
            <fieldset>
                <legend>Please Login</legend>
                <div th:if="${param.error}" class="alert alert-error">    
                    Invalid username and password.
                </div>
                <div th:if="${param.logout}" class="alert alert-success"> 
                    You have been logged out.
                </div>
                <label for="username">Username</label>
                <input type="text" id="username" name="username"/>        
                <label for="password">Password</label>
                <input type="password" id="password" name="password"/>
                <div class="form-actions">
                    <button type="submit" class="btn">Log in</button>
                </div>
            </fieldset>
        </form>
    </div>
  </body>
</html>

堆栈跟踪

java.lang.IllegalStateException: Cannot initialize context because there is already a root application context present - check whether you have multiple ContextLoader* definitions in your web.xml!
    at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:277)
    at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:112)
    at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4701)
    at org.apache.catalina.core.StandardContext$1.call(StandardContext.java:5204)
    at org.apache.catalina.core.StandardContext$1.call(StandardContext.java:5199)
    at java.util.concurrent.FutureTask$Sync.innerRun(Unknown Source)
    at java.util.concurrent.FutureTask.run(Unknown Source)
    at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)
Jul 23, 2014 5:47:10 PM org.apache.catalina.core.StandardContext startInternal
SEVERE: Error listenerStart
Jul 23, 2014 5:47:10 PM org.apache.catalina.core.StandardContext startInternal
SEVERE: Context [/geocounts] startup failed due to previous errors
Jul 23, 2014 5:47:10 PM org.apache.catalina.core.ApplicationContext log
SEVERE: Servlet dispatcher threw unload() exception
javax.servlet.ServletException: Servlet.destroy() for servlet dispatcher threw exception
    at org.apache.catalina.core.StandardWrapper.unload(StandardWrapper.java:1397)
    at org.apache.catalina.core.StandardWrapper.stopInternal(StandardWrapper.java:1723)
    at org.apache.catalina.util.LifecycleBase.stop(LifecycleBase.java:225)
    at org.apache.catalina.core.StandardContext$4.run(StandardContext.java:5427)
    at java.lang.Thread.run(Unknown Source)
    at org.apache.catalina.core.StandardContext.stopInternal(StandardContext.java:5459)
    at org.apache.catalina.util.LifecycleBase.stop(LifecycleBase.java:225)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:153)
    at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:1033)
    at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:774)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:145)
    at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:1033)
    at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:291)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:145)
    at org.apache.catalina.core.StandardService.startInternal(StandardService.java:443)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:145)
    at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:727)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:145)
    at org.apache.catalina.startup.Catalina.start(Catalina.java:620)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:303)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:431)
Caused by: java.lang.NullPointerException
    at org.springframework.web.servlet.FrameworkServlet.destroy(FrameworkServlet.java:809)
    at org.apache.catalina.core.StandardWrapper.unload(StandardWrapper.java:1377)
    ... 24 more

登录页面破损 enter image description here

Answer 1

在Spring Security中使用基于Java的配置时，CSRF protection is enabled by default。您可以将其关闭为http.csrf().disable()。

Spring安全性无法初始化上下文

1 个答案: