1. 首頁
  2. 問答
  3. Spring Security不會發布提供登錄處理url

Spring Security不會發布提供登錄處理url

2016-04-22 64 views
1

由於某種奇怪的原因，我無法訪問註冊處理登錄帖子的控制器。我只是重定向到這個愚蠢的形象，是在我的資源文件夾中：Spring Security不會發布提供登錄處理url

https://localhost:8443/images/piggy-bank.jpeg

這裏是我的控制器。

@RequestMapping(value = "/login/process", method = RequestMethod.POST) 
public String loginPost(HttpSession session, Authentication authentication) { 

    String client_id = (String) session.getAttribute("client_id"); 

    if (client_id.equals(Constants.TRUSTED_CLIENT)) { 

     //TODO: 
     /* 
     * 1. Generate an access_token 
     * 2. Save to database 
     * 3. Form redirect url with all necessary tokens 
     * 4. Return redirect url string 
     */ 

     return "redirect:" + Constants.REDIRECT_TRUSTED_CLIENT; 

    } 

    long userId = AuthenticationUtils.getAuthenticatedUserId(authentication); 
    return "/user/" + userId; 
}

這裏是我的安全配置：

@Configuration 
@EnableWebSecurity 
public class SecurityConfiguration extends WebSecurityConfigurerAdapter { 

    @Autowired 
    @Qualifier("customUserDetailsService") 
    UserDetailsService userDetailsService; 

    @Autowired 
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception { 
     auth.userDetailsService(userDetailsService); 
    } 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http. 
       authorizeRequests() 
       .antMatchers("/","/sign_up","/resources/**").permitAll() 
       .anyRequest().authenticated() 
       .and() 
      .formLogin() 
       .permitAll() 
       .loginPage("/login") 
       .loginProcessingUrl("/login/process") 
       .defaultSuccessUrl("/") 
       .failureUrl("/access_denied") 
       .and() 
      .csrf() 
       .and() 
      .exceptionHandling() 
       .accessDeniedPage("/access_denied") 
       .and() 
      .logout() 
       .permitAll(); 

    } 
}

而這裏的觀點：

<!DOCTYPE html> 
<html xmlns:th="http://www.thymeleaf.org"> 
    <head lang="en"> 

     <title>Spring App</title> 

     <!--/*/ <th:block th:include="fragments/headerinc :: head"></th:block> /*/--> 
    </head> 

    <body> 
     <div class="container"> 
      <!--/*/ <th:block th:include="fragments/header :: header"></th:block> /*/--> 

      <div id="mainWrapper"> 
       <div class="login-container"> 
        <div class="login-card"> 
         <div class="login-form"> 
          <form th:action="@{/login/process}" method="post" class="form-horizontal"> 
           <div th:if="${param.error != null}"> 
            <div class="alert alert-danger"> 
             <p>Invalid username and password.</p> 
            </div> 
           </div> 
           <div th:if="${param.logout != null}"> 
            <div class="alert alert-success"> 
             <p>You have been logged out successfully.</p> 
            </div> 
           </div> 
           <div class="input-group input-sm"> 
            <label class="input-group-addon" for="username"><i class="fa fa-user"></i></label> 
            <input type="text" class="form-control" id="username" name="username" placeholder="Enter Username" /> 
           </div> 
           <div class="input-group input-sm"> 
            <label class="input-group-addon" for="password"><i class="fa fa-lock"></i></label> 
            <input type="password" class="form-control" id="password" name="password" placeholder="Enter Password" /> 
           </div> 
           <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" /> 

           <div class="form-actions"> 
            <input type="submit" 
              class="btn btn-block btn-primary btn-default" value="Log in"/> 
           </div> 
          </form> 
         </div> 
        </div> 
       </div> 
      </div> 
     </div> 
    </body> 
</html>

檢查我的網絡數據，我看到表單提交到/登錄/過程是成功的並且服務器反應良好！

Request URL:https://localhost:8443/login/process 
Request Method:POST 
Status Code:302 Found 
Remote Address:[::1]:8443

