java - Spring-security:登录用户页面时得到http状态405

Question

我使用两种不同的 WebSecurityConfigurerAdapter 配置来重定向到管理员和用户之间的不同登录页面。

管理页面工作正常，而用户页面在将用户名和密码数据发布到/login/user 界面时收到 http 状态代码 405 方法，不允许使用

我查了很多，有人说需要禁用 csrf ，但我已经禁用了。

下面是我的代码

@EnableWebSecurity
public class MultiHttpSecurityConfig {

    /**
     * intercept user url
     */
    @Configuration
    @Order(1)
    public static class UserWebSecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        CustomAuthenticationSuccessHandler successHandler;

        @Autowired
        CustomAuthenticationFailureHandler failureHandler;

        @Autowired
        private CustomAuthenticationProvider customAuthProvider;

        @Autowired
        private CustomUserDetailsService userDetailsService;

        @Value("${my.cookie.timeout}")
        private int cookieTimeOut;


        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable();
            http.requestMatchers()
                .antMatchers("/bbb/**", "/aaa/**")
                .and()
                .authorizeRequests()
                .antMatchers("/**").hasAnyRole("USER");
            http.formLogin()
                .successHandler(successHandler)
                .failureHandler(failureHandler)
                .loginPage("/login/user").permitAll();
            http.logout().permitAll();

            http.rememberMe().key("uniqueAndSecret").tokenValiditySeconds(cookieTimeOut);
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.authenticationProvider(customAuthProvider);
            auth.userDetailsService(userDetailsService);
        }
    }


    /**
     * intercept admin url
     */
    @Configuration
    public static class AdminWebSecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        CustomAuthenticationSuccessHandler successHandler;

        @Autowired
        CustomAuthenticationFailureHandler failureHandler;

        @Value("${my.cookie.timeout}")
        private int cookieTimeOut;

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable();
            http.authorizeRequests()
                .antMatchers("/ccc/**","/dddd").hasAnyRole("ADMIN");
            http.formLogin()
                .successHandler(successHandler)
                .failureHandler(failureHandler)
                .loginPage("/login/admin").permitAll();
            http.logout().permitAll();

            http.rememberMe().key("uniqueAndSecret").tokenValiditySeconds(cookieTimeOut);
        }

        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication()
                .withUser("test").password("test").roles("ADMIN");
        }
    }
}

更新:在我将“/login/user”添加到用户模式后，它工作正常。

http.requestMatchers()
                .antMatchers("/dl/**", "/reinstall/**","/login/user/**")
                .and()
                .authorizeRequests()
                .antMatchers("/**").hasAnyRole("USER");
            http.formLogin()
                .successHandler(successHandler)
                .failureHandler(failureHandler)
                .loginPage("/login/user").permitAll();

emmmm，我不太了解 spring-security 中的这种机制

Answer 1

参见类似Multiple websecurityconfigureradapter 中给出的答案问题。您可能需要重写两者中的 AuthenticationManagerBuilder 而不是 Autowiring 其中任何一个。