java - Spring 安全 : Ignoring alias of server-name and forcing relogin

Question

我正在开发一个项目，其中使用 Spring-Security 进行身份验证和授权。一切似乎都工作正常，只是 Spring-security 忽略了服务器的 Alias-name 。 因此，例如，如果我使用 domain-name.com 登录并访问某些安全资源，则没有问题。但现在，当有人给我一个像 www-domain-name.com/secured/resource 这样的链接时，我被迫再次登录，然后就可以正常工作了。

如何确保登录时同时登录 domain-name.com 和 www.domain-name.com。这个问题叫什么？

安全-applicationContext.xml:

    <security:http create-session="ifRequired" use-expressions="true" auto-config="false" disable-url-rewriting="true">
        <security:form-login login-page="/login" username-parameter="j_username" password-parameter="j_password"
                             login-processing-url="/j_spring_security_check" default-target-url="/dashboard"
                             always-use-default-target="true" authentication-failure-url="/denied"/>
        <security:remember-me key="_spring_security_remember_me" user-service-ref="userDetailsService"
                              token-validity-seconds="1209600" data-source-ref="dataSource"/>
        <security:logout delete-cookies="JSESSIONID" invalidate-session="true" logout-url="/j_spring_security_logout"/>
            <!--<security:intercept-url pattern="/**" requires-channel="https"/>-->
        <security:port-mappings>
            <security:port-mapping http="8080" https="8443"/>
        </security:port-mappings>
        <security:logout logout-url="/logout" logout-success-url="/" success-handler-ref="myLogoutHandler"/>

        <security:session-management session-fixation-protection="migrateSession">
            <security:concurrency-control session-registry-ref="sessionReg" max-sessions="5" expired-url="/login"/>
        </security:session-management>
    </security:http>

    <beans:bean id="sessionReg" class="org.springframework.security.core.session.SessionRegistryImpl"/>

    <beans:bean id="rememberMeAuthenticationProvider"
                class="org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices">
        <beans:constructor-arg index="0" value="_spring_security_remember_me"/>
        <beans:constructor-arg index="1" ref="userDetailsService"/>
        <beans:constructor-arg index="2" ref="jdbcTokenRepository"/>
        <property name="alwaysRemember" value="true"/>
    </beans:bean>

    <beans:bean id="jdbcTokenRepository"
                class="org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl">
        <beans:property name="createTableOnStartup" value="false"/>
        <beans:property name="dataSource" ref="dataSource"/>
    </beans:bean>

    <!-- Remember me ends here -->
    <security:authentication-manager alias="authenticationManager">
        <security:authentication-provider user-service-ref="LoginServiceImpl">
            <security:password-encoder ref="encoder"/>
        </security:authentication-provider>
    </security:authentication-manager>

    <beans:bean id="encoder"
                class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
        <beans:constructor-arg name="strength" value="11"/>
    </beans:bean>

    <beans:bean id="daoAuthenticationProvider"
                class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
        <beans:property name="userDetailsService" ref="LoginServiceImpl"/>
        <beans:property name="passwordEncoder" ref="encoder"/>
    </beans:bean>
</beans>

如果需要更多信息，请告诉我。谢谢。

更新 我在 CATALINA_HOME/conf/context.xml 的两个 Tomcat 实例中添加了此内容:

<Context sessionCookiePath="/" sessionCookieDomain=".domainname.com" />

这会杀死服务器，网络应用程序将无法加载。我在日志中找不到任何内容。

Answer 1

我认为这不是 spring-security 问题，而是 servlet 问题。您可以尝试为tomcat共享子域cookie:

<Context sessionCookieDomain=".domain-name.com" />

使用 spring-boot:

@Bean
public ServletContextInitializer servletContextInitializer() {
    return new ServletContextInitializer() {

        @Override
        public void onStartup(ServletContext servletContext) throws ServletException
        {
            servletContext.getSessionCookieConfig().setDomain(".domain-name.com");
        }
    };

}

引用号:Best way for allowing subdomain session cookies using Tomcat