<分区>
我是 Spring 框架的初学者。我和我的 friend 正在写关于波兹南理工大学的工程师论文，我们遇到了 Spring Security (3.1.0) 的问题。我不能很好地注销。当我想再次登录时，我看到消息“用户已登录”(我覆盖了标准的 Spring Security 错误消息)。我试图清除 SecurityContextHolder 的上下文，但它仍然不起作用。
spring-security.xml
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<security:http auto-config="true" create-session="ifRequired">
<security:intercept-url pattern="/start"
access="IS_AUTHENTICATED_ANONYMOUSLY" />
<security:intercept-url pattern="/home" access="ROLE_USER" />
<security:session-management>
<security:concurrency-control
max-sessions="1" error-if-maximum-exceeded="true" />
</security:session-management>
<security:form-login login-page="/start"
default-target-url="/home" authentication-failure-url="/login_error?error=true"
always-use-default-target="true" />
<security:logout invalidate-session="true" logout-success-url="/start" logout-url="/j_spring_security_logout"/>
</security:http>
<security:authentication-manager>
<security:authentication-provider ref="myAuthenticationProvider"/>
</security:authentication-manager>
<bean id="myAuthenticationProvider" name="myAuthenticationProvider" class="org.pp.web.Authentication.XtbAuthenticationProvider"/>
</beans>`
网络.xml
<!-- Spring Security -->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>
org.springframework.web.filter.DelegatingFilterProxy
</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
首页.jsp
<a href="<c:url value="/logout" />">Logout</a>
Controller .java
@RequestMapping(value = "logout")
public String logout() {
SecurityContextHolder.clearContext();
return "redirect:/j_spring_security_logout";
}
@RequestMapping(value = "start")
public String start(Model model, HttpServletRequest request) {
// sprawdzenie czy uzytkownik nie jest juz zalogowany
if (request.getRemoteUser() == null) {
return "start";
} else {
return "redirect:/home";
}
}
我有自己的提供商来检查登录名和密码。
AuthProvider.java
public class AuthenticationProvider implements AuthenticationProvider{
private Logger logger = Logger.getLogger(AuthenticationProvider.class);
@Override
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
authorities.add(new GrantedAuthorityImpl("ROLE_USER"));
UsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication;
String username = String.valueOf(auth.getPrincipal());
String password = String.valueOf(auth.getCredentials());
if(username.length()<4)
{
logger.warn("Error: Login is to short for username: "+ username);
throw new BadCredentialsException("Login is to short!");
}
else if(password.length()<4)
{
logger.warn("Error: Password is to short for username: "+ username);
throw new BadCredentialsException("Password is to short!");
}
else if(!( (username.equals("login") & password.equals("password"))|
(username.equals("login2") & password.equals("password2"))) ) {
logger.warn("Error: Incorrect data for username: "+ username);
throw new BadCredentialsException("Incorrect data!");
}
return new UsernamePasswordAuthenticationToken(
authentication.getName(), authentication.getCredentials(),
authorities);
}
@Override
public boolean supports(Class<?> authentication) {
return authentication.equals(UsernamePasswordAuthenticationToken.class);
}
我试图修复它，我找了很长时间但找不到解决方案。
我希望你能帮助我。
马特乌斯·贾穆泽克， 卢卡斯·格日博夫斯基
编辑: 我覆盖了标准的 Spring Security 错误消息。
修改后的代码。
Controller .java
@RequestMapping(value = "dummy")
public String dummy() {
//SecurityContextHolder.clearContext();
return "redirect:/dummy";
}
@RequestMapping(value = "logout")
public String logout() {
//SecurityContextHolder.clearContext();
return "redirect:/start";
}
虚拟.jsp
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
<html>
<%
session.invalidate();
// String redirectURL = "http://localhost:8080/start";
// response.sendRedirect(redirectURL);
%>
<body>
<%-- <c:redirect url='http://localhost:8080/start' /> --%>
</body>
</html>
首页.jsp
<a href="<c:url value='/dummy' />">Logout</a>