Spring 安全注销
Spring Security Logout
我 运行 在 Spring 安全方面遇到了麻烦。我能够登录但不能注销（至少不是预期的那样）。
登录后，我将被重定向到 /secure/home.xhtml <- 这工作正常，符合预期。但是我无法通过#{request.contextPath}/logout 注销。 （我在 spring 安全配置中更改了注销 url，但我也尝试使用默认设置）总是出现 404.
这里是目前的代码：
index.xhtm <- 工作正常
<form method="POST" id="loginForm" action="#{request.contextPath}/j_spring_security_check" class="form-signin" autocomplete="off">
<div class="form-group">
<label for="username" class="control-label">#{bundle["login.username"]}</label>
<input type="text" name="username" id="username" class="input-block-level form-control"
placeholder="#{bundle['label.username']}" required="true" tabindex="1" />
<span class="help-block"></span>
</div>
<div class="form-group">
<label for="password" class="control-label">#{bundle["login.password"]}</label>
<input type="password" class="input-block-level form-control" name="password" id="password" tabindex="2"
placeholder="#{bundle['label.password']}" required="true" />
<span class="help-block"></span>
</div>
<button type="submit" tabindex="3" class="btn btn-success btn-block">#{bundle["login.action"]}</button>
<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
</form>
spring-security.xhtml, http 配置文件
<security:http use-expressions="true" >
<security:intercept-url pattern="/secure/**" access="hasAnyRole('USER','ADMIN')" />
<security:intercept-url pattern="/admin/**" access="hasRole('ADMIN')" />
<!--<security:access-denied-handler error-page="/404.xhtml" />-->
<security:form-login
login-page="/index.xhtml"
default-target-url="/secure/home.xhtml"
authentication-failure-url="/index.xhtml?error"
username-parameter="username"
password-parameter="password" />
<security:logout logout-url="/logout" logout-success-url="/index.xhtml?logout" invalidate-session="true" delete-cookies="JSESSIONID" />
<security:csrf />
</security:http>
这是我尝试实现关于 Whosebug 上其他答案的注销的方式：
<a href="#{request.contextPath}/logout">logout</a>
<h:outputLink value="#{request.contextPath}/logout">Logout</h:outputLink>
但是两个 link 都不起作用。我得到了 404。我还读到你应该用 pageContext.request.contextPath 替换 request.contextPath 但这也不起作用。 （而不是 localhost:8080/myContext/logout link 会将我重定向到 localhost:8080/注销）
一个教程告诉我，注销也可以用这个实现：
<form method="POST" id="loginForm" action="#{request.contextPath}/logout" class="form-signin" autocomplete="off">
<button type="submit" tabindex="3" class="btn btn-success btn-block">#{bundle["logout.action"]}</button>
<input type="hidden" name="#{_csrf.parameterName}" value="#{_csrf.token}" />
</form>
一开始它似乎解决了我的问题，但在向安全部分添加更多页面后，例如 "profile.xhtml"，我遇到了页面加载后我被注销的不良行为。
因此，如果我在我的 home.xhtml 中添加上面的注销表单，即使我不单击注销，我也会被注销。如果我刷新页面，即使我没有点击注销，我也会被重定向到 index.xhtml（登录）。因此，如果我单击 link 到 profile.xhtml，我自然会被重定向到 index.xhtml，因为 spring 认为我已注销。没有这个表格，我会保持登录状态，但无法注销！一团糟！
啊，如果我单击表单上的注销按钮，我会收到以下错误消息：
HTTP Status 403 - Expected CSRF token not found. Has your session expired?
type Status report
messageExpected CSRF token not found. Has your session expired?
descriptionAccess to the specified resource has been forbidden.
我真的不知道我的配置有什么问题:(!
