Question

我正在使用SpringMVC 4.3.13和Spring Security 4.2.4。
在最后几天，我将webjars依赖项添加到我的webapp中，如果我已经登录到该应用程序，则一切正常。我唯一的问题是无法使用webjars的登录页面，因为Spring Security不允许我下载资源。
在这里，我如何在登录页面中加载资源

<script src="/webjars/jquery/jquery.min.js"></script>

这里是MVCConfiguration中的资源配置

 @Override
 public void addResourceHandlers(final ResourceHandlerRegistry registry) {
     registry.addResourceHandler("/webjars/**").addResourceLocations(/webjars/")
        .resourceChain(false)
        .addResolver(new WebJarsResourceResolver())
        .addResolver(new PathResourceResolver());
     registry.addResourceHandler("/css/**").addResourceLocations("/css/");
     registry.addResourceHandler("/js/**").addResourceLocations("/js/");
     registry.addResourceHandler("/plugins/**").addResourceLocations(/plugins/");
     registry.addResourceHandler("/img/**").addResourceLocations("/img/");
     registry.addResourceHandler("/images/**").addResourceLocations(/images/");
     registry.addResourceHandler("/font/**").addResourceLocations("/font/");
     registry.addResourceHandler("/fonts/**").addResourceLocations("/fonts/");
     registry.addResourceHandler("/servlet/**").addResourceLocations("/servlet/");
     registry.addResourceHandler("/user/**").addResourceLocations("/user/");
     registry.addResourceHandler("/asset/**").addResourceLocations("/asset/");
     registry.addResourceHandler("/xslt/**").addResourceLocations("/xslt/");
     registry.addResourceHandler("/jsp/**").addResourceLocations("/jsp/");
     registry.addResourceHandler("/applets/**").addResourceLocations("/applets/");
     registry.addResourceHandler("/manager/**").addResourceLocations("/manager/");
     registry.addResourceHandler("/resources/**").addResourceLocations("/resources/");
 }

最后确定我的WebSecurityConfig

 @Override
 public void configure(WebSecurity web) throws Exception {
     web
        .ignoring()
        .antMatchers("/webjars/**");
 }

 @Override protected void configure(final HttpSecurity http) throws Exception {
      LOGGER.info("Initialization HTTP configuration");
      http
          .csrf().disable()
          .addFilterBefore(authenticationFilter(), UsernamePasswordAuthenticationFilter.class)
          .authorizeRequests().antMatchers("/login", "/asset/**","/privileged/**").permitAll()
          .anyRequest().authenticated()
          .and().formLogin().loginPage("/login")
          .defaultSuccessUrl("/home")
          .successHandler(customAuthenticationSuccessHandler)
          .permitAll();
 }

就像您可以看到我已经在“安全性”配置中添加了例外一样。我也尝试此配置

.antMatchers("/login", "/asset/**","/privileged/**","/webjars/**").permitAll()

但是如果没有成功，任何人都不知道。

更新 resourceHandler和ResourceLocations的配置正确。实际上，登录后Webjars可以正常工作

Answer 1

在您的xml配置文件中添加以下代码。

<mvc:resources mapping="/webjars/**" location="classpath:/META-INF/resources/webjars/"/>

或使用JavaConfig

@Configuration
public class WebConfig extends WebMvcConfigurerAdapter {

  @Override
  public void addResourceHandlers(ResourceHandlerRegistry registry) {
    registry.addResourceHandler("/webjars/**").addResourceLocations("classpath:/META-INF/resources/webjars/");
  }

}

Answer 2

问题与Spring Security无关。
有罪的是一个旧的自定义安全层，将来将完全被Spring安全性取代。

Webjars无法正确加载

2 个答案: