Question

目前我正在使用tomcat 6和spring-security 3.0.3.RELEASE而不使用apache。

我可以强制https登录页面，它可以正常工作。

下一个配置用于防止通过http访问某些页面。

<http use-expressions="true">
    <intercept-url pattern="/" access="permitAll" />
    <intercept-url pattern="/login" access="permitAll" requires-channel="https" />
    <intercept-url pattern="/spring_security_login" access="permitAll" requires-channel="https" />
    <intercept-url pattern="/users/new" access="permitAll" requires-channel="https" />
    <intercept-url pattern="/users/authorize/*" access="isAuthenticated()" />


    <!--<form-login /> -->
    <form-login  login-page="/login" />
    <logout />
    <remember-me />

    <!--
        Uncomment to enable X509 client authentication support <x509 />
    -->
    <!-- Uncomment to limit the number of sessions a user can have -->
    <session-management>
        <concurrency-control max-sessions="10000"
            error-if-maximum-exceeded="true" />
    </session-management>

</http>

但是，如果我尝试通过非https链接访问 / buyers / new http://localhost:8085/path/buyers/new我收到下一个错误：

The page isn't redirecting properly

Firefox has detected that the server is redirecting the request for this address in a way that will never complete.

    *   This problem can sometimes be caused by disabling or refusing to accept
          cookies.

允许使用Cookie，所以我认为这不是问题。当我尝试访问上面的链接时，我在Chrome中遇到了类似的错误。

在我的配置端口8085是非ssl端口。 SSL在端口8443上配置，并且工作正常。

我希望对某些页面的所有访问尝试都重定向到https。

任何建议都将受到高度赞赏。

祝你好运， Tiho

Answer 1

在您的http配置中添加port-mappings部分：

<http use-expressions="true">
 ...
    <port-mappings>
        <port-mapping http="8085" https="8443"/>
    </port-mappings>
</http>

有没有办法在spring-security中为某些页面强制使用https？

1 个答案: