Question

我正在用SpringMVC开发一个简单的Java Web应用程序。启用安全性后，尽管我已经通过身份验证，但无法将HTTP发布请求（从index.jsp）发送到服务器。未实现安全性时，POST请求确实起作用。因此，我认为我的SecurityConfig.java代码有问题。能否为我提供帮助？非常感谢

错误代码：

HTTP Status 403 – Forbidden

Type Status Report

Message Forbidden

Description The server understood the request but refuses to authorize it.

这是我的安全配置。

SecurityConfig.java

 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

 @Configuration
 @EnableWebSecurity
 public class SecurityConfig extends WebSecurityConfigurerAdapter {

     @Autowired
     public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication().withUser("user1").password("{noop}123456").roles("USER");

        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {

            http
                    .formLogin()
                    .and()
                    .authorizeRequests()
                    .antMatchers("/index").hasRole("USER")
                    .antMatchers(HttpMethod.POST, "/index").hasRole("USER");

        }
    }

index.jsp

<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form"%>
<%@page pageEncoding="UTF-8" contentType="text/html; charset=UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
    "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<META http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Registration</title>
</head>
<body>

     <form action='@{/index}' method="POST">
     <div class="form-group">

     <td><textarea class="form-control" name="textForm">${text1}</textarea>   
     <input type="submit" value="Submit">
     <textarea name="textFin">${textFinal}</textarea></td>
     </form>
    </div>


</body>
</html>

Answer 1

添加 http.csrf().disable();来配置方法。

protected void configure(HttpSecurity http) throws Exception {
 http
            .formLogin()
            .and()
            .authorizeRequests()
            .antMatchers("/index").hasRole("USER")
            .antMatchers(HttpMethod.POST, "/index").hasRole("USER")
            .and()
            .csrf().disable();

}

您将jsp与thymleaf混淆了。将jsp file编辑为：

<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form"%>
<%@page pageEncoding="UTF-8" contentType="text/html; charset=UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
    "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<META http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Registration</title>
</head>
<body>

     <form:form action="/index" method="POST">
     <div class="form-group">

     <td><textarea class="form-control" name="textForm">${text1}</textarea>   
     <input type="submit" value="Submit">
     <textarea name="textFin">${textFinal}</textarea></td>
     </form:form>
    </div>


</body>
</html>

您提供的UserDetailService bean对我不起作用。我必须这样更改它：

@Bean
public UserDetailsService userDetailsService() {
    // ensure the passwords are encoded properly
    @SuppressWarnings("deprecation")
    UserBuilder users = User.withDefaultPasswordEncoder();
    InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
    manager.createUser(users.username("me").password("me").roles("USER").build());
    return manager;
}

SpringMVC（安全性）-403错误

1 个答案: