Spring mvc和基於安全角色的限制問題

Question

我正在使用spring-mvc 3.1.1.RELEASE和Spring-Security構建一個應用程序，我希望每個人都必須登錄才能訪問它，同時我想限制訪問通過角色的一些用戶，我編輯了彈簧的security.xml這樣：

<beans xmlns="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:context="http://www.springframework.org/schema/context" 
xmlns:sec="http://www.springframework.org/schema/security" 
xsi:schemaLocation="http://www.springframework.org/schema/beans 
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd 
http://www.springframework.org/schema/security 
http://www.springframework.org/schema/security/spring-security-3.1.xsd 
http://www.springframework.org/schema/context 
http://www.springframework.org/schema/context/spring-context-3.1.xsd"> 

<bean id="userDetailsService" class="it.dedagroup.cartesio.security.auth.UserDetailServiceImpl"> 
    <property name="accountService" ref="accountService"></property> 
</bean> 

<sec:http auto-config="true" use-expressions="true" create-session="always"> 
    <sec:http-basic /> 
    <sec:intercept-url pattern="/login" access="permitAll"/> 
    <sec:intercept-url pattern="/failedLogin" access="permitAll"/> 
    <sec:intercept-url pattern="/resources/**" access="permitAll"/> 
    <sec:intercept-url pattern="/error" access="permitAll"/> 
    <sec:intercept-url pattern="/accessDenied*" access="isAuthenticated()" /> 
    <sec:intercept-url pattern="/home*" access="isAuthenticated()" /> 
    <sec:intercept-url pattern="/utentiRicerca*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/userEdit*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/creaUser*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/detailsUtente*" access="isAuthenticated()" /> 
    <sec:intercept-url pattern="/modificaAccount*" access="isAuthenticated()" /> 
    <sec:intercept-url pattern="/serverRicerca*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/editServer*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/prepareListaSearch*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/prepareListaEdit*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/groupInitSearch*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/groupEdit*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/listaUpdate*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/upload*" access="isAuthenticated()" /> 
    <sec:intercept-url pattern="/emailRicerca*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/prepareEditCasella*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/acl*" access="hasRole('ROLE_ADMIN')" /> 
    <sec:intercept-url pattern="/initDaemons*" access="hasAnyRole('ROLE_ADMIN','ROLE_SYSTEM')" /> 
    <sec:intercept-url pattern="/mailbox*" access="hasAnyRole('ROLE_OPER','ROLE_USER')" /> 
    <sec:intercept-url pattern="/emailBody*" access="hasAnyRole('ROLE_OPER','ROLE_USER')" /> 
    <sec:intercept-url pattern="/pecBody*" access="hasAnyRole('ROLE_OPER','ROLE_USER')" /> 
    <sec:intercept-url pattern="/composeEmail*" access="hasRole('ROLE_OPER')" /> 

    <sec:form-login login-page="/login" 
     always-use-default-target="true" 
     default-target-url="/home" 
     authentication-failure-url="/failedLogin" /> 

    <sec:logout invalidate-session="true" logout-success-url="/logout" delete-cookies="true" /> 

    <sec:session-management invalid-session-url="/login" session-authentication-error-url="/failedLogin?sessionExpiredDuplicateLogin=true" > 
     <sec:concurrency-control max-sessions="1" expired-url="/failedLogin" error-if-maximum-exceeded="false" /> 
    </sec:session-management> 
</sec:http> 

<sec:authentication-manager> 
    <sec:authentication-provider user-service-ref="userDetailsService"> 
     <sec:password-encoder ref="stdEncoder"></sec:password-encoder> 
    </sec:authentication-provider> 
</sec:authentication-manager> 

，但如果我刪除根URL的seurity映射，它返回了我未找到頁面錯誤，如果我以這種方式評價安全性：

<sec:intercept-url pattern="/**" access="isAuthenticated()" /> 

它在登錄後包裝了我所有的請求，並忽略了我直接在瀏覽器欄上寫入時爲子網址指定的規則。

例如，我需要只有「ROLE_ADMIN」才能訪問URL「/ utentiRicerca」處的用戶搜索，但是如果我使用「ROLE_USER」登錄並在瀏覽器URL「http://myhost.it:8080/myApp/utentiRicerca」上寫入，它不會給我「 http 403「，因爲我配得上這個角色。那麼我能爲它做些什麼？

Answer 1

/**模式將匹配任何網址，因此總能訪問所有鏈接。如果先放置，則其他鏈接甚至不會被檢查，如果放到最後，則會檢查其他模式，但即使它們失敗，如果選中此項，用戶仍然會傳遞安全性。

如果要限制某些網址，你可以嘗試改變你的URL結構，例如有一個固定的角​​色進入下一個「安全」的網址

例如，你可以使用像鏈接的任何網址以 「安全」 爲前綴如下： ：

secured/prepareListaEdit 

，並讓他們安全使用模式是這樣的：

<sec:intercept-url pattern="secured/prepareListaEdit/* access="hasRole('ROLE_ADMIN')" /> 

和ñ增加，而不是/ **使用/ *訪問您的根路徑上的其他鏈接的模式

<security:intercept-url pattern="/*" access="isAuthenticated()" /> 

（因爲使用/ **會匹配所有的子路徑包括「擔保」）