Question

这是我的主要控制者：

package org.demian.demibox.controllers;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;

@Controller
public class MainController {
    private String getUsername() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth.isAuthenticated())
            return auth.getName();
        else
            return null;
    }
    @RequestMapping(value = "/", method = RequestMethod.GET)
    public String showHome() {
        String username = getUsername();
        System.out.println(username);
        if (username == null || username.length() == 0)
            return "welcome";
        return "index";
    }
}

即使我未登录，auth.isAuthenticated()也始终返回true。这是为什么？何时auth.isAuthenticated()会返回false？如果我没有登录，则经过身份验证的用户的名称为anonymousUser，如果我已登录，则为用户名。

修改

这是我的security-context.xml文件：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
    xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <security:authentication-manager>
        <security:authentication-provider>
            <security:jdbc-user-service data-source-ref="dataSource" id="jdbcUserService" />
            <!-- <security:password-encoder ref="passwordEncoder" /> -->
        </security:authentication-provider>
    </security:authentication-manager>
    <security:http use-expressions="true">
        <security:intercept-url pattern="/" access="permitAll" />
        <security:intercept-url pattern="/login" access="permitAll" />
        <security:intercept-url pattern="/redeem" access="permitAll" />
        <security:intercept-url pattern="/redeem_code" access="permitAll" />
        <security:intercept-url pattern="/static/**" access="permitAll" />
        <security:intercept-url pattern="/*" access="isAuthenticated()" />
        <security:intercept-url pattern="/**" access="isAuthenticated()" />
        <security:intercept-url pattern="/**" access="denyAll" />
        <security:form-login login-page="/login" authentication-failure-url="/login?error=true" />
        <security:logout logout-success-url="/" />
        <security:remember-me key="offersAppKey" user-service-ref="jdbcUserService" />
    </security:http>
    <security:global-method-security secured-annotations="enabled" />
    <!-- <bean id="passwordEncoder" class="org.springframework.security.crypto.password.StandardPasswordEncoder" /> -->
</beans>

以下行位于web.xml文件中：

<filter>
    <display-name>springSecurityFilterChain</display-name>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

我正在通过Maven使用Tomcat 8.0和所有最新的依赖项。

Answer 1

这是默认情况下spring-security的工作原理。

来自文档：

请注意，匿名身份验证的用户与＃34;之间没有真正的概念差异。和一个未经身份验证的用户。 Spring Security的匿名身份验证只是为您提供了一种更方便的方法来配置访问控制属性。例如，调用servlet API调用（例如getCallerPrincipal）仍将返回null，即使SecurityContextHolder中实际存在匿名身份验证对象。

在其他情况下，匿名身份验证很有用，例如审计拦截器查询SecurityContextHolder以确定哪个主体负责给定操作时。如果类知道SecurityContextHolder总是包含Authentication对象，并且永远不会为null，则可以更健壮地创建类。

如果您需要检查它是否为anonymousUser，那么您可以检查Authentication对象是否为AnonymousAuthenticationToken实例。

为什么＆＃39; anonymousUser＆＃39;在Spring Security中验证？

修改

1 个答案: