Spring爲每個POST請求創建會話

截至目前，GET請求可以正常工作，但是無論何時發佈POST，它都會創建會話。配置有什麼問題？部分aplicationContext.xml

：

部分 web.xml中

<!-- Spring 4.0 namespaces used. --> 
<security:http realm="Protected API" use-expressions="true" auto-config="false" create-session="stateless" entry-point-ref="authenticationEntryPoint"> 
    <security:custom-filter ref="authenticationFilter" position="PRE_AUTH_FILTER"/> 
    <security:intercept-url pattern="/**"/> 
</security:http> 

<security:authentication-manager alias="authenticationManager" />

：

<!-- Spring configuration loading. --> 
<listener> 
    <listener-class> 
     org.springframework.web.context.ContextLoaderListener 
    </listener-class> 
</listener> 

<!-- Spring request dispatcher. --> 
<servlet> 
    <servlet-name>mvc-dispatcher</servlet-name> 
    <servlet-class> 
     org.springframework.web.servlet.DispatcherServlet 
    </servlet-class> 
    <load-on-startup>1</load-on-startup> 
</servlet> 

<servlet-mapping> 
    <servlet-name>mvc-dispatcher</servlet-name> 
    <url-pattern>/</url-pattern> 
</servlet-mapping> 

<!-- Spring security filters. --> 
<filter> 
    <filter-name>springSecurityFilterChain</filter-name> 
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> 
</filter> 

<filter-mapping> 
    <filter-name>springSecurityFilterChain</filter-name> 
    <url-pattern>/*</url-pattern> 
</filter-mapping>

問題是（按評論）去除開機啓動更新

終點是否有效或無t，這是我在製作POST請求時獲得的堆棧跟蹤：

java.lang.RuntimeException: Session support is not enabled in appengine-web.xml. To enable sessions, put <sessions-enabled>true</sessions-enabled> in that file. Without it, getSession() is allowed, but manipulation of sessionattributes is not. at com.google.apphosting.utils.jetty.StubSessionManager$StubSession.throwException(StubSessionManager.java:77) at com.google.apphosting.utils.jetty.StubSessionManager$StubSession.setAttribute(StubSessionManager.java:65) at org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository.saveToken(HttpSessionCsrfTokenRepository.java:65) at org.springframework.security.web.csrf.CsrfFilter$SaveOnAccessCsrfToken.saveTokenIfNecessary(CsrfFilter.java:227) at org.springframework.security.web.csrf.CsrfFilter$SaveOnAccessCsrfToken.getToken(CsrfFilter.java:185) at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:104) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:91) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:213) at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176) at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262) at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157) at com.google.appengine.api.socket.dev.DevSocketFilter.doFilter(DevSocketFilter.java:74) at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157) at com.google.appengine.tools.development.ResponseRewriterFilter.doFilter(ResponseRewriterFilter.java:127) at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157) at com.google.appengine.tools.development.HeaderVerificationFilter.doFilter(HeaderVerificationFilter.java:34) at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157) at com.google.appengine.api.blobstore.dev.ServeBlobFilter.doFilter(ServeBlobFilter.java:63) at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157) at com.google.apphosting.utils.servlet.TransactionCleanupFilter.doFilter(TransactionCleanupFilter.java:43) at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157) at com.google.appengine.tools.development.StaticFileFilter.doFilter(StaticFileFilter.java:125) at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157) at com.google.appengine.tools.development.DevAppServerModulesFilter.doDirectRequest(DevAppServerModulesFilter.java:366) at com.google.appengine.tools.development.DevAppServerModulesFilter.doDirectModuleRequest(DevAppServerModulesFilter.java:349) at com.google.appengine.tools.development.DevAppServerModulesFilter.doFilter(DevAppServerModulesFilter.java:116) at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157) at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:388) at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216) at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:182) at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:765) at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:418) at com.google.appengine.tools.development.DevAppEngineWebAppContext.handle(DevAppEngineWebAppContext.java:98) at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152) at com.google.appengine.tools.development.JettyContainerService$ApiProxyHandler.handle(JettyContainerService.java:502) at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152) at org.mortbay.jetty.Server.handle(Server.java:326) at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:542) at org.mortbay.jetty.HttpConnection$RequestHandler.content(HttpConnection.java:938) at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:755) at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:218) at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:404) at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:409) at org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:582)

我不希望應用程序使用會話。我認爲create-session="stateless"應該使用NullSecurityContextRepository，但根據堆棧跟蹤HttpSessionCsrfTokenRepository代替。

下面是Spring的依賴：

compile "org.springframework:spring-webmvc:4.0.2.RELEASE" compile "org.springframework.security:spring-security-web:4.0.2.RELEASE" compile "org.springframework.security:spring-security-config:4.0.2.RELEASE"

來源

2015-10-20 Pijusn

關於/ **的截取URL的內容如何？誰可以訪問它，你沒有指定。 –

初學者停止加載所有內容兩次。您正在爲'ContextLoaderListener'和'DispatcherServlet'使用相同的xml，導致創建重複的bean，從而導致各種問題。你也使用Spring Boot，然後使用'spring-boot-starter-security'。由於CSFR默認啓用的存儲庫會禁用它。另外我想知道你爲什麼使用Spring引導，並且仍然有一個web.xml文件，確保你不會干擾Spring Boot啓動和你自己的配置。 –

@WeareBorg我希望過濾器對所有路徑都有效，但不強制認證。 @ M.Deinum我完全刪除了啓動啓動器，並將'security：http'標記移至'applicationContext.xml'。我做我做的是因爲許多教程使用相同的XML。我雖然春天處理。經過一切修改，問題仍然是一樣的。 – Pijusn

看起來這是一種嘗試建立會話的CSRF保護。對於無狀態服務，請將其禁用：

<security:http create-session="stateless" ...> 
    <security:csrf disabled="true"/> 
    <!-- the rest same as before --> 
</security:http>

來源

2015-10-20 12:03:49 holmis83

即使這解決了這個問題，我仍然建議在進行主要帖子的作者（未回答）的進一步任務之前進行清理。 –

這是問題所在。 @ M.Deinum在他的評論中提到了它，但我對Spring真的很陌生，並且沒有正確理解它。 – Pijusn

Spring爲每個POST請求創建會話

回答

相關問題