会话到期后不支持请求方法“POST”

Question

我正在使用Spring Security运行Spring MVC Web应用程序。每当我在会话过期后（使用POST）提交/刷新页面时，我都会：

  

不支持请求方法'POST'

这是错误日志。如果我在Spring Security中禁用CSRF，那么它工作正常。

org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported
at org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping.handleNoMatch(RequestMappingInfoHandlerMapping.java:204)
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.lookupHandlerMethod(AbstractHandlerMethodMapping.java:382)
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java:322)
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java:60)
at org.springframework.web.servlet.handler.AbstractHandlerMapping.getHandler(AbstractHandlerMapping.java:351)
at org.springframework.web.servlet.DispatcherServlet.getHandler(DispatcherServlet.java:1120)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:932)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:893)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:969)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:871)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:845)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:728)
at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:467)
at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:392)
at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:311)
at org.springframework.security.web.firewall.RequestWrapper$FirewalledRequestAwareRequestDispatcher.forward(RequestWrapper.java:139)
at org.springframework.security.web.access.AccessDeniedHandlerImpl.handle(AccessDeniedHandlerImpl.java:71)
at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:110)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:91)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:53)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:213)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:624)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)

这是我的Spring配置

http
    .authorizeRequests()
        .antMatchers("/login**").permitAll()
        .antMatchers("/help**").permitAll()
        .antMatchers("/faq/**").permitAll()
        .antMatchers("/denied").permitAll()
        .and()
    .formLogin()
        .loginPage("/login")
        .successHandler(customSuccessHandler())
        .and()
    .logout()
        .logoutUrl("/login?logout")
        .invalidateHttpSession(true).deleteCookies("JSESSIONID")
        .and()
    .exceptionHandling()
        .accessDeniedPage("/denied")
        .and()
    .exceptionHandling()
        .authenticationEntryPoint(ssoAuthenticationEntryPoint())
        .and()
    .addFilterBefore(userNameTransformationFilter(), UsernamePasswordAuthenticationFilter.class)
    .addFilterBefore(customPreAuthSecurityFilter(), BasicAuthenticationFilter.class)
    .addFilterAfter(waffleNegotiateSecurityFilter(), BasicAuthenticationFilter.class)
    .addFilterAfter(customNegotiateSecurityFilter(), BasicAuthenticationFilter.class)
    .authorizeRequests()
        .anyRequest().fullyAuthenticated();

这是认证入口点java class

    public class SSOAuthenticationEntryPoint extends NegotiateSecurityFilterEntryPoint {

    private static final Logger logger = Logger.getLogger(SSOAuthenticationEntryPoint.class);

    /*
     * (non-Javadoc)
     * @see org.springframework.security.web.AuthenticationEntryPoint#commence(javax.servlet.http.HttpServletRequest,
     * javax.servlet.http.HttpServletResponse, org.springframework.security.core.AuthenticationException)
     */
    @Override
    public void commence(final HttpServletRequest request, final HttpServletResponse response,
                         final AuthenticationException ex) throws IOException, ServletException {
        String ctxPath = ((HttpServletRequest) request).getContextPath();
        String requestURI = request.getRequestURI();
        logger.info(" start authentication process - " + requestURI);
        if (("" + ctxPath + "/rest/sso").equalsIgnoreCase(requestURI)) {
            super.commence(request, response, ex);
        } else {
            Boolean hasCheckedSSO = (Boolean) request.getSession().getAttribute(SecurityConstants.ATTR_HAS_CHECKED_SSO);
            Boolean ssoUserNotFound = (Boolean) request.getSession().getAttribute(SecurityConstants.ATTR_SSO_USER_NOT_FOUND);
            logger.info("hasCheckedSSO = " + hasCheckedSSO + ", ssoUserNotFound = " + ssoUserNotFound);
            String target = request.getRequestURI() + (request.getQueryString() != null ? "?" + request.getQueryString() : "");
            request.getSession().setAttribute(SecurityConstants.ATTR_TARGET, target);
            if (ssoUserNotFound != null && ssoUserNotFound) {
                response.sendRedirect(ctxPath + "/login?noaccess");
            } else if (hasCheckedSSO == null) {
                request.getSession().setAttribute("hasCheckedSSO", Boolean.TRUE);
                target = URLEncoder.encode(target, "UTF-8");
                response.sendRedirect(ctxPath + "/checkSSO?target=" + target);
            } else {
                response.sendRedirect(ctxPath + "/login");
            }
        }

    }
}

有什么建议吗？

Answer 1

如果您的会话已过期，您的请求中包含无效的CSRF令牌（或根本没有CSRF令牌），您的访问权限将被拒绝。

您配置了拒绝访问权限的页面，该页面创建了AccessDeniedHandler，请参阅ExceptionHandlingConfigurer#accessDeniedPage：

  

指定要使用的AccessDeniedHandler的快捷方式是特定的错误页面

此基础AccessDeniedHandler将您的请求转发（不重定向）到访问被拒绝页面，请参阅AccessDeniedHandlerImpl：

  

此实现发送403（SC_FORBIDDEN）HTTP错误代码。此外，如果定义了errorPage，则实现将执行请求调度程序“转发”到指定的错误页面视图。作为“前锋”，SecurityContextHolder将继续填充。如果视图（或标记库或宏）希望访问SecurityContextHolder，这将是有益的。请求范围也将填充异常本身，可从密钥WebAttributes.ACCESS_DENIED_403获得。

因此，您需要一个访问被拒绝的页面，不仅支持HTTP GET，还支持POST以及所有其他使用的HTTP方法。