Question

我有一个要使用Spring Security保护的Spring MVC应用程序。我已经使用框架生成的默认登录页面涵盖了所有内容。现在，我想使用自定义登录页面，并用自己的CSS类装饰它。

在这一点上，我很困惑* .css文件是出于安全角度还是出于完全不同的原因而被拒绝。无论如何，我都会展示我拥有的东西：

我有以下配置：

SecurityController.java

package lb.mi;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import         org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.ui.ModelMap;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;

@Controller
public class SecurityController {

    @RequestMapping(value = "/", method = RequestMethod.GET)
    public String showLoginPage(ModelMap model) {

System.out.println("Moving to welcome!!!");

String loggedInUser = retriveLoggedInUserName();

model.put("name", loggedInUser);
        return "welcome";
    }

    @RequestMapping(value = "/logout", method = RequestMethod.GET)
    public String logout(HttpServletRequest request, HttpServletResponse         response)         {

System.out.println("Logging out the user...");

// Get the implemented authentication:
Authentication auth = SecurityContextHolder.getContext().getAuthentication();

// If there is/are authenticated user/s, get the logout handler and
// log the user/s out.
if (auth != null) {
    new SecurityContextLogoutHandler().logout(request, response, auth);

    // As an extra security measure, invalidate the current user session:
    request.getSession().invalidate();
}

// Return user to the entry point of the application
return "redirect:/";
    }

    private String retriveLoggedInUserName() {

Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();

if (principal instanceof UserDetails)
    return ((UserDetails) principal).getUsername();

return principal.toString();
    }

    @RequestMapping(value = "/login", method = RequestMethod.GET)
    public String login(Model model, String error, String logout) {
        if (error != null)
            model.addAttribute("errorMsg", "Invalid Credentials.");

        if (logout != null)
            model.addAttribute("msg", "Log out Successful!.");

        return "login";
    }
}

SecurityConfiguration.java

     package lb.mi.security;

  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import           org.springframework.security.config.annotation.authentication.builders.Authentic     ationManagerBuilder;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import      org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import      org.springframework.security.config.annotation.web.configuration.WebSecurityConf     igurerAdapter;
  import org.springframework.security.core.userdetails.User;
  import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  import org.springframework.security.crypto.password.PasswordEncoder;

  @Configuration
  @EnableWebSecurity
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

 @Autowired
 public void configureGlobalSecurity(AuthenticationManagerBuilder auth)      throws Exception {

     auth.inMemoryAuthentication().withUser("user1").password(passwordEncoder().encod     e("pass1")).roles("USER",
            "ADMIN");
 }

 @Override
 protected void configure(HttpSecurity http) throws Exception {
     http.authorizeRequests()
     .antMatchers("/").permitAll()
     .antMatchers("/resources/**").permitAll()
     .antMatchers("/").hasAnyRole("USER", "ADMIN")
     .antMatchers("/welcome").hasAnyRole("USER", "ADMIN")
     .anyRequest().authenticated()
     .and().formLogin().loginPage("/login").permitAll()
     .and().logout().permitAll();

        http.csrf().disable();
      }

      @Bean
      public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
      }
  }

springCustSecurity-servlet.xml

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:mvc="http://www.springframework.org/schema/mvc"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans         http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/mvc       http://www.springframework.org/schema/mvc/spring-mvc.xsd
        http://www.springframework.org/schema/context               http://www.springframework.org/schema/context/spring-context.xsd">

    <context:component-scan
        base-package="lb.mi" />

    <mvc:annotation-driven />

    <bean
                class="org.springframework.web.servlet.view.InternalResourceViewResolver">
        <property name="prefix">
            <value>/WEB-INF/views/</value>
        </property>
        <property name="suffix">
    <value>.jsp</value>
        </property>
    </bean>

</beans>

web.xml

<!-- webapp/WEB-INF/web.xml -->
       <web-app xmlns="http://java.sun.com/xml/ns/javaee"              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://java.sun.com/xml/ns/javaee               http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
           version="3.0">

   <servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>
        org.springframework.web.servlet.DispatcherServlet
    </servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/springCustSecurity-servlet.xml</param-       value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>



<servlet-mapping>
    <servlet-name>dispatcher</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>

<!-- Enable Spring Security -->
<filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
       </filter>

       <filter-mapping>
            <filter-name>springSecurityFilterChain</filter-name>
                <url-pattern>/*</url-pattern>
       </filter-mapping>

       </web-app>

我的项目如下：

enter image description here

检查“网络”请求，我可以看到根本没有“提取” css文件。这可以是安全检查吗？任何提示表示赞赏：）

预先感谢

Spring Security：授予对CSS资源的访问权限

0 个答案: