春季安全記住我從https到http cookie認證失敗的身份驗證

Question

我正在使用Spring Security 3.0.5進行身份驗證，我也使用記住我。目前，登錄頁面是一個https頁面，我重定向到成功認證的頁面是一個http頁面。我使用的是https下的所有東西，但是我們的網站上有一些東西不能在IE8的https下運行，所以我想我會嘗試這種方式。下面的調試日誌似乎表明，cookie不能從https寫入http，有沒有辦法做到這一點？

調試跟蹤：

15:13:53,373 DEBUG UsernamePasswordAuthenticationFilter:289 - Authentication success. Updating SecurityContextHolder to contain: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@b7fef7f9: Principal: com.dc.api.model.Users@470ad8; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffd148a: RemoteIpAddress: 204.17.229.254; SessionId: 1C083D7977FDD3C8D1FA94BEA6665C54; Granted Authorities: com.dc.api.model.Authority@bd4e16 
15:13:53,373 DEBUG TokenBasedRememberMeServices:271 - Did not send remember-me cookie (principal did not set parameter '_spring_security_remember_me') 
15:13:53,374 DEBUG TokenBasedRememberMeServices:229 - Remember-me login not requested. 
15:13:53,374 DEBUG DefaultListableBeanFactory:242 - Returning cached instance of singleton bean 'eventDispatcher' 
15:13:53,375 DEBUG SavedRequestAwareAuthenticationSuccessHandler:107 - Using default Url: /registered/home.html 
15:13:53,375 DEBUG DefaultRedirectStrategy:36 - Redirecting to '/dreamcatcher/registered/home.html' 

春季安全配置：

<?xml version="1.0" encoding="UTF-8"?> 
<beans:beans 
    xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:util="http://www.springframework.org/schema/util" 
    xmlns:context="http://www.springframework.org/schema/context" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
    http://www.springframework.org/schema/util 
    http://www.springframework.org/schema/util/spring-util-3.0.xsd 
    http://www.springframework.org/schema/security 
    http://www.springframework.org/schema/security/spring-security-3.0.xsd 
    http://www.springframework.org/schema/context 
    http://www.springframework.org/schema/context/spring-context-3.0.xsd"> 
    <context:annotation-config /> 
    <context:component-scan base-package="dc" /> 
    <global-method-security /> 
    <http access-denied-page="/auth/denied.html"> 
     <intercept-url filters="none" pattern="/javax.faces.resource/**" /> 
     <intercept-url filters="none" pattern="/services/rest-api/1.0/**" /> 
     <intercept-url filters="none" pattern="/preregistered/*"/> 
     <intercept-url 
      pattern="/**/*.xhtml" 
      access="ROLE_NONE_GETS_ACCESS" /> 
     <intercept-url 
      pattern="/auth/**" 
      access="ROLE_ANONYMOUS,ROLE_USER" /> 
     <intercept-url 
      pattern="/auth/*" 
      access="ROLE_ANONYMOUS" /> 
     <intercept-url 
      pattern="/registered/*" 
      access="ROLE_USER" /> 
      <intercept-url 
      pattern="/*" 
      access="ROLE_ANONYMOUS" /> 
     <form-login 
      login-processing-url="/j_spring_security_check.html" 
      login-page="/auth/login.html" 
      default-target-url="/registered/home.html" 
      authentication-failure-url="/auth/login.html" /> 
     <logout invalidate-session="true" 
       logout-url="/auth/logout.html" 
       success-handler-ref="DCLogoutSuccessHandler"/> 
     <anonymous username="guest" granted-authority="ROLE_ANONYMOUS"/> 
     <remember-me user-service-ref="userManager" key="keyvaluehere"/> 
     <custom-filter after="FORM_LOGIN_FILTER" ref="xmlAuthenticationFilter"/> 
    </http> 
    <!-- Configure the authentication provider --> 
    <authentication-manager alias="am"> 
     <authentication-provider user-service-ref="userManager"> 
       <password-encoder ref="passwordEncoder" /> 
     </authentication-provider> 
     <authentication-provider ref="xmlAuthenticationProvider" /> 
    </authentication-manager> 
</beans:beans> 

Answer 1

它是通過改變帶有過濾器的cookie的可能，我已經回答了這個問題here

Answer 2

從安全角度來看，這是正確的行爲，因爲攻擊者可以竊取中使用的會話ID/cooki如果在http中使用相同的會話ID/cooki，也是https。

所以有一個基本的規則，如果使用從http切換到https，創建一個新的會話。因此，如果您有https會話，請在http中使用它，然後在https中再次使用此規則。 - 所以它是Spring Security的一個特性，不是Bug。

無論如何，這個最簡單的解決方案將會使http資源在https下變得可愛。所以你不需要在用戶登錄後（https）切換回http。