java - 我无法使用 spring security 登录

Question

我在 Spring Security 登录方面遇到问题。一切都设置正确(我想)，但它不会使用用户名和密码登录。我应用了一些代码:

   protected void configure(HttpSecurity http) throws Exception {
       http
               .authorizeRequests()
               .antMatchers(LOGIN, REGISTER, ERROR, SEARCH, CATEGORY, COMMENTS_GET, USER).permitAll()
               .antMatchers(ADMIN_DELETE_USER, ADMIN_RESTORE_USER, ADMIN_CREATE_MODERATOR, ADMIN_REVOKE_AUTHORITY, ADMIN_DELETE_CATEGORY)
               .access(ADMIN_AUTHORITY)
               .anyRequest().authenticated()
               .and()
               .csrf().disable()
               .formLogin().loginPage(LOGIN).permitAll()
               .loginProcessingUrl(LOGIN)
               .defaultSuccessUrl(ROOT)
               .and()
               .rememberMe()
               .rememberMeParameter(REMEMBER_PARAMETER)
               .rememberMeCookieName(REMEMBER_COOKIE_NAME)
               .key(REMEMBER_KEY)
               .tokenValiditySeconds(TOKEN_VALIDITY_SECONDS)
               .and()
               .logout().logoutUrl(LOGOUT)
               .logoutSuccessUrl(LOGIN)
               .permitAll();
   }


@GetMapping("/login")
   public ModelAndView login(ModelAndView modelAndView, Model model, Principal principal) {
       if (principal != null) {
           return new ModelAndView("redirect:/");
       }
       modelAndView.setViewName("login");
       modelAndView.addObject("title", "Login");
       if (model.containsAttribute("success")) {
           modelAndView.addObject("success");
       }

       return modelAndView;
   }

Answer 1

http.authorizeRequests().antMatchers("/","/resources/**", "/**").permitAll().anyRequest().authenticated().and().formLogin()
                .loginPage("/").permitAll().usernameParameter("username").passwordParameter("password")
                .loginProcessingUrl("/j_spring_security_check").failureUrl("/")
                .successHandler(myAuthenticationSuccessHandler()).and().logout().logoutSuccessUrl("/")
                .logoutUrl("/logout").invalidateHttpSession(true).deleteCookies("JSESSIONID").and().csrf().disable().headers().frameOptions().sameOrigin();

请尝试一下，希望对您有帮助。