Question

我正在开发一个Web应用程序，并选择使用spring Security。这个想法是要使用户通过身份验证才能看到主页，如果用户未通过身份验证，则将他们重定向到登录页面。此登录页面还显示指向注册表单的链接，该部分正常工作。

但是，在尝试允许用户通过注册链接进行注册时遇到了一个问题。如果用户未通过身份验证，则无法访问注册表单的链接（“ showRegistrationForm”）

任何人都可以洞悉为什么会发生这种情况吗？我已经在下面包含了我的SecurityConfig中的代码段

    @Override
protected void configure(HttpSecurity http) throws Exception {

    //Restrict Access based on the Intercepted Servlet Request 

    http.authorizeRequests()
    .antMatchers("/resources/**", "/register").permitAll()
    .anyRequest().authenticated()
    .antMatchers("/").hasRole("EMPLOYEE")
    .antMatchers("/showForm/**").hasAnyRole("EMPLOYEE","MANAGER", "ADMIN")
    .antMatchers("/save/**").hasAnyRole("MANAGER", "ADMIN")
    .antMatchers("/delete/**").hasRole("ADMIN")
    .and()
    .formLogin()
// Show the custom form created for the below request mappings
        .loginPage("/showSonyaLoginPage")
        .loginProcessingUrl("/authenticateTheUser")
// No need to be logged in to see the login page
        .permitAll()
    .and()
// No need to be logged in to see the logout button.
    .logout().permitAll()
    .and()
    .exceptionHandling().accessDeniedPage("/access-denied");    
}

Answer 1

按如下所示更改代码：

@Override
protected void configure(HttpSecurity http) throws Exception {


    // Restrict Access based on the Intercepted Servlet Request 

    http.authorizeRequests()
        .antMatchers("/showRegistrationForm/").permitAll()
        .anyRequest().authenticated()
        .antMatchers("/").hasRole("EMPLOYEE")
        .antMatchers("/resources/").permitAll()
        .antMatchers("/showForm/**").hasAnyRole("EMPLOYEE","MANAGER", "ADMIN")
        .antMatchers("/save/**").hasAnyRole("MANAGER", "ADMIN")
        .antMatchers("/delete/**").hasRole("ADMIN")
        .and()
        .formLogin()
    // Show the custom form created for the below request mappings
            .loginPage("/showSonyaLoginPage")
            .loginProcessingUrl("/authenticateTheUser")
    // No need to be logged in to see the login page
            .permitAll()
        .and()
    // No need to be logged in to see the logout button.
        .logout().permitAll()
        .and()
        .exceptionHandling().accessDeniedPage("/access-denied");    
}

下移以下代码：

anyRequest().authenticated()

Spring Security-身份验证问题

1 个答案: