Question

我使用Spring Security制作了一个简单的项目来保护一个简单的页面。

您可以从here下载项目。

这是我的<?xml version="1.0" encoding="UTF-8"?> <web-app metadata-complete="true" version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"> <display-name>Spring Security Example</display-name> <context-param> <param-name>contextConfigLocation</param-name> <param-value>classpath:spring-security.xml</param-value> </context-param> <filter> <description>Spring Security filter</description> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <servlet-mapping> <servlet-name>default</servlet-name> <url-pattern>*.html</url-pattern> </servlet-mapping> <welcome-file-list> <welcome-file>index.html</welcome-file> </welcome-file-list> </web-app>：

spring-security.xml

和<?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">  <global-method-security pre-post-annotations="disabled" secured-annotations="disabled" jsr250-annotations="disabled"/> <http pattern="/favicon.ico" security="none"/> <http use-expressions="true" disable-url-rewriting="true" create-session="always" auto-config="false"> <intercept-url pattern="/login" access="permitAll" requires-channel="any"/> <intercept-url pattern="/logout" access="permitAll" requires-channel="any"/> <intercept-url pattern="/**" access="hasRole('ROLE_USER')" requires-channel="any"/> <form-login/> <http-basic /> <logout /> <session-management session-fixation-protection="migrateSession"/> <csrf disabled="true"/> <headers> <cache-control/> <content-type-options/> <frame-options/> <hsts disabled="true"/> <xss-protection/> </headers> </http> <authentication-manager alias="authenticationManager"> <authentication-provider> <password-encoder hash="plaintext"/> <user-service> <user name="john" password="smith" authorities="ROLE_USER" /> </user-service> </authentication-provider> </authentication-manager> </beans:beans>：

mvn jetty:run

在Maven环境下，运行：

C3A2 E2809A C2AC

没事。

当我将其打包并将其放入Tomcat 8/9时，它只需要HTTP 404。

Answer 1

请删除默认的servlet映射。它会起作用。

<servlet-mapping>
            <servlet-name>default</servlet-name>
            <url-pattern>*.css</url-pattern>
        </servlet-mapping>
        <servlet-mapping>
            <servlet-name>default</servlet-name>
            <url-pattern>*.js</url-pattern>
        </servlet-mapping>
        <servlet-mapping>
            <servlet-name>default</servlet-name>
            <url-pattern>*.gif</url-pattern>
        </servlet-mapping>
        <servlet-mapping>
            <servlet-name>default</servlet-name>
            <url-pattern>*.jpg</url-pattern>
        </servlet-mapping>
        <servlet-mapping>
            <servlet-name>default</servlet-name>
            <url-pattern>*.png</url-pattern>
        </servlet-mapping>
        <servlet-mapping>
            <servlet-name>default</servlet-name>
            <url-pattern>*.html</url-pattern>
        </servlet-mapping>

Spring Security 4用于保护简单页面而无需编码，无法在Tomcat中运行

1 个答案: