Spring Security 在新的应用程序启动时重定向到 invalid-session-url

Posted 2023-02-27

【中文标题】Spring Security 在新的应用程序启动时重定向到 invalid-session-url

【英文标题】：Spring Security Redirecting to invalid-session-url on a fresh application launch

【发布时间】：2015-05-07 22:50:16

【问题描述】：

我刚刚在我的 Web 应用程序中配置了会话管理，但 Spring 不断重定向到会话管理中指定的无效会话 URL。在我尝试登录和会话到期之前在浏览器中启动 contextPath 时。

这是我下面的配置：

 <beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd">

<http auto-config="true" use-expressions="true">
            <intercept-url pattern="/login*" access="permitAll" />
            <intercept-url pattern="/styles/calvary.css" access="permitAll" />
            <intercept-url pattern="/styles/vendor/foundation.min.css" access="permitAll" />
            <intercept-url pattern="/styles/vendor/normalize.css" access="permitAll" />
            <intercept-url pattern="/styles/fonts/gothic.eot" access="permitAll" />
            <intercept-url pattern="/styles/fonts/gothic.woff" access="permitAll" />
            <intercept-url pattern="/styles/fonts/gothic.ttf" access="permitAll" />
            <intercept-url pattern="/scripts/vendor/vendor/modernizr.js" access="permitAll" />
            <intercept-url pattern="/scripts/vendor/vendor/jquery.js" access="permitAll" />
            <intercept-url pattern="/scripts/vendor/foundation/foundation.min.js" access="permitAll" />
            <intercept-url pattern="/scripts/vendor/foundation/foundation.abide.js" access="permitAll" />
            <intercept-url pattern="/scripts/calvary.js" access="permitAll" />
            <intercept-url pattern="/images/lg.png" access="permitAll" />
            <intercept-url pattern="/images/red_indicator.gif" access="permitAll" />
            <intercept-url pattern="/**" access="isAuthenticated()" />
            <form-login login-page="/login" default-target-url="/index"  authentication-failure-url="/login?error" username-parameter="username" password-parameter="password" />
            <logout  logout-success-url="/login?logout" invalidate-session="false" delete-cookies="JSESSIONID"/>
            <csrf/>
            <session-management  session-authentication-error-url="/login?expire=3" invalid-session-url="/login?expire=3" session-fixation-protection="migrateSession">
                <concurrency-control error-if-maximum-exceeded="true" max-sessions="1" expired-url="/login?expire"/>
            </session-management>
            
    </http>
    
    
    <authentication-manager>
        <authentication-provider ref="calvaryLogger"/>
    </authentication-manager>
    <beans:bean name="calvaryLogger" class="com.apr.authenticator.CalvaryLogger" /> 
</beans:beans>

我将非常感谢任何帮助。 谢谢

编辑

下面是我的 web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">

<servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <load-on-startup>2</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>dispatcher</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>
<session-config>
    <session-timeout>1</session-timeout>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>
<welcome-file-list>
    <welcome-file>redirect.jsp</welcome-file>
</welcome-file-list>
<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>/WEB-INF/applicationContext.xml
        /WEB-INF/spring-security.xml
    </param-value>
</context-param>
<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
 <listener>
    <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
    <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
    </filter-mapping>
        <error-page>
       <error-code>404</error-code>
       <location>/WEB-INF/viewList/404.html</location>
      </error-page>
   </web-app>

【问题讨论】：

能否请您发布上述场景的错误堆栈跟踪？

没有任何错误堆栈跟踪

那么，哪个无效的 url 正在驱动 u 2 ？

invalid-session-url="/login?expire=3" 同时，这是在用户尝试登录之前的一次新尝试。

你配置 Spring Security Filter 了吗？

【参考方案1】：

我知道很久以前有人问过这个问题，但最近发生在我身上。

一旦用户注销并重新登录，Spring 安全性似乎将我的会话视为无效，并始终将我引导至 invalid-session-url 设置的任何内容。

我刚刚做的是从我的 xml 中删除此设置，问题就消失了。

所以而不是：

<session-management  session-authentication-error-url="/login?expire=3" invalid-session-url="/login?expire=3" session-fixation-protection="migrateSession">
            <concurrency-control error-if-maximum-exceeded="true" max-sessions="1" expired-url="/login?expire"/>
</session-management>

试试：

<session-management  session-authentication-error-url="/login?expire=3" session-fixation-protection="migrateSession">
            <concurrency-control error-if-maximum-exceeded="true" max-sessions="1" expired-url="/login?expire"/>
</session-management>

【讨论】：

看来没有办法了！我不得不删除invalidSessionUrl。

【参考方案2】：

看来！创建会话时出错。请使用Spring-Security 应用映射您的配置。