通过 HttpStatusEntryPoint 实现 Spring Security 的 http401EntryPoint

Question

所以我们可以将 http403EntryPoint 用作 Spring 安全配置的属性 entry-point-ref

<http auto-config='false' use-expressions="true" entry-point-ref="http403EntryPoint">
 <intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>
</http>

<beans:bean id="http403EntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>

但我想为客户端区分 401 UNAUTHORIZED 和 403 FORBIDDEN，所以我可以在 401 时提供登录页面，在 403 时提供 NO ACCESS 页面。

实际上没有http401EntryPoint，但是我们可以使用org.springframework.http.HttpStatus 类并将HttpStatus 传递给它的bean。

我试过了：

 <http auto-config='false' use-expressions="true" entry-point-ref="http401EntryPoint">
 <intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>
</http>

<beans:bean id="UNAUTHORIZED" class="org.springframework.http.HttpStatus">
    <beans:constructor-arg name="value" value="#{new Integer(401)}"/>
    <beans:constructor-arg name="reasonPhrase" value="#{new String(Unauthorized)}"/>
</beans:bean>

但它仍然给我一个错误：

SEVERE [RMI TCP Connection(3)-127.0.0.1]org.apache.catalina.core.StandardContext.listenerStart Exception sending context initialized event to listener instance of class     org.springframework.web.context.ContextLoaderListener
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChains': Cannot resolve reference to bean 'org.springframework.security.web.DefaultSecurityFilterChain#0' while setting bean property 'sourceList' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.DefaultSecurityFilterChain#0': Cannot create inner bean '(inner bean)#183e819c' of type [org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter] while setting constructor argument with key [4]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#183e819c': Cannot resolve reference to bean 'http403EntryPoint' while setting bean property 'authenticationEntryPoint'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'http403EntryPoint' defined in file [C:\Users\k.mezhentsev\Desktop\apache-tomcat-9.0.0.M4\webapps\ROOT\WEB-INF\classes\fooConfig\fooSecurity.xml]: Cannot resolve reference to bean 'UNAUTHORIZED' while setting constructor argument; nested exception is org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is org.springframework.expression.spel.SpelEvaluationException: EL1008E:(pos 11): Property or field 'Unauthorized' cannot be found on object of type 'org.springframework.beans.factory.config.BeanExpressionContext' - maybe not public?

这里可能有什么问题？

Answer 1

是的，我明白了。

<beans:bean id="http401EntryPoint" class="org.springframework.security.web.authentication.HttpStatusEntryPoint">
    <beans:constructor-arg ref="httpCode401"/>
</beans:bean>

<beans:bean id="httpCode401" class="org.springframework.http.HttpStatus" factory-method="valueOf">
    <beans:constructor-arg>
        <beans:value>UNAUTHORIZED</beans:value>
    </beans:constructor-arg>
</beans:bean>