java - Spring Security 忽略 successHandler 和 failureHandler

Question

我正在将 Spring Security 的配置从 xml 移至 Java Config。然而，由于某种原因，当我尝试使用自定义的 successHandler 或 failureHandler 时，spring 只是忽略它们。我错过了什么吗？

我在互联网上查看了很多示例，但找不到此配置的问题所在:

@Override
protected void configure(HttpSecurity http) throws Exception {

    http.csrf().disable()
        .addFilterBefore(concurrentFilter, ConcurrentSessionFilter.class)
        .addFilterAfter(myFilter(), UsernamePasswordAuthenticationFilter.class)
        .sessionManagement()
        .sessionAuthenticationStrategy(sessionAuthenticationStrategy());

    http
        .authorizeRequests()
        .accessDecisionManager(accessDecisionManager())

        .antMatchers("/login.xhtml").permitAll()
        .antMatchers("/403.xhtml").access("IS_AUTHENTICATED_ANONYMOUSLY")   
        .antMatchers("/wrecked-db.xhtml").access("ROLE_USER")   
        .antMatchers("/admin.xhtml").access("ROLE_ADMIN")   

        .antMatchers("/**.xhtml").access("NO_ACCESS")

        .and().formLogin()
        .loginPage("/login.xhtml")
        .successHandler(customAuthenticationSuccessHandler)
        .failureHandler(customAuthenticationFailureHandler)
        .usernameParameter("j_username")
        .passwordParameter("j_password")

        .and().logout().logoutUrl("/logout.xhtml")
        .logoutSuccessUrl("/login.xhtml")
        .deleteCookies("JSESSIONID")

        .and().exceptionHandling().accessDeniedHandler(customAccessDeniedHandler);
}

Answer 1

我拿了你的并做了一些修改，这个对我来说工作得很好，

http
  .csrf().disable()
  .authorizeRequests()
  .antMatchers("/403.xhtml").access("IS_AUTHENTICATED_ANONYMOUSLY")   
  .antMatchers("/wrecked-db.xhtml").access("ROLE_USER")   
  .antMatchers("/admin.xhtml").access("ROLE_ADMIN")   
  .antMatchers("/**.xhtml").access("NO_ACCESS")
  .antMatchers("/login*").permitAll().anyRequest().authenticated()
  .and().formLogin()
  .loginPage("/login.html")
  .loginProcessingUrl("/login")
  .successHandler(new AuthenticationSuccessHandler() {
      @Override
      public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
          System.out.println("AuthenticationSuccessHandler");

      }
  })
  .failureHandler(new AuthenticationFailureHandler() {
      @Override
      public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
          System.out.println("AuthenticationFailureHandler");

      }
  })
  .and().logout().logoutUrl("/logout.xhtml")
  .logoutSuccessUrl("/login.xhtml")
  .deleteCookies("JSESSIONID");

我的登录页面将类似于

<form action="login" method='POST'>
    <table>
       <tr>
          <td>UN</td>
          <td><input type='text' name='username' value=''></td>
       </tr>
       <tr>
          <td>Pass</td>
          <td><input type='password' name='password' /></td>
       </tr>
       <tr>
          <td><input name="submit" type="submit" value="submit" /></td>
       </tr>
    </table>
</form>