java - 如何在最简单的情况下正确配置Spring Security？

我有控制器：

@Controller
public class SecurityController{

    @RequestMapping(value="/403")
    public String renderAccessDeniedPage(){
        return "403";
    }

    @RequestMapping(value="/admin")
    public String renderAdminWelcomePage(){
        return "admin/welcome";
    }
}

当spring-security向其重新发送请求时，应该提供安全视图。我有以下配置：

web.xml

  <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>/WEB-INF/coreContext.xml /WEB-INF/securityContext.xml</param-value>
  </context-param>

  <servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value></param-value>
    </init-param>
  </servlet>

  <servlet-mapping>
    <servlet-name>dispatcher</servlet-name>
    <url-pattern>/</url-pattern>
  </servlet-mapping>

  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>

  <filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>

  <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/</url-pattern>
  </filter-mapping>

ant securityContext本身：

<security:http auto-config="true" use-expressions="true">
    <security:access-denied-handler error-page="/403" />
    <security:intercept-url pattern="admin/**" access="hasRole('ADMIN')" />
    <security:form-login login-page="/" username-parameter="user" password-parameter="pass" login-processing-url="/" />
</security:http>

<security:authentication-manager>
    <security:authentication-provider>
        <security:jdbc-user-service data-source-ref="xaDataSource"
        authorities-by-username-query="select name, role from users where name = ?"
        users-by-username-query="select name, password, enabled from users_auth where name = ?" />
    </security:authentication-provider>
</security:authentication-manager>

问题是，当我尝试通过浏览器发送渲染页面的请求时，即使没有登录，我也只是得到了我请求的页面（例如，admin.jsp）。我尝试调试，并且注意到我在org.springframework.web.filter.DelegatingFilterProxy中声明的web.xml方法没有一个被调用。怎么了？

最佳答案

除了AlanBarrows注释（使用<security:intercept-url pattern="/admin/**"）之外，还应该将过滤器映射到/*而不是/：

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

PS：很高兴注意到相关信息：没有调用DelegatingFilterProxy的一种方法

关于java - 如何在最简单的情况下正确配置Spring Security？，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/28043818/