java - Spring mvc + jsp页面中的安全css和js

Question

我的 jsp 页面无法打开 css 和 js 文件。我尝试了一些在这里找到的解决方案，例如:

<link rel="stylesheet" type="text/css" href="./style/styles.css">
 <link rel="stylesheet" type="text/css" href="./pages//style/style.css">
 <link href="${pageContext.request.contextPath}/style/style.css" rel="stylesheet"/>
<link href="${pageContext.request.contextPath}/pages/style/style.css" rel="stylesheet"/>
<link type="text/css" rel="stylesheet" href="<c:url value="style/style.css" />" /> 

但没有任何帮助。

我的 securityConfig 类:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    @Qualifier("userDetailsService")
    UserDetailsService userDetailsService;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests().antMatchers("/admin/**").access("hasRole('ROLE_ADMIN')")
                 .antMatchers("/user/**").access("hasRole('ROLE_USER')")
                 .antMatchers("/basket/**").access("hasRole('ROLE_USER')")
                  .antMatchers("/resources/**", "/**").permitAll()
                 .and().formLogin()
            .loginPage("/login").failureUrl("/login?error")
                .usernameParameter("username")
                .passwordParameter("password")
                .and().logout().logoutSuccessUrl("/login?logout")
                .and().csrf()
                .and().exceptionHandling().accessDeniedPage("/403");
    }

    @Bean
    public PasswordEncoder passwordEncoder(){
        PasswordEncoder encoder = new BCryptPasswordEncoder();
        return encoder;
    }

}

CSS 文件无法在存在 Spring security 的情况下以及在纯 Spring MVC 中打开。在调试日志中:

/style/style.css at position 1 of 12 in additional filter chain ....
/style/style.css at position 12 of 12 in additional filter chain
 Secure object: FilterInvocation: URL: /style/style.css; Attributes: [permitAll]

https://github.com/Panwo/ProjV2.git

编辑:

@Configuration
public class NewConfigure extends WebMvcConfigurerAdapter {
    @Override
    public void addResourceHandlers(final ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/resources/**").addResourceLocations("/resources/");
    }
}

我应该声明这个类还是将它注入(inject)到任何地方，也许在SpringMvcInitializer 扩展 AbstractAnnotationConfigDispatcherServletInitializer？

编辑2

可能是设置有问题吗？当我从 war 中删除 Web 模块时，我得到 404。

Answer 1

我猜您没有指定静态资源映射。因此您的调度程序正在寻找静态资源的映射。由于您使用的是基于 Java 的配置，因此请添加一个从 WebMvcConfigurerAdapter 扩展的配置类并重写以下方法:

@Override
public void addResourceHandlers(final ResourceHandlerRegistry registry) {
    registry.addResourceHandler("/resources/**").addResourceLocations("/resources/");
}

现在你必须在你的jsp中引用:

<link rel="stylesheet" type="text/css" href="/resources/style/styles.css">

编辑:(回应您更新的问题)

public class SpringMvcInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {
    @Override
    protected Class<?>[] getRootConfigClasses() {
        return new Class[] { AppConfig.class };
    }

    @Override
    protected Class<?>[] getServletConfigClasses() {
        return new Class[]{NewConfigure.class}; // Here is your updated config
    }

    @Override
    protected String[] getServletMappings() {
        return new String[] { "/" };
    }

}