java - 如何在最简单的情况下正确配置spring security？

Question

我有 Controller :

@Controller
public class SecurityController{

    @RequestMapping(value="/403")
    public String renderAccessDeniedPage(){
        return "403";
    }

    @RequestMapping(value="/admin")
    public String renderAdminWelcomePage(){
        return "admin/welcome";
    }
}

当请求被 spring-security 重定向到安全 View 时，它应该呈现安全 View 。我有以下配置:

web.xml

  <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>/WEB-INF/coreContext.xml /WEB-INF/securityContext.xml</param-value>
  </context-param>

  <servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value></param-value>
    </init-param>
  </servlet>

  <servlet-mapping>
    <servlet-name>dispatcher</servlet-name>
    <url-pattern>/</url-pattern>
  </servlet-mapping>

  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>

  <filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>

  <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/</url-pattern>
  </filter-mapping>

ant securityContext 本身:

<security:http auto-config="true" use-expressions="true">
    <security:access-denied-handler error-page="/403" />
    <security:intercept-url pattern="admin/**" access="hasRole('ADMIN')" />
    <security:form-login login-page="/" username-parameter="user" password-parameter="pass" login-processing-url="/" />
</security:http>

<security:authentication-manager>
    <security:authentication-provider>
        <security:jdbc-user-service data-source-ref="xaDataSource" 
        authorities-by-username-query="select name, role from users where name = ?" 
        users-by-username-query="select name, password, enabled from users_auth where name = ?" />
    </security:authentication-provider>
</security:authentication-manager>

问题是，当我尝试发送请求以通过浏览器呈现页面时，即使我没有登录，我也只是得到了我请求的页面(例如 admin.jsp)。我尝试调试，发现没有调用我在 web.xml 中声明的 org.springframework.web.filter.DelegatingFilterProxy 的任何方法。怎么了？

Answer 1

除了 AlanBarrows 注释(使用 <security:intercept-url pattern="/admin/**" )之外，您还应该将过滤器映射到 /*而不是/ :

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

PS:很高兴注意到相关信息:没有调用 DelegatingFilterProxy 的任何方法