Question

我需要定义一个自定义的RememberMeAuthenticationFilter，以便我可以覆盖onSuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult)方法来放置一些自定义逻辑。

我已经配置了XML以便使用我的自定义过滤器：

 <security:http disable-url-rewriting="true" request-matcher-ref="excludeUrlRequestMatcher" entry-point-ref="authenticationEntryPoint">
    <security:custom-filter position="FORM_LOGIN_FILTER" ref="usernamePasswordAuthenticationFilter"/>
    <security:custom-filter position="REMEMBER_ME_FILTER" ref="extRememberMeProcessingFilter"/>

    <security:anonymous username="anonymous" granted-authority="ROLE_ANONYMOUS"/>

    <security:session-management session-authentication-strategy-ref="fixation" />

    <!-- Intercepts url HERE: removed for brevity -->

    <!--<security:form-login: using custom filter -->
            <!--login-page="/login"-->
            <!--authentication-failure-handler-ref="loginAuthenticationFailureHandler"-->
            <!--authentication-success-handler-ref="loginGuidAuthenticationSuccessHandler"/>-->


    <security:logout logout-url="/logout" success-handler-ref="logoutSuccessHandler"/>

    <security:port-mappings>
        <security:port-mapping http="#{configurationService.configuration.getProperty('tomcat.http.port')}"
                               https="#{configurationService.configuration.getProperty('tomcat.ssl.port')}"/>
        <security:port-mapping http="80" https="443"/>
        <!--security:port-mapping http="#{configurationService.configuration.getProperty('proxy.http.port')}"
            https="#{configurationService.configuration.getProperty('proxy.ssl.port')}" /-->
    </security:port-mappings>

    <security:request-cache ref="httpSessionRequestCache"/>

    <security:access-denied-handler ref="b2bAccessDeniedHandler"/>

    <!-- RememberMe: using custom filter -->
    <!--<security:remember-me key="comtestrememberme" services-ref="rememberMeServices"/>-->

</security:http>

<security:authentication-manager alias="authenticationManager">
    <security:authentication-provider ref="myAuthenticationProvider"/>
    <security:authentication-provider ref="rememberMeAuthenticationProvider"/>
</security:authentication-manager>

<bean id="myAuthenticationProvider"
      class="com.test.security.MyAuthenticationProvider">
    <property name="bruteForceAttackCounter" ref="bruteForceAttackCounter"/>
    <property name="customerService" ref="customerService"/>
    <aop:scoped-proxy/>
</bean>

<bean id="rememberMeServices"
      class="com.test.security.MyRememberMeServices">
    <property name="key" value="comtestrememberme"/>
    <property name="cookieName" value="myRememberMe"/>
    <property name="alwaysRemember" value="false"/>
    <property name="customerService" ref="customerService"/>
    <property name="useSecureCookie" value="false"/>
    <aop:scoped-proxy/>
</bean>

<bean id="rememberMeAuthenticationProvider"
      class="org.springframework.security.authentication.RememberMeAuthenticationProvider">
    <property name="key" value="comtestrememberme"/>
    <aop:scoped-proxy/>
</bean>

<bean id="usernamePasswordAuthenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="filterProcessesUrl" value="/j_spring_security_check"/>
    <property name="rememberMeServices" ref="rememberMeServices"/>
    <property name="authenticationSuccessHandler" ref="loginGuidAuthenticationSuccessHandler"/>
    <property name="authenticationFailureHandler" ref="loginAuthenticationFailureHandler"/>
</bean>

<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <property name="loginFormUrl" value="/login"/>
</bean>

<bean id="extRememberMeProcessingFilter" class="com.test.security.filters.ExtRememberMeAuthenticationFilter">
    <property name="rememberMeServices" ref="rememberMeServices"/>
    <property name="authenticationManager" ref="authenticationManager"/>
</bean>

记住我的cookie正在创建并且正在使用我的自定义过滤器，但问题是注销永远不会发生。

当我点击退出按钮时，看起来我再次经历了身份验证过程，并且客户再次登录。

如果我回到标准的Spring过滤器，一切都运行良好。

我是否遗漏了配置中的内容？

Answer 1

这里可能发生的事情是 - 您的注销工作正常，但您在注销时没有删除myRememberMe Cookie。因此，当您的会话在注销时失效时，请记住我的服务是使用myRememberMe Cookie创建新会话。

解决方案：您可以在delete-cookies标记中添加<security:logout>属性来修改配置。

<security:logout logout-url="/logout" success-handler-ref="logoutSuccessHandler" delete-cookies="JSESSIONID,myRememberMe" />

Spring安全和自定义记住我过滤：注销问题

1 个答案: