我对您的问题理解如下：我想以登录的形式提交一个 itemId，在成功登录后用于重定向。
为了建立这样一个过程，你需要做以下事情。
从您的配置中删除 <form-login ...>。你应该有：
<http use-expressions="true" entry-point-ref="authenticationEntryPoint">
<intercept-url pattern="/login" access="permitAll" />
<intercept-url pattern="/resources/**" access="permitAll" />
<intercept-url pattern="/logout" access="permitAll" />
<intercept-url pattern="/accessdenied" access="permitAll" />
<custom-filter ref="ddAuthenticationFilter" position="FORM_LOGIN_FILTER" />
<security:logout />
</http>
别忘了为注销添加<security:logout />，entry-point-ref 属性指向authenticationEntryPoint。
为指向您的登录页面的entry-point-ref 添加LoginUrlAuthenticationEntryPoint：
<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<constructor-arg name="loginFormUrl" value="/login" />
</bean>
重构您的ddAuthenticationFilter 以满足以下配置：
<bean id="ddAuthenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
<property name="authenticationManager" ref="authenticationManager" />
<property name="filterProcessesUrl" value="/j_spring_security_check" />
<property name="authenticationFailureHandler" ref="authenticationFailureHandler" />
<property name="authenticationSuccessHandler" ref="ddAuthenticationSuccessHandler" />
<property name="authenticationDetailsSource">
<bean class="security.CustomWebAuthenticationDetailsSource" />
</property>
</bean>
<bean id="authenticationFailureHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
<property name="defaultFailureUrl" value="/accessdenied" />
</bean>
创建一个新类CustomWebAuthenticationDetailsSource：
package security;
import org.springframework.security.authentication.AuthenticationDetailsSource;
import org.springframework.security.web.authentication.WebAuthenticationDetails;
import javax.servlet.http.HttpServletRequest;
public class CustomWebAuthenticationDetailsSource implements AuthenticationDetailsSource<HttpServletRequest, WebAuthenticationDetails> {
@Override
public WebAuthenticationDetails buildDetails(HttpServletRequest context) {
return new CustomWebAuthenticationDetails(context);
}
}
以及相关的CustomWebAuthenticationDetails：
package security;
import org.springframework.security.web.authentication.WebAuthenticationDetails;
import javax.servlet.http.HttpServletRequest;
public class CustomWebAuthenticationDetails extends WebAuthenticationDetails {
private final String itemId;
public CustomWebAuthenticationDetails(HttpServletRequest request) {
super(request);
itemId = request.getParameter("itemId");
}
public String getItemId() {
return itemId;
}
//TODO override hashCode, equals and toString to include itemId
@Override
public int hashCode() { /* collapsed */ }
@Override
public boolean equals(Object obj) { /* collapsed */ }
@Override
public String toString() { /* collapsed */ }
}
你的ddAuthenticationSuccessHandler 应该有类似这个例子的逻辑：
package com.dd.security;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.util.StringUtils;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
public class DDAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
@Override
public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
CustomWebAuthenticationDetails details = (CustomWebAuthenticationDetails) authentication.getDetails();
if(StringUtils.hasText(details.getItemId())) {
//TODO sanity and security check for itemId needed
String redirectUrl = "item/" + details.getItemId();
response.sendRedirect(redirectUrl);
}
throw new IllegalStateException("itemId in authentication details not found");
}
}
可以在here 找到一个工作示例