Spring Security 身份验证被忽略

Question

你好 Stackoverflower，

我遇到了 Spring Security 的问题。在您继续使用您的应用程序之前应该出现的登录框不会出现，我无需任何身份验证即可访问我的应用程序。我不知道为什么会这样。 知道为什么不询问用户和密码是非常重要的。

我使用 RESTCLient Add on for firefox 测试我的应用程序。

web.xml 中的重要条目如下所示：

<!--    Security Configuration -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/</url-pattern>
    </filter-mapping>

    <!-- Spring Json Init -->
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <servlet>
        <servlet-name>json</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>json</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

我的 spring-security 是：

<!-- Security Propertie Configuration -->
    <security:http use-expressions="true">
    <security:http-basic/>
    </security:http>

    <security:authentication-manager>
        <security:authentication-provider
            ref="springUserService" />
    </security:authentication-manager>

springUserService 看起来像这样：

@组件 公共类 springUserService 实现 AuthenticationProvider {

@Override
public Authentication authenticate(Authentication authentication)
  throws AuthenticationException {
    String name = authentication.getName();
    String password = authentication.getCredentials().toString();
        List<GrantedAuthority> grantedAuths = new ArrayList<>();
        return new UsernamePasswordAuthenticationToken(name, password, grantedAuths);

}

@Override
public boolean supports(Class<?> authentication) {
    return authentication.equals(UsernamePasswordAuthenticationToken.class);
}

}

我非常感谢每一个提示或答案。

Answer 1

我认为你需要在你的 spring 安全配置中添加一些拦截 url 标签：

<security:intercept-url pattern="/securedUrl" access="isAuthenticated()" />
<security:intercept-url pattern="/login" access="permitAll" />

所以改变你的代码是这样的：

<security:http use-expressions="true">
    <security:intercept-url pattern="/securedUrl" access="isAuthenticated()" />
    <security:intercept-url pattern="/login" access="permitAll" />
</security:http>

您还可以在模式属性或自定义访问评估中使用通配符：

<intercept-url pattern="/url1/**" access="hasAnyRole('ROLE_ADMIN', 'ROLE_USER')"/> 
<intercept-url pattern="/url2/**" access="isAuthenticated()" /> 
<intercept-url pattern="/resources/**" access="permitAll" /> 
<intercept-url pattern="/**" access="permitAll" />

Answer 2

试试这个：

<security:http auto-config="true" use-expressions="true" path-type="regex">
    <security:intercept-url pattern="/admin/.*" access="hasRole('ROLE_ADMIN')" />
    <security:intercept-url pattern="/.*" access="isAuthenticated()" />
</security:http>

这里有一个更详细的例子，有解释：

<http auto-config="true" use-expressions="true" path-type="regex">
    <form-login 
        password-parameter="password" -- password field name in your form
        username-parameter="username" -- username field name in your form
        login-processing-url="/security/j_spring_security_check" -- where your login form should submit to, no need to map this to anything, Spring Security handles it
        login-page="/login" -- where you'll be taken to when not logged in
        authentication-failure-url="/login?login_error=t" -- if your login fails, security will redirect you with login_error set to t
        default-target-url="/router" -- if you want to route people based on roles, etc, you can map a controller ot this URL 
        always-use-default-target="false" -- this will send logged in users to your router URL
         />
    <headers>
        <xss-protection/> -- inserts header to prevent prevents cross site scripting
    </headers>
    <logout logout-url="/security/j_spring_security_logout" /> -- logout url, no need ot map it to anything, handled by Spring Security

    <intercept-url pattern="/admin/.*"  access="hasRole('ROLE_ADMIN')" /> -- security URLs by roles
    <intercept-url pattern="/register"  access="permitAll"/>              -- let new users register by allowing everyone access to the registration page
    <intercept-url pattern="/.*"        access="isAuthenticated()" requires-channel="https" />  -- require users to be authenticated for the rest of the page and require HTTPS (optional) for ALL urls
</http>