spring 引导安全自定义 successHandler 其余部分不工作

Question

不知道我的问题好不好..

也许我一直在寻找有关 spring 安全性的信息总的来说，希望你回答起来不难。

问题是，我在登录页面上使用 spring 安全性。登录页面就在 public 模板文件夹中。我没有为它创建一个单独的控制器来 return 查看页面（为它创建一个 return 查看登录页面的控制器是否正确？）。无论如何，即使没有这个页面视图控制器，我的代码也能正常工作。但只有我的自定义 SuccessHandler 不起作用（登录后，按角色检查并重定向到另一个页面）。我应该使用不同的方法按角色重定向到适当的页面吗？（我的意思是如果登录后 ADMIN_ROLE 被重定向到管理员-panel.html）

我的安全

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class CustomWebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserServiceImpl userServiceImpl;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and()
                .authorizeRequests()
                .antMatchers("/", "/templates/sign-up.html").permitAll()
                .antMatchers("/api/users", "/api/users/login").permitAll()
                .antMatchers("/templates/admin-panel.html").hasRole("ADMIN")
                .antMatchers("/all-users").hasRole("ADMIN")
                .antMatchers("/news").hasRole("USER")
        .anyRequest().authenticated()
            .and()
                .formLogin()
                .loginPage("/templates/login.html")
                .defaultSuccessUrl("/")
                .permitAll()
                .successHandler(myAuthenticationSuccessHandler())
                .and()
                .logout()
                .permitAll()
                .logoutSuccessUrl("/index.html");

        http.csrf().disable();
    }
    @Override
    public void configure(WebSecurity web) {
        web
                .ignoring()
                .antMatchers("/css/**")
                .antMatchers("/js/**")
                .antMatchers("/static/**")
                .antMatchers("/resources/**");
    }

    @Autowired
    protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userServiceImpl).passwordEncoder(bCryptPasswordEncoder());
    }

    @Bean
    public AuthenticationSuccessHandler myAuthenticationSuccessHandler(){
        return new CustomAuthenticationSuccessHandler();
    }
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder() {
        return new BCryptPasswordEncoder();
    }

我的自定义成功处理程序

public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    protected final Log logger = LogFactory.getLog(this.getClass());

    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

    public CustomAuthenticationSuccessHandler() {
        super();
    }

    // API

    @Override
    public void onAuthenticationSuccess(final HttpServletRequest request, final HttpServletResponse response, final Authentication authentication) throws IOException {
        handle(request, response, authentication);
        clearAuthenticationAttributes(request);
    }

    // IMPL

    protected void handle(final HttpServletRequest request, final HttpServletResponse response, final Authentication authentication) throws IOException {
        final String targetUrl = determineTargetUrl(authentication);

        if (response.isCommitted()) {
            logger.debug("Response has already been committed. Unable to redirect to " + targetUrl);
            return;
        }

        redirectStrategy.sendRedirect(request, response, targetUrl);
    }

    protected String determineTargetUrl(final Authentication authentication) {

        Map<String, String> roleTargetUrlMap = new HashMap<>();
        roleTargetUrlMap.put("ROLE_USER", "/index.html");
        roleTargetUrlMap.put("ROLE_ADMIN", "/templates/admin-panel.html");

        final Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
        for (final GrantedAuthority grantedAuthority : authorities) {

            String authorityName = grantedAuthority.getAuthority();
            if(roleTargetUrlMap.containsKey(authorityName)) {
                return roleTargetUrlMap.get(authorityName);
            }
        }

        throw new IllegalStateException();
    }

    /**
     * Removes temporary authentication-related data which may have been stored in the session
     * during the authentication process.
     */
    protected final void clearAuthenticationAttributes(final HttpServletRequest request) {
        final HttpSession session = request.getSession(false);

        if (session == null) {
            return;
        }

        session.removeAttribute(WebAttributes.AUTHENTICATION_EXCEPTION);
    }
}

我的控制器

    @CrossOrigin
    @RestController
    @RequestMapping("/api/users")
    public class UserController {
    
        private final UserServiceImpl userService;
        private AuthenticationManager authenticationManager;
        public UserController(UserServiceImpl userService, AuthenticationManager authenticationManager) {
            this.userService = userService;
            this.authenticationManager = authenticationManager;
        }
    
        @PostMapping
        public ResponseEntity<?> register(@RequestBody UserDTO user) {
          try {
              userService.register(user);
              return new ResponseEntity<>("User added", HttpStatus.OK);
          } catch (Exception e) {
              return new ResponseEntity<>(e, HttpStatus.BAD_REQUEST);
          }
        }
    
        @PostMapping(value = "/login")
        public ResponseEntity<?> login(@RequestBody UserDTO user, HttpServletResponse response) {
            try {
                Authentication authentication = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword()));
                boolean isAuthenticated = isAuthenticated(authentication);
                if (isAuthenticated) {
                    SecurityContextHolder.getContext().setAuthentication(authentication);
    //                response.sendRedirect("/templates/admin-panel.html");
   //                my pathetic attempt to create a redirect to another page
                }
                return new ResponseEntity<>("user authenticated", HttpStatus.OK);
            } catch (Exception e) {
                return new ResponseEntity<>(e, HttpStatus.FORBIDDEN);
            }
        }
        private boolean isAuthenticated(Authentication authentication) {
            return authentication != null && !(authentication instanceof AnonymousAuthenticationToken) && authentication.isAuthenticated();
        }

我的静态文件 enter image description here

Answer 1

我猜，因为你没有post你的登录页面本身：

您不需要监听 POST /login 的控制器，这通常由 Spring 安全自动注册，具有所有与安全相关的身份验证内容。无需像 UserController.login() 中那样自己尝试。我想通过注册这个端点，您可以覆盖/停用常规 spring 安全行为。

通常您只需要一个登录页面，其中的表单 post 正确地指向 /login。后端处理由 spring 安全本身完成。

请参阅 https://spring.io/guides/gs/securing-web/ 了解最小的 worling 设置。

spring 引导安全自定义 successHandler 其余部分不工作

spring boot security custom successHandler with rest not working

spring-security

spring-boot