Spring已經登錄用戶的安全性重定向問題

Question

在基於GWT的web應用程序中實現spring安全性。我找到。 一切正常工作正常，除了以下事實：

我打開login.jsp並給出我的有效用戶登錄憑據。 提交後，它成功重定向到主頁。現在，當我在地址欄中編輯login.jsp的URL ...令人驚訝的是，它允許打開我的login.jsp，但據我的理解..它不應該允許回到login.jsp直到&，除非我已登錄。

可能是我的security-context.xml文件沒有正確配置。

下面是我的安全應用程序的context.xml

<?xml version="1.0" encoding="UTF-8"?> 

<!-- - Sample namespace-based configuration - --> 

<beans:beans xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
         http://www.springframework.org/schema/beans/spring-beans-2.5.xsd 
         http://www.springframework.org/schema/security 
         http://www.springframework.org/schema/security/spring-security-2.0.4.xsd"> 

    <global-method-security secured-annotations="enabled"> 
    </global-method-security> 

    <beans:bean id="customAuthenticationProcessingFilter" 
     class="edu.authentication.CustomAuthenticationProcessingFilter"> 
     <custom-filter position="AUTHENTICATION_PROCESSING_FILTER" /> 
     <beans:property name="defaultTargetUrl" value="/Home.html?gwt.codesvr=127.0.0.1:9997" /> 
     <beans:property name="authenticationFailureUrl" value="/login.jsp?login_error=1" /> 
     <beans:property name="authenticationManager" ref="authenticationManager" /> 
    </beans:bean> 

    <beans:bean id="authenticationProcessingFilterEntryPoint" 
     class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint"> 
     <beans:property name="loginFormUrl" value="/login.jsp" /> 
     <beans:property name="forceHttps" value="false" /> 
    </beans:bean> 

    <beans:bean id="customUserDetailsService" 
     class="edu.authentication.CustomUserDetailsService"> 
     <beans:property name="urmService" ref="urmService" /> 
    </beans:bean> 

    <http auto-config="false" entry-point-ref="authenticationProcessingFilterEntryPoint"> 

    <intercept-url pattern="/login.jsp*" filters="none" /> 
     <intercept-url pattern="/forgot_password.jsp*" filters="none" /> 
     <intercept-url pattern="/forgotPasswordServlet.do*" filters="none" /> 

    <intercept-url pattern="/myApp/**" access="IS_AUTHENTICATED_FULLY"/> 
     <intercept-url pattern="/gwt/**" access="IS_AUTHENTICATED_FULLY"/> 
     <intercept-url pattern="/*.html" access="IS_AUTHENTICATED_FULLY"/> 

    <logout logout-url="/j_spring_security_logout" 
      invalidate-session="true" logout-success-url="/login.jsp?loggedout=true"/> 
    </http> 

    <authentication-manager alias="authenticationManager" /> 

    <authentication-provider user-service-ref="customUserDetailsService"> 
     <password-encoder hash="md5" /> 
    </authentication-provider> 

</beans:beans> 

任何幫助/建議將是非常appriciable ..

Answer 1

沒有什麼內置到春季安全，以防止您查看登錄頁面登錄後，您可以通過將以下代碼添加到登錄頁面頂部來阻止登錄用戶登錄頁面。

<%@ taglib prefix='sec' uri='http://www.springframework.org/security/tags' %> 
<sec:authorize ifNotGranted="ROLE_ANONYMOUS"> 
    <% response.sendRedirect("/mainpage.jsp"); %> 
</sec:authorize> 

的邏輯是，如果用戶沒有在Spring Security的登錄會創建一個匿名Authentication對象爲他們，爲他們提供ROLE_ANONYMOUS的作用。因此，您只需檢查用戶是否具有該角色，如果他們不這樣做，則可以假定他們已登錄並將其重定向到應用程序的主頁面。

Answer 2

或者，你可以創建一個Servlet過濾器：

public class LoginPageFilter implements Filter 
{ 
    public void init(FilterConfig filterConfig) throws ServletException { 
    } 

    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException 
    { 
     HttpServletRequest request = (HttpServletRequest) servletRequest; 
     HttpServletResponse response = (HttpServletResponse) servletResponse; 

     if(request.getUserPrincipal() != null){ //If user is already authenticated 
      response.sendRedirect("");// or, forward using RequestDispatcher 
     } else{ 
      filterChain.doFilter(servletRequest, servletResponse); 
     } 
    } 

    public void destroy() { 
    } 
} 

的web.xml：

LoginPageFilter com.xxx.xx.LoginPageFilter

<filter-mapping> 
    <filter-name>LoginPageFilter</filter-name> 
    <url-pattern>/login</url-pattern> 
</filter-mapping>