java - 如何启用Spring安全性？

Question

我想知道为什么我的 Spring 安全性不起作用。我有这个 spring-security.xml

<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.1.xsd">

     <http auto-config='true'>
        <intercept-url pattern="/**" access="ROLE_USER" />
        <port-mappings>
            <port-mapping http="8088" https="9443"/>
        </port-mappings>
    </http>

    <authentication-manager>
        <authentication-provider>
            <user-service>
                <user name="admin" password="password2" authorities="ROLE_USER" />
                <user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN" />
                <user name="bob" password="bobspassword" authorities="ROLE_USER" />
            </user-service>
        </authentication-provider>
    </authentication-manager>

</beans:beans>

然后我得到了这个 web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/spring/admin-servlet-common.xml
            /WEB-INF/spring/admin-servlet-controller.xml
            /WEB-INF/spring/admin-servlet-security.xml
            /WEB-INF/spring/admin-servlet-service.xml
            /WEB-INF/spring-security.xml
            classpath:ses-service.xml
        </param-value>
    </context-param>

    <context-param>
        <param-name>log4jConfigLocation</param-name>
        <param-value>/WEB-INF/log4j.xml</param-value>
    </context-param>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    <listener>
        <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
    </listener>


    <!-- Reads request input using UTF-8 encoding -->
    <filter>
        <filter-name>characterEncodingFilter</filter-name>
        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>UTF-8</param-value>
        </init-param>
        <init-param>
            <param-name>forceEncoding</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>characterEncodingFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- Enables clean URLs with JSP views e.g. /welcome instead of /app/welcome -->
    <filter>
        <filter-name>UrlRewriteFilter</filter-name>
        <filter-class>org.tuckey.web.filters.urlrewrite.UrlRewriteFilter</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>UrlRewriteFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- Spring Security -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- Handles all requests into the application -->
    <servlet>
        <servlet-name>ses</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>2</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>ses</servlet-name>
        <url-pattern>/app/*</url-pattern>
    </servlet-mapping>
</web-app>

但它既不给出错误消息也不启用安全性。我的网络应用程序没有任何变化，我仍然可以浏览页面，例如http://localhost:8088/admin/login 和 http://localhost:8088/admin/menu 。该项目是网络应用程序的管理部分，我正在为管理网络启用安全性。可以做什么？我想要使​​用的自己的登录页面是 http://localhost:8088/admin/login 并且我想保护管理员角色的其余/admin* 页面。

Answer 1

UrlRewriteFilter 首先列出，并将通过转发到应用程序内的其他位置来绕过 Spring Security。一般来说，springSecurityFilterChain 应该是 web.xml 中的第一个，以确保它拦截所有请求。

我还考虑一起删除 UrlRewriteFilter (因为它可能会在拦截 URL 中造成非常困惑的映射。过去，它用于删除分配给 Springs DispatcherServlet 的/app 映射，这可以通过映射轻松避免DispatcherServlet 到/

<servlet-mapping>
  <servlet-name>ses</servlet-name>
  <url-pattern>/</url-pattern>
</servlet-mapping>

您可以在 Spring Security forums 上找到有关 Spring Security 和 UrlRewriteFilter 的更多讨论