Spring Security 自定义身份验证失败处理程序使用参数重定向

Question

我在使用参数重定向 Spring Security 身份验证失败处理程序时遇到问题。

当我使用时在安全配置中

failureUrl("/login.html?error=true")

它有效。但是当我使用自定义身份验证失败处理程序(如下所示)时，它总是返回:url/login.html

getRedirectStrategy().sendRedirect(request, response, "/login.html?error=true");

或

response.sendRedirect(request.getContextPath() + "/login.html?error=true");

我不知道出了什么问题。为什么不显示参数?error=true?

信息:我正在使用 Spring + JSF + Hibernate + Spring Security

@Override
protected void configure(HttpSecurity http) throws Exception {

    http
        .authorizeRequests()
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login.html")
            .usernameParameter("j_username")
            .passwordParameter("j_password")
            .loginProcessingUrl("/j_spring_security_check")
            .failureHandler(customAuthenticationFailureHandler)// .failureUrl("/login.html?error=true")//.successHandler(authSuccsessHandler)
            .defaultSuccessUrl("/dashboard.html")
            .permitAll()
            .and()
        .logout()
            .invalidateHttpSession(true)
            .logoutSuccessUrl("/")
            .permitAll()
            .and()
        .exceptionHandling()
            .accessDeniedPage("/access.html")
            .and()
        .headers()
            .defaultsDisabled()
            .frameOptions()
            .sameOrigin()
            .cacheControl();

    http
        .csrf().disable();
}

这是自定义身份验证失败处理程序:

@Component
public class CustomAuthFailureHandler extends SimpleUrlAuthenticationFailureHandler {

    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
            AuthenticationException exception) throws IOException, ServletException {
        getRedirectStrategy().sendRedirect(request, response, "/login.html?error=true");

    }
}

我会针对某些情况更改参数。

Answer 1

您不允许匿名访问 URL /login.html?error=true，因此您将被重定向到登录页面 (/login.html)。

AbstractAuthenticationFilterConfigurer#permitAll允许(任何人)访问失败 URL，但不允许访问自定义失败处理程序:

Ensures the urls for failureUrl(String) as well as for the HttpSecurityBuilder, the getLoginPage() and getLoginProcessingUrl() are granted access to any user.

您必须使用 AbstractRequestMatcherRegistry#antMatchers 显式允许访问:

Maps a List of AntPathRequestMatcher instances that do not care which HttpMethod is used.

和ExpressionUrlAuthorizationConfigurer.AuthorizedUrl#permitAll :

Specify that URLs are allowed by anyone.

您不必允许确切的 URL /login.html?error=true，因为 AntPathRequestMatcher忽略 query字符串:

Matcher which compares a pre-defined ant-style pattern against the URL ( servletPath + pathInfo) of an HttpServletRequest. The query string of the URL is ignored and matching is case-insensitive or case-sensitive depending on the arguments passed into the constructor.

您修改后的配置:

@Override
protected void configure(HttpSecurity http) throws Exception {

    http
        .authorizeRequests()
            .antMatchers("/login.html").permitAll()
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login.html")
            .usernameParameter("j_username")
            .passwordParameter("j_password")
            .loginProcessingUrl("/j_spring_security_check")
            .failureHandler(customAuthenticationFailureHandler)// .failureUrl("/login.html?error=true")//.successHandler(authSuccsessHandler)
            .defaultSuccessUrl("/dashboard.html")
            .permitAll()
            .and()
        .logout()
            .invalidateHttpSession(true)
            .logoutSuccessUrl("/")
            .permitAll()
            .and()
        .exceptionHandling()
            .accessDeniedPage("/access.html")
            .and()
        .headers()
            .defaultsDisabled()
            .frameOptions()
            .sameOrigin()
            .cacheControl();

    http
        .csrf().disable();
}