这是我的 web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
version="3.1">
<context-param>
<param-name>javax.faces.PROJECT_STAGE</param-name>
<param-value>Development</param-value>
</context-param>
<context-param>
<param-name>javax.faces.FACELETS_SKIP_COMMENTS</param-name>
<param-value>true</param-value>
</context-param>
<context-param>
<param-name>javax.faces.INTERPRET_EMPTY_STRING_SUBMITTED_VALUES_AS_NULL</param-name>
<param-value>true</param-value>
</context-param>
<context-param>
<param-name>javax.servlet.jsp.jstl.fmt.localizationContext</param-name>
<param-value>messages</param-value>
</context-param>
<context-param>
<param-name>javax.faces.STATE_SAVING_METHOD</param-name>
<param-value>server</param-value>
</context-param>
<context-param>
<param-name>javax.faces.DEFAULT_SUFFIX</param-name>
<param-value>.xhtml</param-value>
</context-param>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath:/application-context.xml
classpath:/application-security.xml
</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<listener>
<listener-class>com.sun.faces.config.ConfigureListener</listener-class>
</listener>
<!-- Predefined pages -->
<welcome-file-list>
<welcome-file>index.xhtml</welcome-file>
</welcome-file-list>
<!-- <error-page>
<error-code>403</error-code>
<location>/error.xhtml</location>
</error-page>-->
<error-page>
<error-code>404</error-code>
<location>/404.xhtml</location>
</error-page>
<error-page>
<error-code>500</error-code>
<location>/error.xhtml</location>
</error-page>
<error-page>
<exception-type>javax.faces.application.ServletException</exception-type>
<location>/index.xhtml</location>
</error-page>
<error-page>
<exception-type>java.lang.Exception</exception-type>
<location>/error.xhtml</location>
</error-page>
<session-config>
<session-timeout>30</session-timeout>
</session-config>
<servlet>
<servlet-name>Faces Servlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>*.xhtml</url-pattern>
</servlet-mapping>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/logout</url-pattern>
</filter-mapping>
<!-- MIME TYPES -->
<mime-mapping>
<extension>css</extension>
<mime-type>text/css</mime-type>
</mime-mapping>
<mime-mapping>
<extension>eot</extension>
<mime-type>application/x-font-eot</mime-type>
</mime-mapping>
<mime-mapping>
<extension>js</extension>
<mime-type>text/javascript</mime-type>
</mime-mapping>
<mime-mapping>
<extension>latex</extension>
<mime-type>application/x-latex</mime-type>
</mime-mapping>
<mime-mapping>
<extension>otf</extension>
<mime-type>application/x-font-opentype</mime-type>
</mime-mapping>
<mime-mapping>
<extension>roff</extension>
<mime-type>application/x-troff</mime-type>
</mime-mapping>
<mime-mapping>
<extension>svg</extension>
<mime-type>application/svg+xml</mime-type>
</mime-mapping>
<mime-mapping>
<extension>ttf</extension>
<mime-type>application/x-font-ttf</mime-type>
</mime-mapping>
<mime-mapping>
<extension>woff</extension>
<mime-type>application/x-font-woff</mime-type>
</mime-mapping>
<mime-mapping>
<extension>woff2</extension>
<mime-type>application/x-font-woff2</mime-type>
</mime-mapping>
</web-app>
使用 GlassFish 4.1、spring 框架版本 4.1。2.RELEASE 和 spring 安全版本 3.2。5.RELEASE。
我将不胜感激每一个答案。这个错误已经花了两天没有任何解决方案:(
使用 spring url taglig 或 jstl url taglib 写下您的 url。 This post 适合学习 spring 安全配置
您在 .
启用了 CRLF 保护
您可以尝试通过将此添加到您的表单来支持 CRLF：
<input type="hidden"
name="${_csrf.parameterName}"
value="${_csrf.token}"/>
如果这不起作用，您可以删除 CSRF - 尽管不推荐这样做。
更多信息：http://docs.spring.io/spring-security/site/docs/3.2.x/reference/htmlsingle/#csrf
我 运行 在 Spring 安全方面遇到了麻烦。我能够登录但不能注销（至少不是预期的那样）。
登录后，我将被重定向到 /secure/home.xhtml <- 这工作正常，符合预期。但是我无法通过#{request.contextPath}/logout 注销。 （我在 spring 安全配置中更改了注销 url，但我也尝试使用默认设置）总是出现 404.
这里是目前的代码：
index.xhtm <- 工作正常
<form method="POST" id="loginForm" action="#{request.contextPath}/j_spring_security_check" class="form-signin" autocomplete="off">
<div class="form-group">
<label for="username" class="control-label">#{bundle["login.username"]}</label>
<input type="text" name="username" id="username" class="input-block-level form-control"
placeholder="#{bundle['label.username']}" required="true" tabindex="1" />
<span class="help-block"></span>
</div>
<div class="form-group">
<label for="password" class="control-label">#{bundle["login.password"]}</label>
<input type="password" class="input-block-level form-control" name="password" id="password" tabindex="2"
placeholder="#{bundle['label.password']}" required="true" />
<span class="help-block"></span>
</div>
<button type="submit" tabindex="3" class="btn btn-success btn-block">#{bundle["login.action"]}</button>
<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
</form>
spring-security.xhtml, http 配置文件
<security:http use-expressions="true" >
<security:intercept-url pattern="/secure/**" access="hasAnyRole('USER','ADMIN')" />
<security:intercept-url pattern="/admin/**" access="hasRole('ADMIN')" />
<!--<security:access-denied-handler error-page="/404.xhtml" />-->
<security:form-login
login-page="/index.xhtml"
default-target-url="/secure/home.xhtml"
authentication-failure-url="/index.xhtml?error"
username-parameter="username"
password-parameter="password" />
<security:logout logout-url="/logout" logout-success-url="/index.xhtml?logout" invalidate-session="true" delete-cookies="JSESSIONID" />
<security:csrf />
</security:http>
这是我尝试实现关于 Whosebug 上其他答案的注销的方式：
<a href="#{request.contextPath}/logout">logout</a>
<h:outputLink value="#{request.contextPath}/logout">Logout</h:outputLink>
但是两个 link 都不起作用。我得到了 404。我还读到你应该用 pageContext.request.contextPath 替换 request.contextPath 但这也不起作用。 （而不是 localhost:8080/myContext/logout link 会将我重定向到 localhost:8080/注销）
一个教程告诉我，注销也可以用这个实现：
<form method="POST" id="loginForm" action="#{request.contextPath}/logout" class="form-signin" autocomplete="off">
<button type="submit" tabindex="3" class="btn btn-success btn-block">#{bundle["logout.action"]}</button>
<input type="hidden" name="#{_csrf.parameterName}" value="#{_csrf.token}" />
</form>
一开始它似乎解决了我的问题，但在向安全部分添加更多页面后，例如 "profile.xhtml"，我遇到了页面加载后我被注销的不良行为。 因此，如果我在我的 home.xhtml 中添加上面的注销表单，即使我不单击注销，我也会被注销。如果我刷新页面，即使我没有点击注销，我也会被重定向到 index.xhtml（登录）。因此，如果我单击 link 到 profile.xhtml，我自然会被重定向到 index.xhtml，因为 spring 认为我已注销。没有这个表格，我会保持登录状态，但无法注销！一团糟！
啊，如果我单击表单上的注销按钮，我会收到以下错误消息：
HTTP Status 403 - Expected CSRF token not found. Has your session expired?
type Status report
messageExpected CSRF token not found. Has your session expired?
descriptionAccess to the specified resource has been forbidden.
我真的不知道我的配置有什么问题:(!
这是我的 web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
version="3.1">
<context-param>
<param-name>javax.faces.PROJECT_STAGE</param-name>
<param-value>Development</param-value>
</context-param>
<context-param>
<param-name>javax.faces.FACELETS_SKIP_COMMENTS</param-name>
<param-value>true</param-value>
</context-param>
<context-param>
<param-name>javax.faces.INTERPRET_EMPTY_STRING_SUBMITTED_VALUES_AS_NULL</param-name>
<param-value>true</param-value>
</context-param>
<context-param>
<param-name>javax.servlet.jsp.jstl.fmt.localizationContext</param-name>
<param-value>messages</param-value>
</context-param>
<context-param>
<param-name>javax.faces.STATE_SAVING_METHOD</param-name>
<param-value>server</param-value>
</context-param>
<context-param>
<param-name>javax.faces.DEFAULT_SUFFIX</param-name>
<param-value>.xhtml</param-value>
</context-param>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath:/application-context.xml
classpath:/application-security.xml
</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<listener>
<listener-class>com.sun.faces.config.ConfigureListener</listener-class>
</listener>
<!-- Predefined pages -->
<welcome-file-list>
<welcome-file>index.xhtml</welcome-file>
</welcome-file-list>
<!-- <error-page>
<error-code>403</error-code>
<location>/error.xhtml</location>
</error-page>-->
<error-page>
<error-code>404</error-code>
<location>/404.xhtml</location>
</error-page>
<error-page>
<error-code>500</error-code>
<location>/error.xhtml</location>
</error-page>
<error-page>
<exception-type>javax.faces.application.ServletException</exception-type>
<location>/index.xhtml</location>
</error-page>
<error-page>
<exception-type>java.lang.Exception</exception-type>
<location>/error.xhtml</location>
</error-page>
<session-config>
<session-timeout>30</session-timeout>
</session-config>
<servlet>
<servlet-name>Faces Servlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>*.xhtml</url-pattern>
</servlet-mapping>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/logout</url-pattern>
</filter-mapping>
<!-- MIME TYPES -->
<mime-mapping>
<extension>css</extension>
<mime-type>text/css</mime-type>
</mime-mapping>
<mime-mapping>
<extension>eot</extension>
<mime-type>application/x-font-eot</mime-type>
</mime-mapping>
<mime-mapping>
<extension>js</extension>
<mime-type>text/javascript</mime-type>
</mime-mapping>
<mime-mapping>
<extension>latex</extension>
<mime-type>application/x-latex</mime-type>
</mime-mapping>
<mime-mapping>
<extension>otf</extension>
<mime-type>application/x-font-opentype</mime-type>
</mime-mapping>
<mime-mapping>
<extension>roff</extension>
<mime-type>application/x-troff</mime-type>
</mime-mapping>
<mime-mapping>
<extension>svg</extension>
<mime-type>application/svg+xml</mime-type>
</mime-mapping>
<mime-mapping>
<extension>ttf</extension>
<mime-type>application/x-font-ttf</mime-type>
</mime-mapping>
<mime-mapping>
<extension>woff</extension>
<mime-type>application/x-font-woff</mime-type>
</mime-mapping>
<mime-mapping>
<extension>woff2</extension>
<mime-type>application/x-font-woff2</mime-type>
</mime-mapping>
</web-app>
使用 GlassFish 4.1、spring 框架版本 4.1。2.RELEASE 和 spring 安全版本 3.2。5.RELEASE。
我将不胜感激每一个答案。这个错误已经花了两天没有任何解决方案:(
使用 spring url taglig 或 jstl url taglib 写下您的 url。 This post 适合学习 spring 安全配置
您在 .
启用了 CRLF 保护您可以尝试通过将此添加到您的表单来支持 CRLF：
<input type="hidden"
name="${_csrf.parameterName}"
value="${_csrf.token}"/>
如果这不起作用，您可以删除 CSRF - 尽管不推荐这样做。
更多信息：http://docs.spring.io/spring-security/site/docs/3.2.x/reference/htmlsingle/#csrf