Question

我已经用登录表单设置了一个Spring Boot 2应用程序，但是，当您登录时，它不是像应该的那样重定向到/admin，而是通过@import下载样式表引用的字体文件。

这是我的安全设置；

@Configuration
@EnableWebSecurity()
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    UserService userService;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return PasswordEncoderFactories.createDelegatingPasswordEncoder();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();

        // These pages don't require the user to be logged in
        http.authorizeRequests()
                .antMatchers("/", "/login", "/logout", "/report/**").permitAll()
                .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
                .anyRequest().authenticated();

        // When the user has logged in as XX.
        // But access a page that requires role YY,
        // AccessDeniedException will be thrown.
        http.authorizeRequests().and().exceptionHandling().accessDeniedPage("/403");

        // Config for Login Form
        http.authorizeRequests().and().formLogin()//
                // Submit URL of login page.
                .loginProcessingUrl("/j_spring_security_check") // Submit URL
                .loginPage("/login")//
                .defaultSuccessUrl("/admin")//
                .failureUrl("/login?error=true")//
                .usernameParameter("username")//
                .passwordParameter("password")
                // Config for Logout Page
                .and().logout().logoutUrl("/logout").logoutSuccessUrl("/login?logout=true");
    }
}

我要去哪里错了？据我所知，我正在启用对存储在static文件夹中的Spring资源的访问。

Answer 1

我发现了这一点，我阅读了允许访问资源的代码，并注意到它说“ atCommonLocations”，并且猜想这增加了对文件夹的访问，例如css，js，img，图像等。我在文件夹中有字体标记为webfonts，因此我更新了我的安全配置；

http.authorizeRequests()
                .antMatchers("/", "/login", "/logout", "/report/**", "/webfonts/**").permitAll()
                .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
                .anyRequest().authenticated();

Spring Boot 2 Security在登录时下载字体文件

1 个答案: