java - 如何在Spring Security中设置always-use-default-target？

Question

我需要在 Spring Boot 应用程序中的 SavedRequestAwareAuthenticationSuccessHandler 中设置always-use-default-target="true"。我怎样才能做到这一点？我尝试过:

@Bean
SavedRequestAwareAuthenticationSuccessHandler handler() {
    SavedRequestAwareAuthenticationSuccessHandler handler = new SavedRequestAwareAuthenticationSuccessHandler();
    handler.setAlwaysUseDefaultTargetUrl(true);
    return  handler;
}

但没有成功。似乎正在使用完全不同的bean

我的安全配置:

@EnableOAuth2Sso
@Configuration
@Order(2)
public class FormWebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired OAuth2ProtectedResourceDetails oAuth2ProtectedResourceDetails;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .antMatcher("/**")
                .authorizeRequests()
                .antMatchers("/login**", "/assets/**", "/uaa/**", "/management/health").permitAll()
                .anyRequest().authenticated()
            .and()
                .headers()
                .defaultsDisabled()
                .frameOptions()
                .sameOrigin()
            .and()
                .csrf()
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                .ignoringAntMatchers("/uaa/**")
            .and()
                .logout()
                .logoutSuccessUrl("/login?logout")
                .permitAll();
    }
}

和:

@Configuration
@Order(1)
public class ApiWebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired OAuth2ProtectedResourceDetails oAuth2ProtectedResourceDetails;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .antMatcher("/api/**")
                .authorizeRequests()
                .anyRequest().authenticated()
            .and()
                .csrf()
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            .and()
                .formLogin()
                .successForwardUrl("/")
            .and()
                .exceptionHandling().authenticationEntryPoint(new Unauthorized401EntryPoint());
    }

    public static class Unauthorized401EntryPoint implements AuthenticationEntryPoint {

        @Override
        public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception)
                throws IOException, ServletException {

            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);

        }
    }
}

Answer 1

使用以下内容进行基于注释的设置:

defaultSuccessUrl("/dashboard",true)

第二个 boolean 参数将 always-use-default-target 设置为 true。