Spring Security+MVC注解非法参数异常答案

【问题标题】：Spring Security+MVC annotations Illegal argument exceptionSpring Security+MVC注解非法参数异常
【发布时间】：2012-05-30 09:17:26
【问题描述】：

我正在使用 Spring MVC 和 Spring Security。

我有注解驱动的控制器并尝试向它添加安全注解。

控制器代码：

@Controller
public class SomeController implements MessageSourceAware {

    @Secured("ROLE_ADMIN")
    @RequestMapping(value = "/somepage", method = RequestMethod.GET)
    public String getPage(HttpServletRequest request, ModelMap model) {
        // logic
        return ADMIN_VIEW_NAME;
    }

我的spring-security.xml：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"
       xsi:schemaLocation="
       http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security-3.1.xsd">

    <security:global-method-security secured-annotations="enabled" />

    <security:http auto-config="true" use-expressions="true" access-denied-page="/denied">

        <security:intercept-url pattern="/login" access="permitAll"/>
        <!--<security:intercept-url pattern="/admin" access="hasRole('ROLE_ADMIN')"/>-->

        <security:form-login
                login-page="/login"
                authentication-failure-url="/login?error=true"
                default-target-url="/index"/>

        <security:logout
                invalidate-session="true"
                logout-success-url="/login"
                logout-url="/logout"/>

    </security:http>

    <!-- Declare an authentication-manager to use a custom userDetailsService -->
    <security:authentication-manager>
        <security:authentication-provider user-service-ref="authManager">
            <security:password-encoder ref="passwordEncoder"/>
        </security:authentication-provider>
    </security:authentication-manager>

    <!-- Use a SHA encoder since the user's passwords are stored as SHA in the database -->
    <bean class="org.springframework.security.authentication.encoding.ShaPasswordEncoder" id="passwordEncoder"/>

    <!-- A custom service where Spring will retrieve users and their corresponding access levels  -->
    <bean id="authManager" class="some.package.AdminManager"/>

</beans>

当我尝试打开安全页面时，出现以下错误：

org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.IllegalArgumentException: object is not an instance of declaring class
HandlerMethod details: 
Controller [$Proxy139]
Method [public java.lang.String SomeController.getPage(javax.servlet.http.HttpServletRequest,org.springframework.ui.ModelMap)]
Resolved arguments: 
[0] [type=org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestWrapper] [value=SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.connector.RequestFacade@7a31c825]]]
[1] [type=org.springframework.validation.support.BindingAwareModelMap] [value={}]

如果我删除安全注释并取消注释 spring-security.xml 中的以下行：

&lt;security:intercept-url pattern="/admin" access="hasRole('ROLE_ADMIN')"/&gt;

一切正常。

感谢您的帮助。

【问题讨论】：

标签： spring-mvc spring-security spring-annotations

【解决方案1】：

移动

<security:global-method-security secured-annotations="enabled" />

从 spring-security.xml 到主调度器 servlet 引用的 xml 文件，通常类似于 servlet-context.xml 或 application-context.xml

看这里 http://static.springsource.org/spring-security/site/faq/faq.html#faq-method-security-in-web-context

另外，我认为您需要将“ proxy-target-class="true" ”添加到 global-method-security 注释中

<security:global-method-security secured-annotations="enabled" proxy-target-class="true"/>

【讨论】：

谢谢。 proxy-target-class 是必要的。我已经添加了 cglib 和 asm 并且可以正常工作。