为什么Spring Security无法工作？

Question

我正在尝试将Spring Security集成到我的项目中。

我遵循了这里给出的文档：https://spring.io/guides/gs/securing-web/ 我没有使用Spring Boot，而是使用XML配置了所有内容。

我的web.xml如下：

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>

<servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>*.css</url-pattern>
</servlet-mapping>

<servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>*.js</url-pattern>
</servlet-mapping>

<servlet-mapping>
    <servlet-name>dispatcher</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>

dispatcher-servlet.xml:

<context:component-scan base-package="com.name.ot" />

<bean id="resolver"
    class="org.springframework.web.servlet.view.InternalResourceViewResolver">
    <property name="viewClass"
        value="org.springframework.web.servlet.view.JstlView" />
    <property name="prefix" value="/WEB-INF/" />
    <property name="suffix" value=".jsp" />
</bean>

我的视图控制器是：

@Controller
public class HomeController{

    @RequestMapping(value={"/", "/home"}, method = RequestMethod.GET)
    public ModelAndView home() {

        ModelAndView model = new ModelAndView("home");
        return model;
    }

    @RequestMapping(value={"/hello"}, method = RequestMethod.GET)
    public ModelAndView hello() {

        ModelAndView model = new ModelAndView("hello");
        return model;
    }

    @RequestMapping(value={"/login"}, method = RequestMethod.GET)
    public ModelAndView login() {

        ModelAndView model = new ModelAndView("login");
        return model;
    }
}

我的安全课：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/", "/home").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
            .logout()
                .permitAll();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .inMemoryAuthentication()
                .withUser("user").password("password").roles("USER");
    }
}

但是，我可以访问所有页面，/, /home, /hello, /login。

我不希望用户在没有进入/login的情况下直接访问/hello。

我做错了什么？

- adi rohan

---

是的，我正在使用3.0版本。我不确定如何在我的应用程序中使用这个Filter Chain Proxy，你能给我一个示例代码吗？ - adi rohan

Answer 1

我遇到了同样的问题。

我的解决方法如《Spring in action》一书中Craig Walls所述的第247页。您需要创建一个空类，该类扩展AbstractSecurityWebApplicationInitializer。

public class SecurityWebInitializer extends AbstractSecurityWebApplicationInitializer {}

- user3559338

Answer 2

你需要注册Filter Chain Proxy。

对于XML配置，请查看Spring安全参考：

When using servlet filters, you obviously need to declare them in your web.xml, or they will be ignored by the servlet container. In Spring Security, the filter classes are also Spring beans defined in the application context and thus able to take advantage of Spring’s rich dependency-injection facilities and lifecycle interfaces. Spring’s DelegatingFilterProxy provides the link between web.xml and the application context.

When using DelegatingFilterProxy, you will see something like this in the web.xml file:

<filter>
    <filter-name>myFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>myFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

对于Java配置和Servlet API 3+，请参见Spring安全参考手册:

下一步是在war包中注册springSecurityFilterChain。在Servlet 3.0+环境中，可以通过Spring的WebApplicationInitializer支持进行Java配置。显然，Spring Security提供了一个基类AbstractSecurityWebApplicationInitializer，它将确保为您注册springSecurityFilterChain。

- dur