Question

我正在使用基于Spring Security Java的配置。但是当用户提交登录表单时无法调用进程操作。这是我的配置和java文件。请让我知道我做错了什么。提前谢谢。

1）Spring安全性Java Config类

@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    UserService userService;
    @Bean
    public AuthenticationManager authenticationManager() throws Exception{
        AuthenticationManager authenticationManager = new ProviderManager(
                    Arrays.asList(authenticationProvider()));
            return authenticationManager;
        }
    @Bean
    public AuthenticationProvider authenticationProvider() throws     Exception {
        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
        authenticationProvider.setUserDetailsService(userService);
        authenticationProvider.afterPropertiesSet();
        return authenticationProvider;
        }
        @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/**").permitAll()
        .antMatchers("/process/success").authenticated()
        .and()
        .formLogin()
        .usernameParameter("username") 
        .passwordParameter("password") 
        .loginPage("/")
        .failureUrl("/?auth=fail")
        .loginProcessingUrl("/process")
        .and().logout().logoutUrl("/logout")
         .invalidateHttpSession(true).deleteCookies("JSESSIONID")
        .permitAll();
        }
}

2）Jsp登录页面。

<form name="f" action="./process" method="post">
    <fieldset>
    <legend>Please Login</legend>
    <c:if test="${'fail' eq param.auth}">
    <div style="color: red">
    Login Failed!!!<br /> Reason :
    ${sessionScope["SPRING_SECURITY_LAST_EXCEPTION"].message}
    </div>
    </c:if>
    <c:if test="${'succ' eq param.out}">
    <div style="color: blue">
    <h2>You have been successfully logged out.</h2>
    ${sessionScope["SPRING_SECURITY_LAST_EXCEPTION"].message}
    </div>
    </c:if>
    <div class="alert alert-success">${param.logout}</div>
    <label for="username">Username</label> <input type="text"id="username" name="username" /> <label for="password">Password</label>
    <input type="password" id="password" name="password" /> 
    <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
    <div class="form-actions">
    <button type="submit" class="btn">Log in</button>
    </div>
    </fieldset>
    </form>

3）这是家庭控制器

@Controller
public class HomeController {
    @Autowired
    AuthenticationManager authenticationManager;
    @RequestMapping(value = "/", method = RequestMethod.GET)
    public String index() {
        System.out.println("index.....");
        return "index";
    }
    @RequestMapping(value = "/process", method = RequestMethod.POST)
    public String process(@PathVariable("username") String userName,
        @PathVariable("password") String password,
        HttpServletRequest request, RedirectAttributes redirectAttr) {
        try {
            UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(userName, password);
            Authentication authenticate = authenticationManager.authenticate(token);
            SecurityContextHolder.getContext().setAuthentication(authenticate);
        } catch (AuthenticationException e) {
            System.out.println(e.getMessage());
        }
        System.out.println("login....." + request.getSession(false));
        return "redirect:/process/success";
    }
    @RequestMapping(value = "/process/success", method = RequestMethod.GET)
    public String success() {
        System.out.println("success.....");
        return "success";
    }
    @RequestMapping(value = "/logout", method = RequestMethod.GET)
    public String logout(HttpServletRequest request) {
        System.out.println("logout....." + request.getSession(false)+ " is new " + request.getSession(false).isNew());
        request.getSession(false).invalidate();
        return "index";
    }
}

Answer 1

问题是Spring Security使用过滤器，以及UsernamePasswordAuthenticationFilter正常截获和处理的请求。所以它无法到达你的控制器。

Spring Security使用过滤器为您处理登录，您甚至不应该考虑使用控制器。您应该（再次）阅读参考手册并从教程开始。

使用基于Java Config的

1 个答案: