Question

我正在尝试创建一个包含安全性的Spring MVC应用程序。所有配置都是用代码完成的，没有XML-s。首先，我有我的WebApplicationInitializer，将所有请求映射到我的dispatchservlet：

public class DBCAppInitializer implements WebApplicationInitializer {

@Override
public void onStartup(ServletContext servletContext) throws ServletException {

    AnnotationConfigWebApplicationContext ctx = new AnnotationConfigWebApplicationContext();
    ctx.register(DBCConfiguration.class);
    ctx.setServletContext(servletContext);

    ServletRegistration.Dynamic servlet = servletContext.addServlet(
            "dispatcher", new DispatcherServlet(ctx));

    servlet.setLoadOnStartup(1);
    servlet.addMapping("/"); 
    servlet.setMultipartConfig(new MultipartConfigElement("", 1024*1024*5, 1024*1024*5*5, 1024*1024));


}

还有一个配置文件：

@EnableWebMvc
@Configuration
@ComponentScan(basePackages = "our.dbc")
public class DBCConfiguration extends WebMvcConfigurerAdapter {

private static final Logger log = Logger.getLogger(DBCConfiguration.class);

@Bean
public InternalResourceViewResolver getInternalResourceViewResolverJsp(){
    InternalResourceViewResolver viewResolver = new InternalResourceViewResolver();
    viewResolver.setPrefix("/WEB-INF/view/");
    viewResolver.setSuffix(".jsp");
    viewResolver.setOrder(0);
    log.info("####   Internal view resolver 0 called...");
    return viewResolver;
}

@Bean
public StandardServletMultipartResolver multipartResolver(){
    log.info("####   Multipart resolver called...");
    return new StandardServletMultipartResolver();
}

//    @Override 
//    public void addResourceHandlers(final ResourceHandlerRegistry registry)  {
//       registry.addResourceHandler("/resources/**")
//          .addResourceLocations("/resources/");
//        
//    }
//    
//    @Override
//    public void   configureDefaultServletHandling(DefaultServletHandlerConfigurer configurer) {
//       configurer.enable();
//    }
}

正如您所看到的，我已尝试过addResourceHandler和configureDefaultServletHandling，但这些都没有奏效。问题是所有请求默认情况下，优先级最低的最终结束欢迎页面（所以如果请求了错误的地址，欢迎返回:)，这样就不会让css客户端返回欢迎页面：

@Controller
public class FileUploadController {

private static final Logger LOG = Logger.getLogger(FileUploadController.class);

private static final String FORM = "form";

private static final String WELCOME = "welcome";

private static final String DENIED = "accessDenied";

private static final String UPLOADED_REDIRECT = "redirect:/uploaded";

@Autowired
FileUploadService uploadService;

@RequestMapping(value = "/**", method = RequestMethod.GET)
public String getWelcome() {
     return WELCOME;
}

@RequestMapping(value = "/login", method = RequestMethod.GET)
public String loginPage() {
    LOG.info("####   /login called..." );
    return "login";
}

@RequestMapping(value = { "/uploaded" }, method = RequestMethod.GET)
public String getUploaded() {
    LOG.info("####   /uploaded called..." );
    return "uploaded";
}
.
.
.

正如我所说，我也配置了安全性，但是默认容器servlet提供静态资源，它不需要更改。无论如何，我还尝试将permitall添加到资源中，但没有成功。无论如何，如果我禁用安全性它也不起作用，所以安全性不是问题。

 @Override
protected void configure(HttpSecurity http) throws Exception {

  http.authorizeRequests()
  .antMatchers("/resources/**").permitAll()
    .antMatchers("/welcome").permitAll() 
    .antMatchers("/form").access("hasRole('ADMIN')and hasRole('USER')")
.
.
.

但没有机会。如果我输入http://localhost:8080/SpringMVC/resources/app.css而不是获取样式表，浏览器将返回欢迎页面。

有什么建议吗？任何帮助都应该被赞赏：）

Spring静态资源映射不起作用

0 个答案: