java - Spring Security 教程不适用于 Tomcat 服务器

Question

我做了这个教程 https://spring.io/guides/gs/securing-web/它将 SpringBoot 和 SpringSecurity 用于 WebApplication。正如教程中所述，整个项目通过主类执行并使用自动配置进行配置。

我的目标是使用在 Tomcat 服务器上运行的相同东西(我使用的是 IntelliJ IDEA)。一切都在没有任何错误的情况下执行，但不知何故，如果我转到“你好”页面，我不会被重定向到登录页面。相反，它向我显示 Hello null!。在调试日志中，我可以看到以下内容:

10:34:06.102 [http-apr-8080-exec-5] DEBUG o.s.web.servlet.DispatcherServlet - DispatcherServlet with name 'dispatcher' processing GET request for [/hello]
10:34:06.103 [http-apr-8080-exec-5] DEBUG o.s.w.s.h.SimpleUrlHandlerMapping - Mapping [/hello] to HandlerExecutionChain with handler [org.springframework.web.servlet.mvc.ParameterizableViewController@225a46d1] and 1 interceptor
10:34:06.103 [http-apr-8080-exec-5] DEBUG o.s.web.servlet.DispatcherServlet - Last-Modified value for [/hello] is: -1
10:34:06.103 [http-apr-8080-exec-5] DEBUG o.s.w.s.v.ContentNegotiatingViewResolver - Requested media types are [text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8] based on Accept header types and producible media types [*/*])
10:34:06.103 [http-apr-8080-exec-5] DEBUG o.s.w.s.view.BeanNameViewResolver - No matching bean found for view name 'hello'
10:34:06.103 [http-apr-8080-exec-5] DEBUG o.s.w.s.v.ContentNegotiatingViewResolver - Returning [org.thymeleaf.spring4.view.ThymeleafView@2c9dacea] based on requested media type 'text/html'
10:34:06.104 [http-apr-8080-exec-5] DEBUG o.s.web.servlet.DispatcherServlet - Rendering view [org.thymeleaf.spring4.view.ThymeleafView@2c9dacea] in DispatcherServlet with name 'dispatcher'
10:34:06.104 [http-apr-8080-exec-5] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'requestDataValueProcessor'
10:34:06.104 [http-apr-8080-exec-5] DEBUG org.thymeleaf.TemplateEngine - [THYMELEAF][http-apr-8080-exec-5] STARTING PROCESS OF TEMPLATE "hello" WITH LOCALE de
10:34:06.104 [http-apr-8080-exec-5] DEBUG org.thymeleaf.TemplateEngine - [THYMELEAF][http-apr-8080-exec-5] Starting process on template "hello" using mode "HTML5"
10:34:06.104 [http-apr-8080-exec-5] DEBUG org.thymeleaf.TemplateEngine - [THYMELEAF][http-apr-8080-exec-5] Finished process on template "hello" using mode "HTML5"
10:34:06.104 [http-apr-8080-exec-5] DEBUG org.thymeleaf.TemplateEngine - [THYMELEAF][http-apr-8080-exec-5] FINISHED PROCESS AND OUTPUT OF TEMPLATE "hello" WITH LOCALE de
10:34:06.104 [http-apr-8080-exec-5] DEBUG org.thymeleaf.TemplateEngine.TIMER - [THYMELEAF][http-apr-8080-exec-5][hello][de][644609][1] TEMPLATE "hello" WITH LOCALE de PROCESSED IN 644609 nanoseconds (approx. 1ms)
10:34:06.104 [http-apr-8080-exec-5] DEBUG o.s.web.servlet.DispatcherServlet - Successfully completed request

我想要一个纯基于 java 的配置并根据 Spring Docs 进行设置.

我的 AppConfig 如下所示:

@EnableAutoConfiguration //do magic
@Configuration
@ComponentScan("de.visargue")
@Import({MvcConfig.class, SecurityConfig.class})
public class AppConfig {

    public static void main(String[] args) throws Throwable {
        SpringApplication.run(AppConfig.class, args);
    }
}

SecurityConfig 与教程中的一样。通过调试我可以看到这些方法是在部署 war 时执行的。但是，重定向到登录页面不再有效。

通过单击注销，输出显示找不到处理程序。

10:42:07.653 [http-apr-8080-exec-7] DEBUG o.s.web.servlet.DispatcherServlet - DispatcherServlet with name 'dispatcher' processing POST request for [/logout]
10:42:07.653 [http-apr-8080-exec-7] DEBUG o.s.w.s.m.m.a.RequestMappingHandlerMapping - Looking up handler method for path /logout
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.w.s.m.m.a.RequestMappingHandlerMapping - Did not find handler method for [/logout]
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.w.s.h.SimpleUrlHandlerMapping - Matching patterns for request [/logout] are [/**]
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.w.s.h.SimpleUrlHandlerMapping - URI Template variables for request [/logout] are {}
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.w.s.h.SimpleUrlHandlerMapping - Mapping [/logout] to HandlerExecutionChain with handler [org.springframework.web.servlet.resource.ResourceHttpRequestHandler@45dfaa56] and 1 interceptor
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.w.s.m.a.ResponseStatusExceptionResolver - Resolving exception from handler [org.springframework.web.servlet.resource.ResourceHttpRequestHandler@45dfaa56]: org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.w.s.m.s.DefaultHandlerExceptionResolver - Resolving exception from handler [org.springframework.web.servlet.resource.ResourceHttpRequestHandler@45dfaa56]: org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported
10:42:07.654 [http-apr-8080-exec-7] WARN  o.s.web.servlet.PageNotFound - Request method 'POST' not supported
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.web.servlet.DispatcherServlet - Null ModelAndView returned to DispatcherServlet with name 'dispatcher': assuming HandlerAdapter completed request handling
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.web.servlet.DispatcherServlet - Successfully completed request

有人能解释一下为什么当我通过 main 方法启动项目时整个设置工作正常，但当它作为 war 部署在 tomcat 服务器上时却不工作吗？

Answer 1

我刚刚找到了解决方案。对于 WAR，您需要添加另一个类。我将我的添加到其他配置类所在的配置包中。

import org.springframework.security.web.context.*;

public class MessageSecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
}

这就是让它工作所需的一切。

在本教程中描述:http://docs.spring.io/autorepo/docs/spring-security/3.2.x/guides/hellomvc.html#registering-spring-security-with-the-war