Question

我正在为我的申请实施春季保全。

输入错误的用户名或密码后，我想显示错误的凭据消息，然后弹出窗口关闭。

当前发生的是，如果我输入了错误的凭据并单击“登录”，则弹出窗口将停留在该位置，下一次取消该弹出窗口时，将显示401消息。

如何以这种方式自定义？

我以以下方式更改了代码。现在弹出窗口根本不显示。

@Component
public class MyBasicAuthenticationEntryPoint extends BasicAuthenticationEntryPoint {

    @Override
    public void commence(final HttpServletRequest request, final HttpServletResponse response, final AuthenticationException authException) throws IOException, ServletException {
        //response.addHeader("WWW-Authenticate", "Basic realm=\"" + getRealmName() + "\"");
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        final PrintWriter writer = response.getWriter();
        writer.println("HTTP Status " + HttpServletResponse.SC_UNAUTHORIZED + " - " + authException.getMessage());
    }

    @Override
    public void afterPropertiesSet() throws Exception {
        setRealmName("testrealmname");
        super.afterPropertiesSet();
    }

}

完整代码

@Configuration
@EnableWebSecurity
public class CustomWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    @Autowired
    private MyBasicAuthenticationEntryPoint authenticationEntryPoint;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user1").password(passwordEncoder().encode("user1"))
                .authorities("ROLE_USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/securityNone").permitAll().anyRequest().authenticated().and().httpBasic()
                .authenticationEntryPoint(authenticationEntryPoint);
        http.csrf().disable().headers().frameOptions().disable();
        http.addFilterAfter(new CustomFilter(), BasicAuthenticationFilter.class);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

@Component 公共类MyBasicAuthenticationEntryPoint扩展了BasicAuthenticationEntryPoint {

@Override
public void commence(final HttpServletRequest request, final HttpServletResponse response, final AuthenticationException authException) throws IOException, ServletException {
    //response.addHeader("WWW-Authenticate", "Basic realm=\"" + getRealmName() + "\"");
    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
    final PrintWriter writer = response.getWriter();
    writer.println("HTTP Status " + HttpServletResponse.SC_UNAUTHORIZED + " - " + authException.getMessage());
}

@Override
public void afterPropertiesSet() throws Exception {
    setRealmName("testrealmname");
    super.afterPropertiesSet();
}

}

   public class CustomFilter extends GenericFilterBean {

        @Override
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
            chain.doFilter(request, response);
        }

    }

我提到了以下主题。

Spring Security throwing "Reason: Bad credentials" error in UI but correctly finding user during login

Spring Security弹出窗口未关闭

完整代码

0 个答案: