我厌倦了寻找如何通过 Spring Security REST json 登录。我为 Android/iOS 编写后端。这是我的 security.xml:
<http use-expressions="true" create-session="stateless" entry-point-ref="restAuthenticationEntryPoint">
<intercept-url pattern="/auth/**" access="permitAll" />
<intercept-url pattern="/**" access="isAuthenticated()" />
<custom-filter ref="myFilter" position="FORM_LOGIN_FILTER"/>
<logout />
</http>
<beans:bean id="myFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
<beans:property name="authenticationManager" ref="authenticationManager"/>
<beans:property name="authenticationSuccessHandler" ref="mySuccessHandler"/>
</beans:bean>
<beans:bean id="mySuccessHandler" class="com.teamodc.jee.webmail.security.MySavedRequestAwareAuthenticationSuccessHandler"/>
<authentication-manager alias="authenticationManager">
<authentication-provider user-service-ref="userDetailsService" />
<authentication-provider ref="authenticationProvider" />
</authentication-manager>
<beans:bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
<beans:property name="userDetailsService" ref="userDetailsService"/>
</beans:bean>
这是我的AuthenticationController:
@Controller
@RequestMapping(value = "/auth")
public class AuthorizationController {
@Autowired
@Qualifier(value = "authenticationManager")
AuthenticationManager authenticationManager;
private SimpleGrantedAuthority anonymousRole = new SimpleGrantedAuthority("ROLE_ANONYMOUS");
@RequestMapping(value = "/login", method = RequestMethod.POST, headers = {"Accept=application/json"})
@ResponseBody
public Map<String, String> login(@RequestParam("login") String username, @RequestParam("password") String password) {
Map<String, String> response = new HashMap<String, String>();
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password);
try {
Authentication auth = authenticationManager.authenticate(token);
SecurityContextHolder.getContext().setAuthentication(auth);
response.put("status", "true");
return response;
} catch (BadCredentialsException ex) {
System.out.println("Login 3");
response.put("status", "false");
response.put("error", "Bad credentials");
return response;
}
}
最后,我的web.xml:
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/spring/appServlet/servlet-context.xml
</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<servlet>
<servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/appServlet/dispatcher.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<filter>
<filter-name>charsetFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
<init-param>
<param-name>forceEncoding</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>charsetFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
我已经从 Firefox Rest 客户端测试了它,但是当我设置 URL 为 bla/user/1 时,它花了我 401(这是正确的),但是当 URL 为 bla/auth/login 时,它花了我 404,然后返回警告 [org.springframework.web.servlet.PageNotFound] - 但是当我在 @Controller 中标记路径时会发生什么
最佳答案
您的login()
方法似乎映射到 /auth/auth/login
。在方法级别给出的路径 @RequestMapping
注解是相对于类级别注解而言的。
尝试将方法级别注释更改为 @RequestMapping(value = "/login"...
.
编辑:
如果这只是一个拼写错误,并且您在处理程序映射方面仍然存在问题,那么请确保您的 spring 上下文中有适当的说明:
-
<context:component-scan base-package="package.for.controllers"/>
以便将您的 Controller 实例化为 spring beans。 -
<mvc:annotation-driven/>
为了获得对@RequestMapping
的支持带注释的 Controller 方法。请参阅reference docs了解更多信息。
此外,请确保它们实际上位于同一上下文中(通常在 servlet 上下文中)。
关于java - Spring Security REST 授权,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/15626917/