Question

我正在端口80上的AWS EC2实例中部署Spring Boot Web应用程序，并且主页显示为安全的。当我单击用户登录名或管理员登录之类的链接时，浏览器将其显示为不安全。我该怎么办确保我的整个应用程序安全。

下面是我从某个站点使用的代码，我是spring security的新手，请帮忙。

Home.html

<div class="starter-template">
                <h1>Spring Boot Web Thymeleaf + Spring Security</h1>
                <h2>1. Visit <a th:href="@{/admin}">Admin page (Spring Security protected, Need Admin Role)</a></h2>
                <h2>2. Visit <a th:href="@{/user}">User page (Spring Security protected, Need User Role)</a></h2>
                <h2>3. Visit <a th:href="@{/about}">Normal page</a></h2>
            </div>


    @Configuration
    // http://docs.spring.io/spring-boot/docs/current/reference/html/howto-security.html
    // Switch off the Spring Boot security configuration
    //@EnableWebSecurity
    public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

        @Autowired
        private AccessDeniedHandler accessDeniedHandler;

        // roles admin allow to access /admin/**
        // roles user allow to access /user/**
        // custom 403 access denied handler
        @Override
        protected void configure(HttpSecurity http) throws Exception {

            http.csrf().disable()
                    .authorizeRequests()
                    .antMatchers("/", "/home", "/about").permitAll()
                    .antMatchers("/admin/**").hasAnyRole("ADMIN")
                    .antMatchers("/user/**").hasAnyRole("USER")
                    .anyRequest().authenticated()
                    .and()
                    .formLogin()
                    .loginPage("/login")
                    .permitAll()
                    .and()
                    .logout()
                    .permitAll()
                    .and()
                    .exceptionHandling().accessDeniedHandler(accessDeniedHandler);
        }


            @Autowired
            public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

                auth.inMemoryAuthentication()
                        .withUser("user").password("password").roles("USER")
                        .and()
                        .withUser("admin").password("password").roles("ADMIN");
            }
        }

我在做什么错？是代码或我的AWS配置中的问题

Answer 1

通过将application.properties设置为以下内容解决了该问题

server.use-forward-headers = true

HTTPS安全保护仅在主页上有效，而在下一页上无效

1 个答案: