無法在Spring Security中登錄

Question

我在實現基於註釋的Spring Security時遇到了問題。

當我從我的角度UI發佈數據時，它碰到了Spring Security，但它並沒有進入登錄嘗試。我不知道我在做什麼錯。

我無國籍登錄過濾器：

class StatelessLoginFilter extends AbstractAuthenticationProcessingFilter { 

    private final TokenAuthenticationService tokenAuthenticationService; 
    private final CustomJDBCDaoImpl userDetailsService; 

    protected StatelessLoginFilter(String urlMapping, TokenAuthenticationService tokenAuthenticationService, 
      CustomJDBCDaoImpl userDetailsService, AuthenticationManager authManager) { 
     super(new AntPathRequestMatcher(urlMapping)); 
     this.userDetailsService = userDetailsService; 
     this.tokenAuthenticationService = tokenAuthenticationService; 
     setAuthenticationManager(authManager); 
    } 

    @Override 
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) 
      throws AuthenticationException, IOException, ServletException { 

       final UsernamePasswordAuthenticationToken loginToken = new UsernamePasswordAuthenticationToken(
       request.getParameter("username").toString(), request.getParameter("password").toString()); 
     return getAuthenticationManager().authenticate(loginToken); 
    } 

    @Override 
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, 
      FilterChain chain, Authentication authentication) throws IOException, ServletException { 

     // Lookup the complete User object from the database and create an Authentication for it 
     final UserDetails authenticatedUser = userDetailsService.loadUserByUsername(authentication.getName()); 
     final UserAuthentication userAuthentication = new UserAuthentication(authenticatedUser); 

     // Add the custom token as HTTP header to the response 
     tokenAuthenticationService.addAuthentication(response, userAuthentication); 

     // Add the authentication to the Security context 
     SecurityContextHolder.getContext().setAuthentication(userAuthentication); 
    } 
} 

我的春季安全配置文件是：

@Configuration 
@EnableWebSecurity 
@EnableGlobalMethodSecurity 
@Order(1) 
public class StatelessAuthenticationSecurityConfig extends WebSecurityConfigurerAdapter { 


    @Autowired 
    private TokenAuthenticationService tokenAuthenticationService; 

    public StatelessAuthenticationSecurityConfig() { 
     super(true); 
    } 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
       .exceptionHandling().and() 
       .anonymous().and() 
       .servletApi().and() 
       .headers().cacheControl().and() 
       .authorizeRequests() 

       //allow anonymous resource requests 
//    .antMatchers("/").permitAll() 
       .antMatchers("/favicon.ico").permitAll() 
       .antMatchers("/resources/**").permitAll() 

       //allow anonymous POSTs to login 
       .antMatchers(HttpMethod.POST, "/api/login").permitAll() 

       //allow anonymous GETs to API 
       .antMatchers(HttpMethod.GET, "/api/**").permitAll() 

       //defined Admin only API area 
       .antMatchers("/api/admin/**").hasRole("ADMIN") 

       //all other request need to be authenticated 
       .anyRequest().hasRole("USER").and()    

       // custom JSON based authentication by POST of {"username":"<name>","password":"<password>"} which sets the token header upon authentication 
       .addFilterBefore(new StatelessLoginFilter("/api/login", tokenAuthenticationService, new CustomJDBCDaoImpl(), authenticationManager()), UsernamePasswordAuthenticationFilter.class) 

       // custom Token based authentication based on the header previously given to the client 
       .addFilterBefore(new StatelessAuthenticationFilter(tokenAuthenticationService), UsernamePasswordAuthenticationFilter.class); 
    } 

    @Bean 
    @Override 
    public AuthenticationManager authenticationManagerBean() throws Exception { 
     return super.authenticationManagerBean(); 
    } 

    @Override 
    protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
     auth.userDetailsService(new CustomJDBCDaoImpl()).passwordEncoder(new BCryptPasswordEncoder()); 
    } 


} 

當我開始我的服務器它進入StatlessLoginFilter構造。但是，當我訪問我的頁面時，它直接顯示我拒絕訪問，而無需嘗試使用我的statelessloginfilter類的LoginLog方法。

我AngularJS POST請求的樣子：

$http.post('/api/login', { username: $scope.user.email, password: $scope.user.password }).success(function (result, status, headers) { 
      $scope.authenticated = true; 
} 

編輯＃1：

加入後http.csrf（）禁用（）我到attemptAuthentication。但是，現在請求參數爲空。

Info: 2016-03-23 00:59:59 DEBUG FilterChainProxy:337 - /api/login at position 1 of 7 in additional filter chain; firing Filter: 'HeaderWriterFilter' 
Info: 2016-03-23 00:59:59 DEBUG FilterChainProxy:337 - /api/login at position 2 of 7 in additional filter chain; firing Filter: 'StatelessLoginFilter' 
Info: 2016-03-23 00:59:59 DEBUG AntPathRequestMatcher:145 - Checking match of request : '/api/login'; against '/api/login' 
Info: 2016-03-23 00:59:59 DEBUG StatelessLoginFilter:205 - Request is to process authentication 
Warning: StandardWrapperValve[com.security.AppConfig]: Servlet.service() for servlet com.security.AppConfig threw exception 
java.lang.NullPointerException 
.... 

Answer 1

嘗試禁用CSFR：

http 
    .csrf().disable(); 

或者implementing它。