spring - Thymeleaf 身份验证对象在错误页面上为 null 或为空

Question

成功登录后，身份验证显然不为空，但仍然登录时强制发生错误，使身份验证为空。

• Spring Boot 1.3.1
• thymeleaf 2.1.4
• Thymeleaf-Spring4 2.1.4
• Thymeleaf-Extras-SpringSecurity4

error.html(处理错误/异常的自定义错误页面)

...          
<header th:include="fragments/menu :: menu"></header>
...

menu.html(错误/异常期间不会显示所有菜单项)

 ...
 <li sec:authorize="hasAnyRole('ADMIN', 'MANAGER')">
 ...
 </li>
 ...
 <li sec:authorize="isAuthenticated()"><a id="logoff" href="#logoff">Log Off</a></li>
 ..

这种行为是预期的还是我错过了什么？我希望身份验证对象不为空，这样我就可以重新显示安全的 URL 链接。

Answer 1

这是 Spring Boot 的一个已知问题，甚至记录在 the documentation 中:

N.B. if you register an ErrorPage with a path that will end up being handled by a Filter (e.g. as is common with some non-Spring web frameworks, like Jersey and Wicket), then the Filter has to be explicitly registered as an ERROR dispatcher (the default FilterRegistrationBean does not include the ERROR dispatcher type).

示例:

@Bean
public FilterRegistrationBean myFilter() {
    FilterRegistrationBean registration = new FilterRegistrationBean();
    registration.setFilter(new MyFilter());
    ...
    registration.setDispatcherTypes(EnumSet.allOf(DispatcherType.class));
    return registration;
}

另请参阅related issue in Spring Boot tracker .

但从 1.3.1 开始，您可以通过将以下行添加到 application.properties 来更简单地配置它(请参阅 #4505 ):

security.filter-dispatcher-types: ASYNC, FORWARD, INCLUDE, REQUEST, ERROR