是否需要通过https和spring security进行身份验证?

如果在任何时候您通过HTTP传递会话id,那么您就违反了 OWASP A9 . 如果攻击者拥有会话id,则不需要密码。我不会在你的应用程序中实现此功能,https非常轻,我认为你应该考虑在不意味着你的客户端将被黑客攻击的地方节省资源。

我不知道如何使用springmvc来实现它,但是我确实使用Grails和springsecurity3实现了这一点……如果您感兴趣,可以查看我的博客文章 here

因为这对你没什么帮助…我在谷歌上搜索了一下,发现 this 张贴正确的,并说要配置您的网站.xml:

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
        /WEB-INF/applicationContext-security.xml
    </param-value>
</context-param>

     <filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

  <beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.1.xsd">

    <http>
        <intercept-url pattern="/url1.htm"
        access="IS_AUTHENTICATED_ANONYMOUSLY" requires-channel="https" />
        <intercept-url pattern="/url2.htm"
        access="IS_AUTHENTICATED_ANONYMOUSLY" requires-channel="https" />
        <intercept-url pattern="/**"
        access="IS_AUTHENTICATED_ANONYMOUSLY" requires-channel="http" />

        <anonymous />
        <http-basic/>
    </http>

    <!-- This bean is optional; it isn't used by any other bean as it only listens and logs -->
    <beans:bean id="loggerListener" class="org.springframework.security.event.authentication.LoggerListener"/>

</beans:beans>

也看看这个 site