spring security3.1配置比较纠结的2个问题

Posted 2021-02-03 panchanggui

转自：http://www.iteye.com/topic/1122629

总论
无疑问的，spring security在怎么保护网页应用安全上做得很强很周全，但有些地方还是很差强人意，比如对<http/>这个标签，对auto-config="true"与use-expressions="true"的描述和关系辨析上，就语焉不详。升级到3.1版本后，居然发现有莫名奇妙的错误，比如无法解析‘ROLE_ADMIN‘这样的标准配置，或者报：

引用 Field or property cannot be found on object of type ‘org.springframework.security.web.access.expression.WebSecurityExpressionRoot‘

这样摸不着头脑的错误。如果有遇到这类问题，一个要仔细看官方文档，彻底理解use-expressions的含义，比如，

在用use-expressions后，就不能用access="ROLE_USER"这样的配置了;

而且在3.1之后，如果同时用auto-config=‘true‘和use-expression="true"是不行的，就好比撞了两面墙，左右不是，这种问题的确是使用spring security这样的庞然大物时比较令人生畏之处，用好了事情迎刃而解，用不好破敌800自损3000，这是因为安全本身就很复杂，一般只能case by case的实现和解决，也难为了做spring security这群人了。

how to do it？

啃吧，专注深入的学习spring security，从它的手册tutorial一点点看起。

问题解决：

<http use-expressions="true">
　　<logout />
　　<remember-me />
　　<session-management invalid-session-url="/timeout.jsp">
　　　　<concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
　　</session-management>

　　<!--下边的access="xxxxx" 中的属性加上就报错不知为知-->
　　<intercept-url pattern="/login.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" />
　　<intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" />
　　<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=true" default-target-url="/" />
</http>

报错：

java.lang.IllegalArgumentException: Failed to evaluate expression ‘IS_AUTHENTICATED_ANONYMOUSLY‘
at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:13)
at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:34)
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:50)
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:203)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:106)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:97)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:100)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:78)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:112)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:35)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:187)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:79)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
at org.springframework.security.web.session.ConcurrentSessionFilter.doFilter(ConcurrentSessionFilter.java:109)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:169)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:104)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:261)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:581)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
at java.lang.Thread.run(Thread.java:619)
Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1008E:(pos 0): Field or property ‘IS_AUTHENTICATED_ANONYMOUSLY‘ cannot be found on object of type ‘org.springframework.security.web.access.expression.WebSecurityExpressionRoot‘
at org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:206)
at org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:71)
at org.springframework.expression.spel.ast.SpelNodeImpl.getTypedValue(SpelNodeImpl.java:102)
at org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:97)
at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:11)
... 41 more

解决：
改成access="hasRole(‘ROLE_USER‘)"就行了

问题2：
今天发现spring全部进级到3.1了，官方网站说是100％与3.0兼容，当然这指的是spring framework，可能没有包含spring security。

按照我之前进级的经验来说，起首xml头上的xsd文件版本要更新一下，从3.0.xsd改为3.1.xsd
别的，碰到了一个问题就是spring security3.1中不再支撑filter="none"了

比如：

<http use-expression="true" auto-config="true">
    <intercept-url pattern="/static/**" filters="none"/>
    <intercept-url pattern="/security/**" access="hasRole（""ROLE_ADMIN""）" />
    <intercept-url pattern="/**" access="hasRole（""ROLE_USER""）"/>
    <http-basic/>
</http>
须要改成：
<http pattern="/static/**" security="none"/>
<http use-expression="true" auto-config="true">
    <intercept-url pattern="/security/**" access="hasRole（""ROLE_ADMIN""）" />
    <intercept-url pattern="/**" access="hasRole（""ROLE_USER""）"/>
    <http-basic/>
</http>