从 Spring-security-3 更新到 Spring-security-4 导致 XML 错误答案

【问题标题】：Update from Spring-security-3 to Spring-security-4 caused XML error从 Spring-security-3 更新到 Spring-security-4 导致 XML 错误
【发布时间】：2016-03-02 01:22:52
【问题描述】：

更新到 Spring security 4 后，我的 rest-security.xml 中有一个错误

Attribute 'access-denied-page' is not allowed to appear in element 'security:http'

目前我的 rest-security.xml 看起来像这样：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:security="http://www.springframework.org/schema/security" xmlns:p="http://www.springframework.org/schema/p"
    xmlns:context="http://www.springframework.org/schema/context"
    xsi:schemaLocation="
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.0.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd">

    <security:http pattern="/rest/**" auto-config="false" use-expressions="true" entry-point-ref="response403EntryPoint"/>

    <security:http auto-config="false" use-expressions="true" entry-point-ref="authenticationEntryPoint"
        access-denied-page="/#/not-authorized">

        <security:logout logout-url="/logout" invalidate-session="true" logout-success-url="/" />
        <security:custom-filter ref="jsonAuthenticationProcessingFilter" position="FORM_LOGIN_FILTER" />
    </security:http>

    <bean id="customAuthenticationManager" class="com.nortal.security.CustomAuthenticationManager" p:username="admin"
        p:password="admin" />

    <bean id="customAuthenticationFailureHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"
        p:defaultFailureUrl="/rest/security/login-failed" />

    <bean id="customAuthenticationSuccessHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler"
        p:defaultTargetUrl="/rest/security/check" />

    <bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"
        p:loginFormUrl="/#/login" />

    <bean id="response403EntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>

    <bean id="jsonAuthenticationProcessingFilter" class="com.nortal.security.JsonAuthenticationProcessingFilter"
        p:authenticationManager-ref="customAuthenticationManager" p:authenticationFailureHandler-ref="customAuthenticationFailureHandler"
        p:authenticationSuccessHandler-ref="customAuthenticationSuccessHandler" />

    <security:authentication-manager />
</beans>

这个元素导致了错误：

<security:http auto-config="false" use-expressions="true" entry-point-ref="authenticationEntryPoint"
        access-denied-page="/#/not-authorized">

属性access-denied-page 是不允许的。我应该如何更改我的 rest-security.xml 文件以使其与 Spring security 4 兼容？

【问题讨论】：

标签： java xml spring spring-security

【解决方案1】：

<security:http auto-config="false" use-expressions="true" entry-point-ref="authenticationEntryPoint"
        access-denied-page="/#/not-authorized">

        <security:logout logout-url="/logout" invalidate-session="true" logout-success-url="/" />
        <security:custom-filter ref="jsonAuthenticationProcessingFilter" position="FORM_LOGIN_FILTER" />
</security:http>

替换为

<security:http auto-config="false" use-expressions="true" entry-point-ref="authenticationEntryPoint">
        <security:access-denied-handler error-page="/#/not-authorized"/>
        <security:logout logout-url="/logout" invalidate-session="true" logout-success-url="/" />
        <security:custom-filter ref="jsonAuthenticationProcessingFilter" position="FORM_LOGIN_FILTER" />
</security:http>

在 spring security 4 中 acces-denied-page 已被替换为 access-denied-handler

文档Here

【讨论】：