代码之家  ›  专栏  ›  技术社区  ›  Java Questions

此网页在spring安全应用程序中有一个重定向循环

  •  12
  • Java Questions  · 技术社区  · 13 年前

    我在spring中有一个使用spring安全性的web应用程序,当我试图执行它所说的应用程序时

    This webpage has a redirect loop
    

    这是我的 security-context.xml 添加后,我只得到了这个异常

    <?xml version="1.0" encoding="UTF-8"?>
    
    <b:beans xmlns="http://www.springframework.org/schema/security"
        xmlns:b="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                            http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
    
        <!-- HTTP security configurations -->
        <http use-expressions="true">
            <form-login login-processing-url="/resources/j_spring_security_check"
                login-page="/login" authentication-failure-url="/login?login_error=t" />
            <logout logout-url="/resources/j_spring_security_logout" />
            <intercept-url pattern="/**" access="isAuthenticated()" />
            <intercept-url pattern="/login*" access="permitAll()" />
            <intercept-url pattern="/resources/**" access="permitAll()" />
    
        </http>
    
        <!-- Configure Authentication mechanism -->
        <authentication-manager alias="authenticationManager">
            <authentication-provider>
                <user-service>
                    <user name="admin" password="admin" authorities="RIGHT_LIST,RIGHT_CANCEL,RIGHT_CREATE,RIGHT_UPDATE" />
                    <user name="antony" password="antony" authorities="RIGHT_LIST,RIGHT_CANCEL,RIGHT_CREATE,RIGHT_UPDATE" />
                    <user name="rod" password="rod" authorities="RIGHT_LIST,RIGHT_CREATE"/>
                </user-service>
            </authentication-provider>
        </authentication-manager>
    
        <global-method-security secured-annotations="enabled" pre-post-annotations="enabled">
            <expression-handler ref="expHandler"/>
        </global-method-security>
    
        <b:bean id="expHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
            <b:property name="permissionEvaluator">
                <b:bean  class="com.anto.springsec.security.CreateContactPermissionEvaluator"/>
            </b:property>
        </b:bean>
    
    </b:beans>
    

    我有一个login.jsp和一个createContact.jsp

    这是我的家庭控制器:

    package com.anto.springsec.controllers;
    
    import java.text.DateFormat;
    import java.util.Date;
    import java.util.Locale;
    
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.stereotype.Controller;
    import org.springframework.ui.Model;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    
    /**
     * Handles requests for the application home page.
     */
    @Controller
    public class HomeController {
    
        private static final Logger logger = LoggerFactory.getLogger(HomeController.class);
    
        /**
         * Simply selects the home view to render by returning its name.
         */
        @RequestMapping(value = "/login", method = RequestMethod.GET)
        public String home(Locale locale, Model model) {
            logger.info("Welcome home! The client locale is {}.", locale);
    
            Date date = new Date();
            DateFormat dateFormat = DateFormat.getDateTimeInstance(DateFormat.LONG, DateFormat.LONG, locale);
    
            String formattedDate = dateFormat.format(date);
    
            model.addAttribute("serverTime", formattedDate );
    
            return "login";
        }
    
    }
    

    请帮我解决这个问题。

    2 回复  |  直到 13 年前
        1
  •  13
  •   limc    13 年前

    我相信 intercept-url 在这里很重要,而且你的 /** 模式是吞咽 /login /resources

    试试这个:-

    <http pattern="/resources/**" security="none"/>
    <http pattern="/login" security="none"/>
    
    <http use-expressions="true">
        <form-login login-processing-url="/resources/j_spring_security_check"
            login-page="/login" authentication-failure-url="/login?login_error=t" />
        <logout logout-url="/resources/j_spring_security_logout" />
        <intercept-url pattern="/**" access="isAuthenticated()" />
    </http>
    

    这个配置与我现有的一个项目非常相似。

    更新

    这是我目前在项目中使用的配置:-

    <security:http pattern="/resources/**" security="none"/>
    <security:http pattern="/login" security="none"/>
    <security:http pattern="/error/**" security="none"/>
    
    <security:http auto-config="true">
        <security:form-login login-page="/login"
                             authentication-failure-url="/login?login_error=1"
                             default-target-url="/"
                             always-use-default-target="true"/>
        <security:logout logout-success-url="/"/>
        <security:intercept-url pattern="/**" access="ROLE_USER"/>
    </security:http>
    

    03-19-13

    为了使用 security 中的属性 http 标签,您将需要Spring Security 3.1…请参阅 http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#new-3.1-ns

        2
  •  2
  •   Kris    13 年前

    试试这个

    改变

    <intercept-url pattern="/login*" access="permitAll()" />

    <intercept-url pattern="/login*" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
    

    <intercept-url pattern="/login*" access="isAnonymous()" />
    

    由于你的表达式是true,我认为你必须使用isAnonymous()

    See docs

    intercept-url元素表示对登录页面的任何请求都应该对匿名用户可用。否则,请求将被模式/**匹配,并且不可能访问登录页面本身!这是一个常见的配置错误,将导致应用程序中出现无限循环。 Read more from here