Spring 静态 Web 项目的安全性

Question

我在为静态 Web 项目实施 spring 安全性时遇到问题。

我的web.xml

<?xml version="1.0"?>
<web-app xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/j2ee" version="2.4" id="WebApp_ID">
    <display-name>Spring Security Application</display-name>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value> /WEB-INF/spring-security.xml </param-value>
    </context-param>
    <!-- Spring Security -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
</web-app>

和我的 spring-security.xml

<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
      http://www.springframework.org/schema/security
      http://www.springframework.org/schema/security/spring-security.xsd">

<security:http auto-config="true" use-expressions="true">

    <security:intercept-url pattern="/security/html/folder1/**" access="isAnonymous()" />

    <security:intercept-url pattern="/security/html/folder2/**" access="isAuthenticated()" />

    <security:intercept-url pattern="/security/html/folder3/**" access="hasRole('ROLE_MANAGER')" />
    <security:intercept-url pattern="/security/html/folder4/**" access="hasRole('ROLE_ADMIN','ROLE_USER','ROLE_MANAGER')" />

    <security:form-login password-parameter="password" username-parameter="username" authentication-failure-url="/login?error" login-page="/login" />
    <security:logout logout-success-url="/login?logout" /> 

</security:http>

<security:authentication-manager>
    <security:authentication-provider>
        <security:user-service>
            <security:user name="user1" password="password" authorities="ROLE_USER, ROLE_ADMIN" />
            <security:user name="user2" password="password" authorities="ROLE_USER" />
            <security:user name="user3" password="password" authorities="ROLE_MANAGER" />
            <security:user name="user4" password="password" authorities="ROLE_ADMIN" />
            <security:user name="user5" password="password" authorities="ROLE_USER, ROLE_MANAGER" />
            <security:user name="user6" password="password" authorities="ROLE_ADMIN, ROLE_MANAGER" />
            <security:user name="user7" password="password" authorities="ROLE_ADMIN, ROLE_USER, ROLE_MANAGER" />
        </security:user-service>
    </security:authentication-provider>
</security:authentication-manager>

我的文件夹结构是 src/main/webapp/WEB-INF/web.xml

src/main/webapp/WEB-INF/spring-security.xml

src/main/webapp/WEB-INF/html/folder1/*.html

src/main/webapp/WEB-INF/html/folder2/*.html

src/main/webapp/WEB-INF/html/folder3/*.html

src/main/webapp/WEB-INF/html/folder4/*.html

我的项目中没有任何欢迎页面或任何其他 java 文件。我需要将其部署在 Tomcat 服务器中。

如果我在配置文件中遗漏任何内容，谁能帮助我

Answer 1

我找到了问题的答案。

两个错误。

我不得不从 intercept-url 中删除 /security，因为 security 是我的上下文根
将 html 文件夹移出 WEB-INF

Spring 静态 Web 项目的安全性

Spring Security for Static Web Project

spring

spring-security

web

tomcat8