java - Spring MVC : Redirecting to login when user trying to access secure resource

Question

• 我正在开发一个 Spring-MVC 应用程序，我在其中发送电子邮件其中包含 @RequestMapping 的链接，而 @RequestMapping 又尝试访问 ROLE_USER 下的资源。

  • 问题是，我想将用户重定向到位于/login 的登录页面如果他/她尝试访问任何安全资源，则直接访问。我尝试过了搜索类似的内容，但找不到任何完全匹配的内容。我是粘贴我的 security-application-context.xml。请看一下。

  <!-- Global Security settings -->
  <security:global-method-security pre-post-annotations="enabled" />
  <security:http pattern="/resources/**" security="none"/>
  
  <security:http create-session="ifRequired" use-expressions="true" auto-config="true" disable-url-rewriting="true">
      <security:form-login login-page="/login" default-target-url="/canvas/list" always-use-default-target="false" authentication-failure-url="/denied.jsp"  />
      <security:remember-me key="_spring_security_remember_me" user-service-ref="userDetailsService" token-validity-seconds="1209600" data-source-ref="dataSource"/>
      <security:logout delete-cookies="JSESSIONID" invalidate-session="true" logout-url="/j_spring_security_logout"/>
      <security:access-denied-handler error-page="/login"/>
  
  <security:port-mappings>
      <security:port-mapping http="80" https="443"/>
  </security:port-mappings>
      <security:session-management invalid-session-url="/login"/>
  </security:http>
  
  <!-- queries to be run on data -->
  <beans:bean id="rememberMeAuthenticationProvider" class="org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices">
      <beans:property name="key" value="_spring_security_remember_me" />
      <beans:property name="tokenRepository" ref="jdbcTokenRepository"/>
      <beans:property name="userDetailsService" ref="LoginServiceImpl"/>
  </beans:bean>
  
  <!--Database management for remember-me -->
  <beans:bean id="jdbcTokenRepository"
              class="org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl">
      <beans:property name="createTableOnStartup" value="false"/>
      <beans:property name="dataSource" ref="dataSource" />
  </beans:bean>
  
  <!-- Remember me ends here -->
  <security:authentication-manager alias="authenticationManager">
      <security:authentication-provider user-service-ref="LoginServiceImpl">
         <security:password-encoder  ref="encoder"/>
      </security:authentication-provider>
  </security:authentication-manager>
  
  <beans:bean id="encoder"
              class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
      <beans:constructor-arg name="strength" value="11" />
  </beans:bean>
  
  <beans:bean id="daoAuthenticationProvider"
              class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
              <beans:property name="userDetailsService" ref="LoginServiceImpl"/>
             <beans:property name="passwordEncoder" ref="encoder"/>
  </beans:bean>
  

任何帮助都会很好。多谢。 :-)

Answer 1

您需要提供<intercept-url> <security-http> 中的元素。目前 Spring Security 不保护任何 url。

您还需要添加 <session-management>到您的配置并指定 invalid-session-url属性。

尝试查看 spring 文档:

<intercept-url> info

<session-management> info

当用户尝试访问 protected 资源时，他们应该被重定向到登录页面。