个人中心
gpt4 book ai didi

jsf - Spring 安全中的ajax

转载 作者：行者123 更新时间：2023-12-04 19:14:17 27 4
gpt4 key购买 nike

我使用spring security+JSF+primefaces
在自定义登录中，我放了一个命令按钮
但命令按钮没有工作...
当在 p:commandbutton ----------> ajax="false"----------> 工作时!
当在 jsf(core) 中使用 f:ajax 时 --------> 没有工作
我在 spring security.xml 文件中使用:

test.xhtml ----> jsf(core) --------> 没有工作

 <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE html
            PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
            "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
    <html xmlns="http://www.w3.org/1999/xhtml" xmlns:h="http://java.sun.com/jsf/html" xmlns:f="http://java.sun.com/jsf/core"
          xml:lang="en" lang="en">
    <head>
        <title>faces-request</title>           
    </head>
    <body>
    <h:form>
        <center>
            <h:outputText id="outtxt" value="#{authentiocationBean.ajaxTest}"/><br/>
            <h:inputText id="intxt" value="#{authentiocationBean.ajaxTest}"/><br/>
            <h:commandButton value="Submit">
                <f:ajax execute="intxt" render="outtxt"/>
            </h:commandButton>        
        </center>
    </h:form>

    </body>
    </html>

Spring_security.xml: 
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-3.2.xsd">


    <http auto-config="true" use-expressions="true">
        <intercept-url pattern="/Admin/*" access="hasRole('ROLE_ADMIN')"/>
        <intercept-url pattern="/user/*" access="hasAnyRole('ROLE_USER,ROLE_ADMIN')"/>           
        <form-login login-page="/login.xhtml"
                    authentication-failure-url="/Fail.xhtml?error"/>
        <logout logout-url="/j_spring_security_logout" delete-cookies="JSESSIONID,SPRING_SECURITY_REMEMBER_ME_COOKIE"
                invalidate-session="true"
                logout-success-url="/login.xhtml"/>
        <session-management session-authentication-error-url="/401.xhtml" session-fixation-protection="migrateSession">
            <concurrency-control max-sessions="1" expired-url="/login.xhtml"/>
        </session-management>

        <remember-me key="myAppKey"/>
        <access-denied-handler error-page="/AccDe.xhtml"/>
        <headers>
            <xss-protection/>
            <frame-options/>
            <cache-control/>
            <content-type-options/>
        </headers>
        <csrf/>

    </http>

    <authentication-manager alias="authenticationManager">
        <authentication-provider>
            <jdbc-user-service data-source-ref="myDataSource"
                               users-by-username-query="select username, password, active from users where username=?"
                               authorities-by-username-query="select us.username, ur.authority from users us, user_roles ur
                    where us.user_id = ur.user_id and us.username =?  "
                    />
            <password-encoder ref="passwordEncoder" hash="sha-256"/>

        </authentication-provider>
    </authentication-manager>


    <bean id="passwordEncoder"
          xmlns="http://www.springframework.org/schema/beans"
          class="org.springframework.security.authentication.encoding.ShaPasswordEncoder">
        <!--org.springframework.security.crypto.password.PasswordEncoder       for salt!-->
        <constructor-arg value="256"/>
    </bean>



</beans:beans>

登录页面: 
<?xml version='1.0' encoding='UTF-8' ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:h="http://java.sun.com/jsf/html"
      xmlns:p="http://primefaces.org/ui">
<h:head>

    <title>faces-request</title>     
</h:head>
<h:body>
    <h:form prependId="false" id="formLogin">
        <center>
            <p:panelGrid style="border-width: 0px;" columns="2">
                UserName:
                <p:inputText required="true" id="j_username"/>
                Password:
                <p:password required="true" id="j_password"/>
            </p:panelGrid>               
            <p:commandButton type="submit" id="login" action="#{authentiocationBean.doLogin()}" value="Login"/>
            <p:outputLabel for="_spring_security_remember_me" value="Remember me: "/>
            <p:selectBooleanCheckbox id="_spring_security_remember_me"/>
            <br/>
        </center>
    </h:form>
</h:body>
</html>

AuthentiocationBean 类 
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;

import java.io.IOException;
import javax.faces.bean.ManagedBean;
import javax.faces.bean.RequestScoped;
import javax.faces.context.ExternalContext;
import javax.faces.context.FacesContext;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;


/**
 * @author Admin
 */
@RequestScoped
@ManagedBean
public class AuthentiocationBean {
    public String ajaxTest = "Test";
    boolean isLogged = false;
    public String role = "ROLE_ADMIN";
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    String name = auth.getName();

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }


    public String doLogin() throws IOException, ServletException {
        isLogged = true;
        FacesContext facesContext = FacesContext.getCurrentInstance();
        ExternalContext context = facesContext.getExternalContext();
        RequestDispatcher dispatcher = ((ServletRequest) context.getRequest()).getRequestDispatcher("/j_spring_security_check");
        dispatcher.forward((ServletRequest) context.getRequest(), (ServletResponse) context.getResponse());
        FacesContext.getCurrentInstance().responseComplete();
        // It's OK to return null here because Faces is just going to exit.
        return null;
    }

    public void doLogout() {
//        FacesContext.getCurrentInstance().getExternalContext().invalidateSession();
//       return "/logout.xhtml";
//       return null;
    }

    public boolean isLogged() {
        return isLogged;
    }

    public void setLogged(boolean logged) {
        isLogged = logged;
    }

    public String getRole() {
        return role;
    }

    public void setRole(String role) {
        this.role = role;
    }

    public String getAjaxTest() {
        return ajaxTest;
    }

    public void setAjaxTest(String ajaxTest) {
        this.ajaxTest = ajaxTest;
    }


}

谢谢

最佳答案

它只是一个登录页面，为什么要使用 AJAX 呢？

我已将 Spring 3.1.4 LDAP 支持与 JSF 集成。虽然我最初编写了一个自定义身份验证 bean，但我不再使用它。我不是专家，而且我确信这与我实现的方式不同。

(1) 简单登录页面(摘录):
<h:inputText id="j_username"/>
<h:inputText type="password" id="j_password" value=""/>
<h:commandButton name="submit" type="submit" value="Log In" />
<input type="reset" value="Reset" />

(2.1) 在 web.xml 中，我声明了一个上下文参数来命名安全配置文件(在下面的步骤 3 中提到)。
我还声明了 Spring 安全过滤器链，您可以在此处阅读:
http://docs.spring.io/spring-security/site/docs/3.1.4.RELEASE/reference/security-filter-chain.html#filter-chains-with-ns

(2.2) 在faces-config中我声明:<el-resolver>org.springframework.web.jsf.el.SpringBeanFacesELResolver</el-resolver>
(2.3) 在faces-config 中，我声明了一个具有 session 范围的自定义UserSession bean。
UserSession bean 有这个方法:

@PostConstruct  
public void loadAuthorities() {
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    . . .
    . . .
}

(3) UserSession bean 是从登录页面 (menu.xhtml) 中引用的，该页面在我的安全配置文件中声明(在上面的步骤 2.1 中在 web.xml 中声明): 

<security:form-login default-target-url="/menu.xhtml" always-use-default-target="true"     authentication-failure-url="/denied.xhtml" />                
<security:logout invalidate-session="true" delete-cookies="JSESSIONID" logout-url="/j_spring_security_logout" />

(4) 用户通过身份验证，然后重定向到 menu.xhtml
Menu.xhtml 导致加载 UserSession bean。

UserSession bean 从 SecurityContext 中拉取权限列表。

UserSession bean 提供了简单的包装器来检查用户是否有权查看页面和资源: 

public boolean isRole(String role) {
    return authorities.contains((String) role);
}

public boolean roleContains(String s);
public boolean roleEndsWith(String s);
. . .
. . .

关于jsf - Spring 安全中的ajax，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/23787473/

27 4 0
文章推荐： 从子进程派生后的gdb分离-禁用？
文章推荐： CSS 分页媒体 :last page selector
文章推荐： sms - 能否在 Twilio 中保存和安排 SMS 发送？如果没有，我该如何完成？
文章推荐： asp.net-mvc - 找到 : DisplayTemplates Speed
行者123
个人简介

我是一名优秀的程序员,十分优秀！

滴滴打车优惠券免费领取
滴滴打车优惠券
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com