在春季啓動期間的日誌也確認url「/ login/post」註冊到上述控制器。相應的日誌：

2016-04-21 20:44:30.725 INFO 25290 --- [   main] s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped "{[/login/process],methods=[POST]}" onto public java.lang.String com.springapp.controllers.UserController.loginPost(javax.servlet.http.HttpSession,org.springframework.security.core.Authentication)

的情況可能是一些更加狡猾，因爲我似乎無法被重定向到連defaultSuccessURL頁面，即指數（「/」）。即使我使用默認的開箱即用登錄視圖，情況也是如此（即loginProcessingURL和defaultSuccessfulURL不重定向）。我的jsp視圖有問題嗎？我是否缺少一些安全配置？

但是，只要我的身份驗證正確，手動輸入/ user/{id}或其他任何url都會成功將我導向目標網址。那是什麼意思？

最後這裏是 '了header.html' 和 'headerinc.html' thymeleaf片段被插在我所有的JSP：

了header.html

<!DOCTYPE html> 
<html xmlns:th="http://www.thymeleaf.org"> 
<head lang="en"> 
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> 

    <script src="https://code.jquery.com/jquery-2.1.4.min.js"></script> 

    <link href="../../static/css/app.css" 
      th:href="@{css/app.css}" rel="stylesheet" media="screen"/> 
    <link href="../../static/css/bootstrap.css" 
      th:href="@{css/bootstrap.css}" rel="stylesheet" media="screen"/> 
    <link href="//cdnjs.cloudflare.com/ajax/libs/font-awesome/4.2.0/css/font-awesome.css" 
      th:href="@{/webjars/font-awesome/4.2.0/font-awesome.css}" rel="stylesheet" media="screen"/> 

</head> 
<body> 

<div class="container"> 
    <div th:fragment="header"> 
     <nav class="navbar navbar-default"> 
      <div class="container-fluid"> 
       <div class="navbar-header"> 
        <a class="navbar-brand" href="#" th:href="@{/}">Home</a> 
        <ul class="nav navbar-nav"> 
         <!-- if logged in, then display -logout, else display -login, -Sign up. --> 
         <div th:with="currentUser=${#httpServletRequest.userPrincipal?.name}"> 

          <div th:if="${currentUser != null}"> 
           <form th:action="@{/logout}" method="post"> 
            <input type="submit" value="Log out"/> 
           </form> 
          </div> 

          <div th:if="${currentUser == null}"> 
           <li><a href="#" th:href="@{/login}">Log in</a></li> 
           <li><a href="#" th:href="@{/sign_up}">Sign up</a></li> 
          </div> 

          <!-- This is to simply test some authentication logic--> 
          <a href="#" th:href="@{/users}">All Users</a> 
         </div> 
        </ul> 
       </div> 
      </div> 
     </nav> 

     <div class="jumbotron"> 
      <div class="row text-center"> 
       <div class=""> 
        <h2>Spring Framework Example..</h2> 

        <h3>Spring Boot Web App</h3> 
       </div> 
      </div> 
      <div class="row text-center"> 
       <img src="../../static/images/NewBannerBOOTS_2.png" width="400" 
        th:src="@{/images/piggy-bank.jpeg}"/> 
      </div> 
     </div> 
    </div> 
</div> 
</body> 
</html>

headerinc.html

<!DOCTYPE html> 
<html xmlns:th="http://www.thymeleaf.org"> 
<head lang="en" th:fragment="head"> 
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> 
    <link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" rel="stylesheet" media="screen" /> 

    <script src="https://code.jquery.com/jquery-2.1.4.min.js"></script> 
    <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js"></script> 
    <link href="../static/css/guru.css" 
      th:href="@{/css/guru.css}" rel="stylesheet" media="screen"/> 
</head> 
<body> 

</body> 
</html>

來源

2016-04-22 apil.tamang

回答

1

這條線：

.loginProcessingUrl("/login/process")

告訴Spring Security在發送指定路徑時處理提交的憑證，並且默認情況下會將用戶重定向回頁面用戶。 它不會將請求傳遞給Spring MVC和您的控制器。

也許你想要而不是請求映射是一個自定義AuthenticationSuccessHandler。

來源

2016-04-22 09:32:53 holmis83

+1

hahhh！爲什麼文章之後的文章將'loginProcessingUrl'參數描述爲自定義登錄控制器!!？ –

相關問題

 相關問題