3
我在我的春天啓動應用程序中使用Spring Security的，似乎Thymeleaf授權不能正常工作。使用Spring Security Thymeleaf授權不工作
我有下面的代碼Thymeleaf的模板：
<div class="container">
<div class="row" sec:authorize="isAuthenticated()">
<h2 style="color:green">User is Logged In</h2>
<p sec:authentication="principal.username">username</p>
</div>
<div class="row" sec:authorize="!isAuthenticated()">
<h2 style="color:red">User is Logged Out</h2>
</div>
<div class="row" sec:authorize="hasRole('ROLE_SUPERUSER')">
<h2>This will only be displayed if authenticated user has role ROLE_SUPERUSER.</h2>
</div>
<div class="row" sec:authorize="hasRole('ROLE_ADMIN')">
<h2>This will only be displayed if authenticated user has role ROLE_ADMIN.</h2>
</div>
<div class="row" sec:authorize="hasRole('ROLE_USER')">
<h2>This will only be displayed if authenticated user has role ROLE_USER.</h2>
</div>
<div th:if="${#authorization.expression('hasRole(''ROLE_ADMIN'')')}">
This will only be displayed if authenticated user has role ROLE_ADMIN.
</div>
<div th:if="${#authorization.expr('hasRole(''ROLE_ADMIN'')')}">
This will only be displayed if authenticated user has role ROLE_ADMIN.
</div>
</div>
例子摘自：https://github.com/thymeleaf/thymeleaf-extras-springsecurity
但是所顯示的唯一內容是sec:authorize="isAuthenticated()"和sec:authorize="!isAuthenticated()"和授權總是被忽略，而不管用戶的角色。
我thymeleaf配置爲：
@Configuration
public class ThymeleafConfig {
@Bean
public TemplateResolver defaultTemplateResolver() {
TemplateResolver resolver = new TemplateResolver();
resolver.setResourceResolver(thymeleafResourceResolver());
resolver.setPrefix("classpath:/templates/");
resolver.setSuffix(".html");
resolver.setTemplateMode("HTML5");
resolver.setCharacterEncoding("UTF-8");
resolver.setCacheable(true);
return resolver;
}
@Bean
public SpringResourceResourceResolver thymeleafResourceResolver() {
return new SpringResourceResourceResolver();
}
@Bean
public SpringTemplateEngine templateEngine(TemplateResolver templateResolver) {
SpringTemplateEngine engine = new SpringTemplateEngine();
engine.setTemplateResolver(templateResolver);
engine.addDialect(new SpringSecurityDialect());
engine.addDialect(new LayoutDialect());
return engine;
}
@Bean
public ThymeleafViewResolver thymeleafViewResolver(SpringTemplateEngine templateEngine) {
ThymeleafViewResolver resolver = new ThymeleafViewResolver();
resolver.setTemplateEngine(templateEngine);
resolver.setCharacterEncoding("UTF-8");
resolver.setContentType("text/html");
resolver.setOrder(Ordered.LOWEST_PRECEDENCE - 5);
return resolver;
}
}
我使用thymeleaf-extras-springsecurity4以下依賴性：
<dependency>
<groupId>org.thymeleaf.extras</groupId>
<artifactId>thymeleaf-extras-springsecurity4</artifactId>
<version>2.1.3.RELEASE</version>
</dependency>
版本3.0.2.RELEASE沒有在所有的工作，並sec命名空間總是被忽略Thymeleaf。
我的春天啓動的版本是1.5.2.RELEASE。
可能是什麼原因？
UPDATE。在SecurityConfig的configure(HttpSecurity http)方法看起來：
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().ignoringAntMatchers("/h2-console").disable()
.authorizeRequests()
.antMatchers("/webjars/**", "/static/**", "/images/**", "/**/favicon.ico").permitAll()
.antMatchers("/heat/**", "/power/**", "/water/**").permitAll()
// start allowing h2-console
.antMatchers("/h2-console/**").permitAll();
http.csrf().disable();
http.headers().frameOptions().disable()
// end allowing h2-console
.and().authorizeRequests().antMatchers("/info").permitAll()
.and().authorizeRequests().antMatchers("https://stackoverflow.com/users/**").authenticated()
.and().authorizeRequests().antMatchers("https://stackoverflow.com/users/**").hasAnyAuthority("ADMIN", "SUPERUSER")
.and().formLogin()
.loginPage("/login")
.permitAll()
.and()
.logout()
.permitAll()
.deleteCookies("remove")
.logoutUrl("/logout")
.logoutSuccessUrl("/")
.invalidateHttpSession(true)
.and().exceptionHandling().accessDeniedPage("/access_denied");
}
，並從IndexController的映射是非常簡單的，它只是返回login模板：
@RequestMapping("/login")
public String loginForm() {
return "login";
}
據我所知的角色僅僅是一個特殊的'ROLE_'前綴的權威。我的角色沒有這個前綴，他們只是'USER'，'ADMIN'等：https://i.stack.imgur.com/jpBA1.png – DimaSan
我聲明我的角色與'ROLE_'當我使用'hasRole'，但表中的角色名稱本身沒有這個前綴。 – DimaSan
@DimaSan：就是這一點。如果您使用'hasRole'，則必須在數據庫中使用前綴。但你可以配置一個不同的前綴或使用'hasAuthority'（如你的答案）。 – dur