Spring Security：不支持身份驗證方法：GET

我不知道我在哪裏丟失了一些東西，真的很感激您對此的幫助！我登錄後得到「身份驗證方法不支持：GET」消息。Spring Security：不支持身份驗證方法：GET

這裏是我的安全context.xml中：

<?xml version="1.0" encoding="UTF-8"?> 
<beans xmlns="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:context="http://www.springframework.org/schema/context" 
    xmlns:security="http://www.springframework.org/schema/security" 
    xmlns:tx="http://www.springframework.org/schema/tx" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
       http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
       http://www.springframework.org/schema/security 
       http://www.springframework.org/schema/security/spring-security-3.1.xsd"> 

    <!-- <security:http auto-config="true" access-decision-manager-ref="accessDecisionManager"> --> 
    <security:http auto-config="true"> 
     <security:intercept-url pattern="/login/login.do" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/login/doLogin.do" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/lib/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/css/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/images/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/resources/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_REMEMBERED" /> 
     <security:form-login login-page="/login/login.do" authentication-failure-url="/login/login.do?login_error=true" default-target-url="/test/showTest.do"/> 
     <security:logout logout-success-url="/login/login.do" invalidate-session="true" /> 
     <security:remember-me key="rememberMe"/> 
    </security:http>  


    <security:authentication-manager> 
     <security:authentication-provider> 
      <security:jdbc-user-service data-source-ref="dataSource" 
      users-by-username-query="select EMAIL as email, PASSWORD as password, from ams.user where EMAIL=?" 
      authorities-by-username-query=" 
       select distinct user.EMAIL as email, permission.NAME as authority 
       from ams.user, ams.user_role, ams.role, ams.role_permission, ams.permission 
       where user.ID=user_role.USER_ID AND user_role.ROLE_ID=role_permission.ROLE_ID AND role_permission.PERMISSION_ID=permission.ID AND user.EMAIL=?"/> 
      <security:password-encoder ref="passwordEncoder" /> 
     </security:authentication-provider> 
    </security:authentication-manager> 

    <bean id="passwordEncoder" 
     class="org.springframework.security.authentication.encoding.ShaPasswordEncoder"> 
     <constructor-arg value="256" /> 
    </bean> 
</beans>

而且我的LoginController：

@Controller 
public class LoginController { 

    @RequestMapping(method = RequestMethod.GET) 
    public ModelAndView showLogin() { 
     ModelAndView mav = new ModelAndView("login/login"); 

     return mav; 
    } 

    @RequestMapping(method = RequestMethod.POST) 
    public ModelAndView doLogin(@RequestParam("email") String email, 
      @RequestParam("password") String password, 
      @RequestParam("remember_me") boolean rememberMe, 
      HttpServletRequest request, HttpServletResponse response) { 

     ModelAndView mav = new ModelAndView(); 

     mav.setViewName("redirect:/j_spring_security_check?j_email=" + email + "&j_password=" + password + "&_spring_security_remember_me=" + rememberMe); 

     return mav; 
    } 
}

如果你需要什麼更多的，請告訴我

來源

2013-02-19 James Carter

我猜你嘗試發送使用用戶名和密碼作爲查詢參數的登錄URL的HTTP GET請求。因爲這本質上是不安全的（例如可以加書籤），所以不允許。您應該發送一個HTTP POST。

來源

2013-02-19 20:04:33 zagyi

但doLogin方法是Post，所以它不應該工作呢？ – 2013-02-19 20:05:35

哦，你在這裏混合了一些東西。你的'doLogin（）'方法**處理一個POST請求併發送一個重定向作爲響應。然後，客戶端（瀏覽器）向重定向消息中指定的URL發送GET請求（這是一個手工製作的登錄url）。 – zagyi 2013-02-19 20:11:32

嗯，那麼好吧，我該怎樣或者更確切地說我應該在哪裏告訴安全 - 上下文，它應該是一個帖子 – 2013-02-19 20:14:00

Spring Security：不支持身份驗證方法：GET

回答

相關問題