Question

我正在使用创建Web应用程序春天：4.1.2.RELEASE spring security版本：3.2.5.RELEASE 前端：角度js

因此，当使用js的webservice调用时，服务器返回文本登录页面作为会话过期时的调用响应（在我的情况下从另一个系统登录时）。所以为了避免这种情况，我在http://forum.spring.io/forum/spring-projects/security/88806-use-form-login-by-default-but-http-basic-for-rest-urls中的建议中在spring security中添加了DelegatingAuthenticationEntryPoint bean 这样工作正常，因此当进行ajax调用时，将从服务器发送http 403状态代码。但这只发生在第二次尝试中。首先从system1进行调用，其中由于在system2上使用相同用户登录，用户会话已过期。因此，会话到期后第一次从system1调用web服务会返回登录页面html，而从下一次调用时，它会按预期返回403错误代码。

我不知道为什么第一次通话没有返回403。请帮忙： -

基本弹簧安全码： -

<beans:bean id="customAuthenticationEntryPoint" class="org.springframework.security.web.authentication.DelegatingAuthenticationEntryPoint">
 <beans:constructor-arg>
     <beans:map>
         <beans:entry>
            <beans:key>
                <beans:bean class="org.springframework.security.web.util.matcher.RegexRequestMatcher">
                    <beans:constructor-arg value="^/ws/.*" /><!-- match URLs starting with "/api/" -->
                    <beans:constructor-arg><beans:null /></beans:constructor-arg><!-- no matter what the HTTP method is -->
                </beans:bean>
            </beans:key>
            <!-- if the key above has matched, send 403 response -->
            <beans:bean class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" />
         </beans:entry>
     </beans:map>
 </beans:constructor-arg>

 <!-- and in the default case just redirect to login form -->
 <beans:property name="defaultEntryPoint" >
    <beans:bean class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
        <beans:constructor-arg value="/login.jsp" />
    </beans:bean>
 </beans:property>

<http use-expressions="true" entry-point-ref="customAuthenticationEntryPoint">

 <intercept-url pattern="/favicon.ico*" access="isAnonymous()" />
    <intercept-url pattern="/login.jsp*" access="isAnonymous()"/>
    <intercept-url pattern="/sessionTimeout.jsp*" access="permitAll"/>
    <intercept-url pattern="/sessionExpired.jsp*" access="permitAll"/>
    <intercept-url pattern="/**" access="hasRole('ROLE_USER')" />

    <intercept-url pattern="/index.jsp*" access="permitAll"/>
    <intercept-url pattern="/authFailed.jsp*" access="permitAll"/> -->
    <http-basic />
    <form-login login-page="/login.jsp" default-target-url="/index.jsp"
        login-processing-url="/loginAuth"
        authentication-failure-url="/login.jsp?authFailed=true"
        username-parameter="uname"
        password-parameter="pwd"

        />
    <logout logout-url="/logoutUser" invalidate-session="false" delete-cookies="JSESSIONID"/>
    <session-management invalid-session-url="/login.jsp?error=invalidSession" >
        <concurrency-control error-if-maximum-exceeded="false" max-sessions="1" expired-url="/login.jsp?error=expiredSession"/>
    </session-management>

</http>

//因为我正在使用调度程序servlet for / ws /*.

请指教。感谢

DelegatingAuthenticationEntryPoint第一次没有被调用

0 个答案: