警告:可能的错误:过滤器都是org.springframework.security.web.session.Sessi

Question

我正在使用Spring MVC和Spring安全性开发一个web应用程序。实际上我没有一个错误，而是一个警告。看起来这个警告很快就会出现一个错误:)

当我尝试部署我的应用程序时，它已成功部署，但出现警告:

"警告:可能错误:位置7和8的过滤器都是org.springframework.security.web.session.SessionManagementFilter的实例"

我有两个sessionManagementFilter和preAuthenticationFilter在我的spring-security xml。

我用谷歌搜索了这个问题，但看起来没有人得到同样的警告。这个警告是什么?它会导致错误吗?我该如何修复它?我无法解决这个问题，如果有人帮助我，我会很感激。谢谢你。

我spring-security.xml

:

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
    <http create-session="never" use-expressions="true" auto-config="false" entry-point-ref="preAuthenticatedProcessingFilterEntryPoint">
        <custom-filter ref="sessionManagementFilter" before="SESSION_MANAGEMENT_FILTER" />
        <intercept-url pattern="/restricted/**" access="isAuthenticated()" />
        <custom-filter position="PRE_AUTH_FILTER" ref="myPreAuthFilter" />
        <session-management>
            <concurrency-control max-sessions="1" error-if-maximum-exceeded="false" expired-url="/invalid-session.xhtml?concurrent=true" />
        </session-management>
        <logout logout-url="/cikis" invalidate-session="true" delete-cookies="JSESSIONID" success-handler-ref="myLogoutHandler" />
    </http>
    <beans:bean id="myLogoutHandler" class="com.test.MyLogoutHandler" />
    <beans:bean id="userDetailsServiceImpl" class="com.test.UserDetailsServiceImpl" />
    <beans:bean id="preAuthenticatedProcessingFilterEntryPoint" class="com.test.ForbiddenURLEntryPoint" />
    <beans:bean id="preAuthenticationProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
        <beans:property name="preAuthenticatedUserDetailsService" ref="userDetailsServiceImpl" />
    </beans:bean>
    <beans:bean id="myPreAuthFilter" class="com.test.MyPreAuthenticationFilter">
        <beans:property name="authenticationManager" ref="appControlAuthenticationManager" />
    </beans:bean>
    <beans:bean id="sessionManagementFilter" class="org.springframework.security.web.session.SessionManagementFilter">
        <beans:constructor-arg name="securityContextRepository" ref="httpSessionSecurityContextRepository" />
        <beans:property name="invalidSessionStrategy" ref="jsfRedirectStrategy" />
    </beans:bean>
    <beans:bean id="jsfRedirectStrategy" class="com.test.JsfRedirectStrategy"/>
    <beans:bean id="httpSessionSecurityContextRepository" class="org.springframework.security.web.context.HttpSessionSecurityContextRepository"/>

    <authentication-manager alias="appControlAuthenticationManager">
        <authentication-provider ref="preAuthenticationProvider" />
    </authentication-manager>
</beans:beans>

Answer 1

Spring安全在启动时默认包含SessionManagementFilter。
如果要指定自己的SESSION_MANAGEMENT_FILTER，则必须禁用会话固定保护，只需键入:

<http create-session="never" use-expressions="true" auto-config="false" entry-point-ref="preAuthenticatedProcessingFilterEntryPoint">
        <session-management session-fixation-protection="none"/>
        <custom-filter ref="sessionManagementFilter" before="SESSION_MANAGEMENT_FILTER" />
        <...>
</http>