Question

在我参与的一个新的大应用中，我正在尝试使用弹簧安全性我使用this guide，因为它模仿了我想做的事情：

虽然我似乎无法登录，但由于/ login是被禁止的，我已经完成了指南中所说的内容，但没有运气。

错误请求 error request picture

安全配置（Java）

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .httpBasic()
                .and()
                .authorizeRequests()
                .antMatchers("/img/**", "/index.html", "/home.html", "/modules/**/**/**", "/", "/translations.js")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .csrf()
                .csrfTokenRepository(csrfTokenRepository())
                .and()
                .addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);
    }

    private Filter csrfHeaderFilter() {
        return new OncePerRequestFilter() {
            @Override
            protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
                    throws ServletException, IOException {
                CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
                if (csrf != null) {
                    Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN");
                    String token = csrf.getToken();
                    if (cookie == null || token != null && !token.equals(cookie.getValue())) {
                        cookie = new Cookie("XSRF-TOKEN", token);
                        cookie.setPath("/");
                        response.addCookie(cookie);
                    }
                }
                filterChain.doFilter(request, response);
            }
        };
    }

    private CsrfTokenRepository csrfTokenRepository() {
        HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
        repository.setHeaderName("X-XSRF-TOKEN");
        return repository;
    }
}

Answer 1

在下面的url匹配模式中看起来缺少/ login，这将跳过对列出的网址的身份验证。

.antMatchers（＆＃34; / img / ＆＃34;，＆＃34; /index.html"，＆＃34; /home.html"，＆＃34; / modules / / / ＆＃34;，＆＃34; /＆＃34;，＆＃34; /translations.js"）

Answer 2

看一下伟大的项目jhipster。

否则，您将在生成的项目中找到一个示例：https://github.com/jhipster/jhipster-sample-app/

Answer 3

当我想在登录失败时返回UNAUTHORIZED响应时，我遇到了同样的情况。我通过添加登录失败处理程序来处理它：

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.formLogin().failureHandler(new AuthenticationFailureHandler() {
        private final Log logger = LogFactory.getLog();

        @Override
        public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception)
                throws IOException, ServletException {
            logger.debug("Returning UNAUTHORIZED HttpStatus: " + exception.getMessage());
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Authentication Failed: " + exception.getMessage());
        }
    });
}

angularjs中的Spring安全性返回403禁止登录

3 个答案: