spring-mvc - session 过期后不支持请求方法 'POST'

Question

我正在使用 Spring Security 运行一个 Spring MVC web 应用程序。每当我在 session 过期后提交/刷新页面时(使用 POST)我得到:

Request method 'POST' not supported

这是错误日志。如果我在 Spring Security 中禁用 CSRF，那么它工作正常。

org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported
at org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping.handleNoMatch(RequestMappingInfoHandlerMapping.java:204)
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.lookupHandlerMethod(AbstractHandlerMethodMapping.java:382)
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java:322)
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java:60)
at org.springframework.web.servlet.handler.AbstractHandlerMapping.getHandler(AbstractHandlerMapping.java:351)
at org.springframework.web.servlet.DispatcherServlet.getHandler(DispatcherServlet.java:1120)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:932)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:893)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:969)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:871)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:845)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:728)
at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:467)
at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:392)
at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:311)
at org.springframework.security.web.firewall.RequestWrapper$FirewalledRequestAwareRequestDispatcher.forward(RequestWrapper.java:139)
at org.springframework.security.web.access.AccessDeniedHandlerImpl.handle(AccessDeniedHandlerImpl.java:71)
at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:110)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:91)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:53)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:213)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:624)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)

这是我的Spring配置

http
    .authorizeRequests()
        .antMatchers("/login**").permitAll()
        .antMatchers("/help**").permitAll()
        .antMatchers("/faq/**").permitAll()
        .antMatchers("/denied").permitAll()
        .and()
    .formLogin()
        .loginPage("/login")
        .successHandler(customSuccessHandler())
        .and()
    .logout()
        .logoutUrl("/login?logout")
        .invalidateHttpSession(true).deleteCookies("JSESSIONID")
        .and()
    .exceptionHandling()
        .accessDeniedPage("/denied")
        .and()
    .exceptionHandling()
        .authenticationEntryPoint(ssoAuthenticationEntryPoint())
        .and()
    .addFilterBefore(userNameTransformationFilter(), UsernamePasswordAuthenticationFilter.class)
    .addFilterBefore(customPreAuthSecurityFilter(), BasicAuthenticationFilter.class)
    .addFilterAfter(waffleNegotiateSecurityFilter(), BasicAuthenticationFilter.class)
    .addFilterAfter(customNegotiateSecurityFilter(), BasicAuthenticationFilter.class)
    .authorizeRequests()
        .anyRequest().fullyAuthenticated();

这是认证入口点java类

    public class SSOAuthenticationEntryPoint extends NegotiateSecurityFilterEntryPoint {

    private static final Logger logger = Logger.getLogger(SSOAuthenticationEntryPoint.class);

    /*
     * (non-Javadoc)
     * @see org.springframework.security.web.AuthenticationEntryPoint#commence(javax.servlet.http.HttpServletRequest,
     * javax.servlet.http.HttpServletResponse, org.springframework.security.core.AuthenticationException)
     */
    @Override
    public void commence(final HttpServletRequest request, final HttpServletResponse response,
                         final AuthenticationException ex) throws IOException, ServletException {
        String ctxPath = ((HttpServletRequest) request).getContextPath();
        String requestURI = request.getRequestURI();
        logger.info(" start authentication process - " + requestURI);
        if (("" + ctxPath + "/rest/sso").equalsIgnoreCase(requestURI)) {
            super.commence(request, response, ex);
        } else {
            Boolean hasCheckedSSO = (Boolean) request.getSession().getAttribute(SecurityConstants.ATTR_HAS_CHECKED_SSO);
            Boolean ssoUserNotFound = (Boolean) request.getSession().getAttribute(SecurityConstants.ATTR_SSO_USER_NOT_FOUND);
            logger.info("hasCheckedSSO = " + hasCheckedSSO + ", ssoUserNotFound = " + ssoUserNotFound);
            String target = request.getRequestURI() + (request.getQueryString() != null ? "?" + request.getQueryString() : "");
            request.getSession().setAttribute(SecurityConstants.ATTR_TARGET, target);
            if (ssoUserNotFound != null && ssoUserNotFound) {
                response.sendRedirect(ctxPath + "/login?noaccess");
            } else if (hasCheckedSSO == null) {
                request.getSession().setAttribute("hasCheckedSSO", Boolean.TRUE);
                target = URLEncoder.encode(target, "UTF-8");
                response.sendRedirect(ctxPath + "/checkSSO?target=" + target);
            } else {
                response.sendRedirect(ctxPath + "/login");
            }
        }

    }
}

有什么建议吗？

Answer 1

如果您的 session 已过期，您的请求包含无效的 CSRF token (或根本没有 CSRF token )并且您的访问被拒绝。

您配置了一个访问被拒绝的页面，它创建了一个 AccessDeniedHandler , 请参阅 ExceptionHandlingConfigurer#accessDeniedPage :

Shortcut to specify the AccessDeniedHandler to be used is a specific error page

此基础 AccessDeniedHandler 将您的请求转发(无重定向)到拒绝访问页面，请参阅 AccessDeniedHandlerImpl :

This implementation sends a 403 (SC_FORBIDDEN) HTTP error code. In addition, if an errorPage is defined, the implementation will perform a request dispatcher "forward" to the specified error page view. Being a "forward", the SecurityContextHolder will remain populated. This is of benefit if the view (or a tag library or macro) wishes to access the SecurityContextHolder. The request scope will also be populated with the exception itself, available from the key WebAttributes.ACCESS_DENIED_403.

因此，您需要一个拒绝访问的页面，不仅支持 HTTP GET，还支持 POST 和所有其他使用的 HTTP 方法。