Question

此问题与弹簧安全性有关。每当我在tomcat上运行我的应用程序时，默认情况下index.jsp会打开，但现在我在此页面上被拒绝访问。

从index.jsp我将页面重定向到login.jsp，但由于我在此页面上获得访问被拒绝，因此不会发生重定向。我的意思是如果点击：“localhost：8080 / abc”我被拒绝访问但如果我点击“localhost：8080 / abc / login”页面打开。（只是要清楚，abc是应用程序上下文）

我非常确定我在Spring安全配置中的某个地方搞砸了，因为它之前工作正常。

以下是我的文件：

这是我的spring-security.xml

<sec:global-method-security pre-post-annotations="enabled"/>
<!--
Add white listed urls here.
Please note that the filter chain will not be applied and the security context not populated.
Use for static resource mostly
-->
<http pattern="/resources/**" security="none" />
<http pattern="/login" security="none" />
<http pattern="/login1" security="none" />
<http pattern="/googleLogin" security="none" />

<!-- Add protected resource here -->
<http use-expressions="true" entry-point-ref="forbiddenEntryPoint">
    <custom-filter position="PRE_AUTH_FILTER" ref="oauth2PreAuthFilter" />
    <intercept-url pattern="/menu" access="hasAnyRole('ROLE_USER')" />
    <intercept-url pattern="/request/**" access="hasAnyRole('ROLE_USER')" />
    <intercept-url pattern="/device/**" access="hasAnyRole('ROLE_USER')" />

    <intercept-url pattern="/**" access="hasRole('ROLE_ADMIN')" />

</http>

<authentication-manager alias="authenticationManager">
    <authentication-provider  ref="AuthenticationService" />
</authentication-manager>

<beans:bean id="forbiddenEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>

<beans:bean id="AuthenticationService" class="com.hitesh.security.AuthenticateUserService"/>

<beans:bean id="oauth2PreAuthFilter" class="com.hitesh.security.OAuth2PreAuthenticationFilter">
    <beans:property name="authenticationManager" ref="authenticationManager"/>
</beans:bean>

<beans:bean id="preAuthAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
    <beans:property name="preAuthenticatedUserDetailsService" ref="preAuthenticatedUserDetailsService"/>
</beans:bean>

<beans:bean id="preAuthenticatedUserDetailsService" class="com.hitesh.security.Oauth2PreAuthenticatedUserService"/>

这是我的web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
      http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
version="2.5">

<display-name>Inventory Project</display-name>

<servlet>
    <servlet-name>mvc-dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>mvc-dispatcher</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath:/abc/application.xml,
                 classpath:/abc/spring-security.xml
    </param-value>
</context-param>

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
</web-app>

我坚持了很长一段时间，任何帮助都会非常感激。

更新：在应用程序启动时，我的代码将进入oauth2PreAuthFilter。对于index.jsp，它不应该运行此过滤器。有没有办法避免这种情况，我试过

    <http pattern="/index" security="none" />

但这没有帮助。

Answer 1

试试这个（使用你的价值观）：

<http use-expressions="true" entry-point-ref="forbiddenEntryPoint">
    <custom-filter position="PRE_AUTH_FILTER" ref="oauth2PreAuthFilter" />
    <intercept-url pattern="/menu" access="hasAnyRole('ROLE_USER')" />
    <intercept-url pattern="/request/**" access="hasAnyRole('ROLE_USER')" />
    <intercept-url pattern="/device/**" access="hasAnyRole('ROLE_USER')" />    
    <intercept-url pattern="/**" access="hasRole('ROLE_ADMIN')" />

    <form-login login-page='/login.htm' default-target-url="/home.htm"/>

</http>

Answer 2

得到了修复：

   <http auto-config="true" pattern="/index.jsp" />

由于spring安全性，index.jsp上的访问被拒绝

2 个答案: