Question

我正在使用此安全配置：

<security:http pattern="/app/.*" security="none" />
<security:http pattern="/assets/.*" security="none" />

<security:http jaas-api-provision="true" request-matcher="regex" use-expressions="true" entry-point-ref="defaultLoginUrlAuthenticationEntryPoint">
    <security:csrf disabled="true"/>
    <security:intercept-url pattern="/index\.html.*" access="isAuthenticated()"/>
    <security:intercept-url pattern="/services/.*" access="isAuthenticated()"/>
    <security:custom-filter before="FORM_LOGIN_FILTER" ref="myAuthenticationFilter"/>
    <security:custom-filter before="LAST" ref="myTokenFilter"/>
    <security:form-login authentication-failure-handler-ref="defaultAuthenticationFailureHandler" 
                         authentication-success-handler-ref="defaultSuccessHandler"
                         login-processing-url="/login"/>
    <security:access-denied-handler ref="defaultAccessDeniedHandler"/>
    <security:logout delete-cookies="user" success-handler-ref="defaultLogoutHandler" logout-url="/logout"/>
</security:http>

应用程序正常使用它，但是存在性能问题，因为安全无配置是错误的（我使用正则表达式模式，而默认是ant）和myTokenFilter调用休息服务的次数比我需要的多。我更正了如下配置：

<security:http request-matcher="regex" pattern="/app/.*" security="none" />
<security:http request-matcher="regex" pattern="/assets/.*" security="none" />

现在过滤器工作正常，但应用程序不再起作用。所有静态请求返回302并重定向到注销。我更改了我的注销网址以避免重定向回到门户网站，我在浏览器中看到了这一点。

旧配置（工作）。

Working

新配置：

Not Working

除了退出，我注意到浏览器无缘无故地识别像json这样的js文件。

我的应用程序使用角度和弹簧启动。目前，使用属性配置静态资源：

spring.resources.static-locations=classpath:/META-INF/resources/webjars/web-template/,classpath:/static/

在使用bean配置之前：

@Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/**")
            .addResourceLocations("classpath:/META-INF/resources/webjars/web-template/")
            .addResourceLocations("classpath:/static/");
    }

尝试直接访问js文件的简单日志。

2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-4] o.s.b.c.web.OrderedRequestContextFilter  : Bound request context to thread: org.apache.catalina.connector.RequestFacade@7e25c043
2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-4] o.s.s.w.u.matcher.RegexRequestMatcher    : Checking match of request : '/app/view/service.js'; against '/app/.*'
2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-4] o.s.security.web.FilterChainProxy        : /app/view/service.js has an empty filter list
2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-4] o.s.b.c.web.OrderedRequestContextFilter  : Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade@7e25c043
2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.b.c.web.OrderedRequestContextFilter  : Bound request context to thread: org.apache.catalina.connector.RequestFacade@7e25c043
2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.s.w.u.matcher.RegexRequestMatcher    : Checking match of request : '/logout'; against '/app/.*'
2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.s.w.u.matcher.RegexRequestMatcher    : Checking match of request : '/logout'; against '/assets/.*'
2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.security.web.FilterChainProxy        : /logout at position 1 of 16 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.
2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.security.web.FilterChainProxy        : /logout at position 2 of 16 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.security.web.FilterChainProxy        : /logout at position 3 of 16 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.security.web.FilterChainProxy        : /logout at position 4 of 16 in additional filter chain; firing Filter: 'LogoutFilter'
2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/logout'; against '/logout'
2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.s.w.a.logout.LogoutFilter            : Logging out user 'null' and transferring to logout destination

对这种奇怪的行为有什么看法吗？

编辑：我正在使用spring-io-platform版本2.0.1-RELEASE并更新到2.0.3试图解决这个问题。

编辑：配置转换为Java Config，没有解决方案。

@Configuration
@EnableWebSecurity
@ImportResource("classpath:application-context-ui-security.xml")
@Profile(DEFAULT_PROFILE)
protected static class SecurityUIApplication extends WebSecurityConfigurerAdapter {

    @Inject
    private MyAuthenticationFilter myAuthenticationFilter;

    @Inject 
    private MyTokenFilter myTokenFilter;

    @Inject
    private DefaultAuthenticationFailureHandler defaultAuthenticationFailureHandler;

    @Inject
    private AuthenticationSuccessHandler defaultSuccessHandler;

    @Inject
    private DefaultAccessDeniedHandler defaultAccessDeniedHandler;

    @Resource
    private DefaultLogoutHandler defaultLogoutHandler;

    @Inject
    private DefaultLoginUrlAuthenticationEntryPoint defaultLoginUrlAuthenticationEntryPoint;

    @Override
    public void configure(WebSecurity web) throws Exception {
         web.ignoring().regexMatchers("/app/.*", "/assets/.*");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable()
            .exceptionHandling().accessDeniedHandler(defaultAccessDeniedHandler)
            .authenticationEntryPoint(defaultLoginUrlAuthenticationEntryPoint)
        .and()
            .addFilterBefore(myAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
            .addFilterBefore(myTokenFilter, AnonymousAuthenticationFilter.class)
        .authorizeRequests()
            .antMatchers("/index.html**","/services/**").authenticated()
            .anyRequest().permitAll()
        .and().formLogin()
            .failureHandler(defaultAuthenticationFailureHandler)
            .loginProcessingUrl("/login")
            .successHandler(defaultSuccessHandler)
        .and().logout()
            .logoutSuccessHandler(defaultLogoutHandler)
            .deleteCookies("user")
            .logoutUrl("/logout")
            ;
    }

}

我仍然导入xml因为我需要导入框架xml并且有一个要覆盖的抽象bean但是只是一个属性。

对于使用security none配置的所有静态内容，Spring Security返回302

0 个答案: