这是我在 springboot 应用程序中的安全配置
package com.logan.cricketbeting.security;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import com.logan.cricketbeting.Service.CustomUserDetailsService;
import com.logan.cricketbeting.Service.UserServiceImpl;
//security configuration class for implementing spring security on urls
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private CustomUserDetailsService userDetailsService;
//for handling user success handler
@Autowired
private CustomizeAuthenticationSuccessHandler customizeAuthenticationSuccessHandler;
@Override
//this configuration is for handling user requests
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/orders").permitAll()
.antMatchers("/login").permitAll()
.antMatchers("/admin/**").hasAuthority("admin")
.antMatchers("/distributor/**").hasAuthority("distributor")
.antMatchers("/user/**").hasAuthority("user").anyRequest()
.authenticated().and().csrf().disable().formLogin().successHandler(customizeAuthenticationSuccessHandler)
.loginPage("/login").failureUrl("/login?error=true")
.usernameParameter("username")
.passwordParameter("password")
.and().logout()
.logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
.logoutSuccessUrl("/login").and().exceptionHandling().accessDeniedPage("/403");
}
//this method allows static resources to be neglected by spring security
@Override
public void configure(WebSecurity web) throws Exception {
web
.ignoring()
.antMatchers("/resources/**", "/static/**", "/css/**", "/js/**", "/images/**","/assets/**","/fonts/**","/vendor/**");
}
@Bean
public BCryptPasswordEncoder passwordEncoder() {
BCryptPasswordEncoder bCryptPasswordEncoder = new BCryptPasswordEncoder();
return bCryptPasswordEncoder;
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
//BCryptPasswordEncoder encoder = passwordEncoder();
//auth.inMemoryAuthentication().withUser("logan@yahoo.com").password(encoder.encode("admin")).roles("user");
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}
}
这是我的自定义成功处理程序
package com.logan.cricketbeting.security;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.stereotype.Component;
/*
* This is an Authentication Success handler class for handling what happens after the user is suc
* successfully logined in the application
*
*
*
* */
@Component
public class CustomizeAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
@Override
public void onAuthenticationSuccess(HttpServletRequest request,
HttpServletResponse response, Authentication authentication)
throws IOException, ServletException {
//set our response to OK status
response.setStatus(HttpServletResponse.SC_OK);
//this check granted authorities against the username
for (GrantedAuthority auth : authentication.getAuthorities()) {
//if the granted authority is user then it is allowed
//if its admin it is allowed
if("admin".equals(auth.getAuthority())) {
response.sendRedirect("/admin/home"); //working fine
}
else if("distributor".equals(auth.getAuthority())) {
response.sendRedirect("/distributor/home");//working fine
}
else if ("user".equals(auth.getAuthority())) {
response.sendRedirect("/user/home");//it is not working
}
//else it redirects to the 403 forbidden error
else {
response.sendRedirect("/403");
}
}
}
}
我的管理员和分销商 url 登录后工作正常，但用户 url 给出错误
java.lang.IllegalStateException：无法在 已提交响应
我不知道故障在哪里，知道如何解决这个问题???
如果用户有多个权限，您的代码调用将多次发送重定向。在每次发送重定向后添加中断或返回应该可以解决问题。