Question

这个想法很简单如果我的登录失败，用户将被重定向到/loginerror但不能正常工作

的LoginController

 @RequestMapping(value = "/login", method = RequestMethod.GET)
        public String login(Model model) {
            return "login";
        }

        @RequestMapping(value = "/loginerror", method = RequestMethod.GET)
        public String loginFailed(Model model) {
            model.addAttribute("error", "true");
            return "login";
        }

        @RequestMapping(value = "/logout", method = RequestMethod.GET)
        public String logout(Model model) {
            return "login";
        }

的login.jsp

<c:if test="${not empty error}">
                            <div class="alert alert-danger">
                                <spring:message
                                    code="AbstractUserDetailsAuthenticationProvider.badCredentials" />
                                <br />
                            </div>
                        </c:if>
                        <form action="<c:url value= "/j_spring_security_check"></c:url>"
                            method="post">
                            <fieldset>
                                <div class="form-group">
                                    <input class="form-control" placeholder="User Name"
                                        name='j_username' type="text">
                                </div>
                                <div class="form-group">
                                    <input class="form-control" placeholder="Password"
                                        name='j_password' type="password" value="">
                                </div>
                                <input class="btn btn-lg btn-success btn-block" type="submit"
                                    value="Login">
                            </fieldset>
                        </form>
                    </div>

安全-context.xml中

<security:http auto-config="true">
    <security:intercept-url pattern="/all/add"
        access="hasRole('ROLE_ADMIN')" />
    <security:form-login login-page="/login"
        default-target-url="/all/add" authentication-failure-url="/loginerror" />
    <security:logout logout-success-url="/logout" />
    <security:csrf disabled="true" />
</security:http>

<security:authentication-manager>
    <security:authentication-provider>
        <security:user-service>
            <security:user name="admin" authorities="ROLE_ADMIN"
                password="admin" />
        </security:user-service>
    </security:authentication-provider>

</security:authentication-manager>

我要做的是在用户登录失败时将用户重定向到登录页面，但每次我都会在网址localhost......../j_spring_security_check上找不到错误404 页面

修改

弹出错误消息 AbstractUserDetailsAuthenticationProvider.badCredentials=The user-name or password you entered is incorrect.

将调试语句放入/loginerror方法后

我发现这个方法甚至没有被调用

如果网址错误，如何拦截？

web.xml

<servlet>
        <servlet-name>dispatcherServlet</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>dispatcherServlet</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/security-context.xml</param-value>
    </context-param>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

Answer 1

我没有在你的控制器中看到“/ loginerror”，这将是一个问题，所以当然这个方法永远不会被调用，要么将failure-url更改为loginerror loginerr，要么更改为loginFailed。正如其他人已经指出的那样，通常你会做-failure-url =“/ login？error = true”，然后使用错误请求参数向用户显示他们搞砸了他们的登录信息。

Answer 2

检查截取URL的顺序，它基于.Maybe中的第一个问题。也请在下面的代码中尝试。

always-use-default-target="true"

Answer 3

您正在使用的弹簧版本不支持 <form action="<c:url value= "/j_spring_security_check"></c:url>" method="post"> 使用/ login作为url而不是 <form action="<c:url value= "/login"></c:url>" method="post"> 因为你问这个链接清楚地解释了差异Why doesn't my custom login page show with Spring Security 4?

无法在spring mvc中显示包含错误消息的同一页面

3 个答案: