无法在 Spring Security 3 中允许静态资源

Posted 2023-02-27

【中文标题】无法在 Spring Security 3 中允许静态资源

【英文标题】：unable to allow static resources in spring security 3

【发布时间】：2013-05-04 18:27:08

【问题描述】：

我（如 js、css、图像）。下面是我的配置文件。

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:security="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
              http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
              http://www.springframework.org/schema/security 
              http://www.springframework.org/schema/security/spring-security-3.1.xsd">



    <bean id="authenticationEntryPoint"
        class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
        <property name="loginFormUrl" value="/login.htm" />
    </bean>

    <security:http security="none" pattern="/js/ajaxScript.js"/>   
    <security:http security="none" pattern="/js/commonScript.js"/>  

    <bean class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler" />

    <security:http auto-config="false" entry-point-ref="authenticationEntryPoint" disable-url-rewriting="true" use-expressions="true">

        <security:custom-filter position="FORM_LOGIN_FILTER"
            ref="customAuthenticationProcessingFilter" />

<!--        <security:intercept-url pattern="/js/jquery.min.js" access="isAuthenticated()" /> -->
<!--        <security:intercept-url pattern="/js/**/**" access="permitAll" />  -->
        <security:intercept-url pattern="/displayAdminPage.htm" access="hasRole('ROLE_ADMIN')" />
        <security:access-denied-handler ref="accessDeniedHandler" />

    </security:http>

    <security:authentication-manager alias="authenticationManager">
       <security:authentication-provider user-service-ref="customUserDetailService">
       </security:authentication-provider>
    </security:authentication-manager> 

    <bean id="customUserDetailService" class="com.qait.cdl.services.impl.UserSecurityServiceImpl">
        <property name="userDao" ref="userDao"/>
       </bean>

    <bean id="customAuthenticationProcessingFilter"
        class="com.qait.cdl.services.impl.CustomAuthenticationProcessingFilter">
        <property name="authenticationManager" ref="authenticationManager" />
    </bean>

    <bean id="accessDeniedHandler"
        class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
        <property name="errorPage" value="/WEB-INF/jsp/customLoginForm/denied.jsp" />
    </bean>
</beans> 

我不知道我错在哪里？我希望所有 js、图像、css 都必须被 spring security 绕过。JS 文件存在于 webapp/js 和 webapp/js/commonScript 文件夹中。图像存在于 webapp/图片文件夹。

下面是我的 web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    id="WebApp_ID" version="2.5">
    <display-name>cdl</display-name>
    <servlet>
        <servlet-name>dispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>dispatcher</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <servlet>
        <servlet-name>startUpServlet</servlet-name>
        <servlet-class>com.qait.cdl.commons.startup.StartUpServlet</servlet-class>
        <load-on-startup>2</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>startUpServlet</servlet-name>
        <url-pattern>/startUpServlet.htm</url-pattern>
    </servlet-mapping>

    <welcome-file-list>
        <welcome-file>redirect.jsp</welcome-file>
    </welcome-file-list>

    <context-param>
        <param-name>CDL_ENV</param-name>
        <param-value>staging</param-value>
    </context-param>

    <listener>
        <listener-class>com.qait.cdl.commons.startup.CdlContextListner</listener-class>
    </listener>

    <!-- Session timeout -->
    <session-config>
        <session-timeout>600</session-timeout>
    </session-config>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <context-param>
     <param-name>contextConfigLocation</param-name>
     <param-value>
     WEB-INF/applicationContext.xml
<!--      WEB-INF/SpringSecurityConfig.xml -->
     WEB-INF/dispatcher-servlet.xml
     </param-value>
    </context-param>

</web-app>

【参考方案1】：

更新：

从更新的问题来看，静态资源映射存在问题。我们需要在 spring 配置中添加一个静态资源映射，因为所有请求都会传递给 dispatcher servlet。

需要在dispatcher-servelt.xml中添加以下内容

<mvc:resources mapping="/js/**" location="/js/" />

【讨论】：

@ved cmets 在哪里？

@ved 看起来有人删除了 cmets，可能需要查看常见问题或元数据才能了解原因

你是如何获得巨额回购的？我知道原因。但是，我应该怎么做呢？我可以在我的 gmail 联系人中添加你吗？

让我们continue this discussion in chat

【参考方案2】：

对我来说解决方案是

在applicationContext.xml（dispatcher-servelt）中添加标签：

<mvc:resources mapping="/js/**" location="/js/" />

以及我如何在我的项目中使用 Spring Security....在 spring-security.xml 中添加标签：

<http pattern="/js/**" security="none" />

使用 Spring 和 Spring Security 3.1