Spring Security - 我已經登錄時無法訪問我的歡迎頁面

Question

我有一個使用Spring Security的網站。我已經意識到，當我登錄應用程序時，我試圖再次訪問該網站而不關閉本次會話，我得到一個404錯誤。我的意思是，如果我的應用程序有一個上下文名稱「myApp」，當我沒有登錄時，我可以訪問localhost：8080/myApp，但是當我登錄並輸入該URL時，出現錯誤。例如，如果我輸入localhost：8080/myApp/control/login，它就會正確顯示我的登錄表單。

這裏是我的春天 - 安全配置：

<beans 
    xmlns="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:sec="http://www.springframework.org/schema/security" 
    xsi:schemaLocation=" 
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd 
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd 
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"> 

<sec:http auto-config="true" access-denied-page="/control/login/error"> 
    <sec:intercept-url pattern="/resources/**" filters="none"/> 
    <sec:intercept-url pattern="/favicon.ico" filters="none"/> 
    <sec:intercept-url pattern="/control/login/error" filters="none"/> 
    <sec:intercept-url pattern="/control/login" filters="none"/> 
    <sec:intercept-url pattern="/control/logout" filters="none"/> 
    <sec:intercept-url pattern="/control/newUser" filters="none"/> 
    <sec:intercept-url pattern="/control/invitedUser" filters="none"/> 
    <sec:intercept-url pattern="/control/error" filters="none"/> 

    <sec:intercept-url pattern="/**" access="ROLE_ANONIM,ROLE_GUEST,ROLE_BASIC,ROLE_ADMIN,ROLE_PREMIUM" /> 
    <sec:form-login login-page='/control/login' default-target-url='/control/index' always-use-default-target='true' /> 
<sec:logout logout-success-url="/control/logout"/> 

<sec:session-management> 
<sec:concurrency-control expired-url="/control/login/error" /> 
</sec:session-management> 

在我的web.xml我有指標。 JSP作爲

<welcome-file-list> 
<welcome-file>/index.jsp</welcome-file> 
</welcome-file-list> 

我增加了日誌，當我嘗試訪問我的歡迎頁面，它顯示了一個404錯誤歡迎文件：

18:36:26,309 DEBUG [jpa.support.OpenEntityManagerInViewFilter] Using EntityManagerFactory 'entityManagerFactory' for OpenEntityManagerInViewFilter 
18:36:26,309 DEBUG [factory.support.DefaultListableBeanFactory] Returning cached instance of singleton bean 'entityManagerFactory' 
18:36:26,309 DEBUG [jpa.support.OpenEntityManagerInViewFilter] Opening JPA EntityManager in OpenEntityManagerInViewFilter 
18:36:26,309 DEBUG [security.web.FilterChainProxy] Converted URL to lowercase, from: '/'; to: '/' 
18:36:26,309 DEBUG [security.web.FilterChainProxy] Candidate is: '/'; pattern is /resources/**; matched=false 
18:36:26,309 DEBUG [security.web.FilterChainProxy] Converted URL to lowercase, from: '/'; to: '/' 
18:36:26,309 DEBUG [security.web.FilterChainProxy] Candidate is: '/'; pattern is /favicon.ico; matched=false 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Converted URL to lowercase, from: '/'; to: '/' 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Candidate is: '/'; pattern is /control/login/error; matched=false 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Converted URL to lowercase, from: '/'; to: '/' 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Candidate is: '/'; pattern is /control/login; matched=false 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Converted URL to lowercase, from: '/'; to: '/' 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Candidate is: '/'; pattern is /control/logout; matched=false 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Converted URL to lowercase, from: '/'; to: '/' 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Candidate is: '/'; pattern is /control/newuser; matched=false 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Converted URL to lowercase, from: '/'; to: '/' 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Candidate is: '/'; pattern is /control/inviteduser; matched=false 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Converted URL to lowercase, from: '/'; to: '/' 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Candidate is: '/'; pattern is /control/error; matched=false 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Converted URL to lowercase, from: '/'; to: '/' 
18:36:26,310 DEBUG [security.web.FilterChainProxy] Candidate is: '/'; pattern is /**; matched=true 
18:36:26,310 DEBUG [security.web.FilterChainProxy]/at position 1 of 11 in additional filter chain; firing Filter: 'org.springframework.security.web.session.ConcurrentSessionFilter@172cbae' 
18:36:26,310 DEBUG [security.web.FilterChainProxy]/at position 2 of 11 in additional filter chain; firing Filter: 'org.springframework.security.web.context.SecurityContextPersistenceFilter@a89e44' 
18:36:26,311 DEBUG [web.context.HttpSessionSecurityContextRepository] Obtained a valid SecurityContext from SPRING_SECURITY_CONTEXT: 'org.springframework.security.core.context.SecurityContextImpl@1e4fb61: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@1e4fb61: Principal: es.myComp.myApp.model.Usuario@a3c69a; Password: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffc7f0c: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: CBDBA57F561C0D3C2AC576182D449F00; Granted Authorities: es.myComp.myApp.model.Role@1450701' 
18:36:26,311 DEBUG [security.web.FilterChainProxy]/at position 3 of 11 in additional filter chain; firing Filter: 'org.springframework.security.web.authentication.logout.LogoutFilter@17dfcf1' 
18:36:26,311 DEBUG [security.web.FilterChainProxy]/at position 4 of 11 in additional filter chain; firing Filter: 'org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@697087' 
18:36:26,311 DEBUG [security.web.FilterChainProxy]/at position 5 of 11 in additional filter chain; firing Filter: 'org.springframework.security.web.authentication.www.BasicAuthenticationFilter@5acf13' 
18:36:26,311 DEBUG [authentication.www.BasicAuthenticationFilter] Authorization header: null 
18:36:26,311 DEBUG [security.web.FilterChainProxy]/at position 6 of 11 in additional filter chain; firing Filter: 'org.springframework.security.web.savedrequest.RequestCacheAwareFilter@1d1282d' 
18:36:26,311 DEBUG [security.web.FilterChainProxy]/at position 7 of 11 in additional filter chain; firing Filter: 'org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@a4b9da' 
18:36:26,311 DEBUG [security.web.FilterChainProxy]/at position 8 of 11 in additional filter chain; firing Filter: 'org.springframework.security.web.authentication.AnonymousAuthenticationFilter@130f268' 
18:36:26,311 DEBUG [web.authentication.AnonymousAuthenticationFilter] SecurityContextHolder not populated with anonymous token, as it already contained: 'org.springframework.security.authentication.UsernamePasswordAuthenticationToken@1e4fb61: Principal: es.myComp.myApp.model.Usuario@a3c69a; Password: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffc7f0c: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: CBDBA57F561C0D3C2AC576182D449F00; Granted Authorities: es.myComp.myApp.model.Role@1450701' 
18:36:26,311 DEBUG [security.web.FilterChainProxy]/at position 9 of 11 in additional filter chain; firing Filter: 'org.springframework.security.web.session.SessionManagementFilter@95772a' 
18:36:26,311 DEBUG [security.web.FilterChainProxy]/at position 10 of 11 in additional filter chain; firing Filter: 'org.springframework.security.web.access.ExceptionTranslationFilter@c26acd' 
18:36:26,311 DEBUG [security.web.FilterChainProxy]/at position 11 of 11 in additional filter chain; firing Filter: 'org.springframework.security.web.access.intercept.FilterSecurityInterceptor@1f1bf46' 
18:36:26,311 DEBUG [access.intercept.DefaultFilterInvocationSecurityMetadataSource] Converted URL to lowercase, from: '/'; to: '/' 
18:36:26,312 DEBUG [access.intercept.DefaultFilterInvocationSecurityMetadataSource] Candidate is: '/'; pattern is /**; matched=true 
18:36:26,312 DEBUG [access.intercept.FilterSecurityInterceptor] Secure object: FilterInvocation: URL: /; Attributes: [ROLE_ANONIM, ROLE_GUEST, ROLE_BASIC, ROLE_ADMIN, ROLE_PREMIUM] 
18:36:26,312 DEBUG [access.intercept.FilterSecurityInterceptor] Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@1e4fb61: Principal: es.myComp.myApp.model.Usuario@a3c69a; Password: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffc7f0c: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: CBDBA57F561C0D3C2AC576182D449F00; Granted Authorities: es.myComp.myApp.model.Role@1450701 
18:36:26,312 DEBUG [access.vote.AffirmativeBased] Voter: org.springframework.security.access.vote.RoleVoter@1b24628, returned: 1 
18:36:26,312 DEBUG [access.intercept.FilterSecurityInterceptor] Authorization successful 
18:36:26,312 DEBUG [access.intercept.FilterSecurityInterceptor] RunAsManager did not change Authentication object 
18:36:26,312 DEBUG [security.web.FilterChainProxy]/reached end of additional filter chain; proceeding with original chain 
18:36:26,312 DEBUG [web.access.ExceptionTranslationFilter] Chain processed normally 
18:36:26,312 DEBUG [web.context.SecurityContextPersistenceFilter] SecurityContextHolder now cleared, as request processing completed 
18:36:26,312 DEBUG [jpa.support.OpenEntityManagerInViewFilter] Closing JPA EntityManager in OpenEntityManagerInViewFilter 
18:36:26,312 DEBUG [orm.jpa.EntityManagerFactoryUtils] Closing JPA EntityManager 

編輯：它只有當我已經登錄情況。這可能是會議的問題嗎？

在此先感謝。

編輯：我有春天3.0.0 RC3和春季安全3.0.0 RC1 它仍然發生，任何想法？

Answer 1

我解決它通過使用JSP的只是用來重定向到index.jsp的REST URL並在歡迎設置 - 將JSP以斜槓開始的位置的絕對路徑。

Answer 2

mmmm，這個URL是否工作http://localhost:8080/myApp/control/index或它顯示呢？這是default-target-url屬性中的一個。

而沒有/？

<welcome-file-list> 
<welcome-file>index.jsp</welcome-file> 
</welcome-file-list> 

Answer 3

<sec:intercept-url pattern="/**" access="ROLE_ANONIM,ROLE_GUEST,ROLE_BASIC,ROLE_ADMIN,ROLE_PREMIUM" /> 

正在合格的URL那裏，只能由那些用戶訪問。

另外，我注意到你使用ROLE_ANONIM，但你還沒有配置它設置爲默認角色。我的意思是這樣

<sec:anonymous username="guest" granted-authority="ROLE_ANONIM"/> 


<sec:intercept-url pattern="/control/login**" filters="none" /> 

添加上述行應該解決您的問題