如何在 Spring Security 中设置始终使用默认目标？

Question

我需要在我的 Spring Boot 应用程序中的 SavedRequestAwareAuthenticationSuccessHandler 中设置 always-use-default-target="true"。我怎样才能做到这一点？我试过了：

@Bean
SavedRequestAwareAuthenticationSuccessHandler handler() {
    SavedRequestAwareAuthenticationSuccessHandler handler = new SavedRequestAwareAuthenticationSuccessHandler();
    handler.setAlwaysUseDefaultTargetUrl(true);
    return  handler;
}

但没有成功。似乎使用了完全不同的 bean

我的安全配置：

@EnableOAuth2Sso
@Configuration
@Order(2)
public class FormWebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired OAuth2ProtectedResourceDetails oAuth2ProtectedResourceDetails;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .antMatcher("/**")
                .authorizeRequests()
                .antMatchers("/login**", "/assets/**", "/uaa/**", "/management/health").permitAll()
                .anyRequest().authenticated()
            .and()
                .headers()
                .defaultsDisabled()
                .frameOptions()
                .sameOrigin()
            .and()
                .csrf()
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                .ignoringAntMatchers("/uaa/**")
            .and()
                .logout()
                .logoutSuccessUrl("/login?logout")
                .permitAll();
    }
}

和：

@Configuration
@Order(1)
public class ApiWebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired OAuth2ProtectedResourceDetails oAuth2ProtectedResourceDetails;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .antMatcher("/api/**")
                .authorizeRequests()
                .anyRequest().authenticated()
            .and()
                .csrf()
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            .and()
                .formLogin()
                .successForwardUrl("/")
            .and()
                .exceptionHandling().authenticationEntryPoint(new Unauthorized401EntryPoint());
    }

    public static class Unauthorized401EntryPoint implements AuthenticationEntryPoint {

        @Override
        public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception)
                throws IOException, ServletException {

            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);

        }
    }
}

Answer 1

将以下用于基于注释的设置：

defaultSuccessUrl("/dashboard",true)

第二个布尔参数将always-use-default-target设置为true。