Html 图像不会为已注销的用户加载 - Spring/SpringSecurity [重复]

Posted 2023-02-26

【中文标题】Html 图像不会为已注销的用户加载 - Spring/SpringSecurity [重复]

【英文标题】：Html images won't load for users that are logged out - Spring/SpringSecurity [duplicate]

【发布时间】：2018-08-30 15:49:22

【问题描述】：

如标题所述，当用户看到我的 spring webapp 的欢迎页面时，嵌入的 html 图像不会加载，只会显示损坏的图像图标。 当用户登录时，图像都是可见的。

没有出现错误，我感觉它与 Spring Security 功能有关，是否有任何解决方案/解决方法？

我的 HTML 代码：

<a> <img src="src/main/resources/static/images/logo.jpg"> </img></a>

我的控制器：

 @RequestMapping(value="/","home")
       public String home()
           return "home";
       

我的网络安全：

package com.FYP.Club.Security;


import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import com.FYP.Club.repository.UserLoginRepository;


@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter 

    @Autowired
       UserLoginRepository userLoginRepository;

    //http.authorizeRequests().antMatchers("/", "/home", "/registeruser").permitAll().antMatchers("/admin").hasRole("ADMIN")

     @Autowired
     DataSource dataSource;

        @Override
        protected void configure(HttpSecurity http) throws Exception 
            http.authorizeRequests().antMatchers("/", "/home", "/registeruser").permitAll().antMatchers("/admin").hasRole("ADMIN")
                    .anyRequest().authenticated().and().formLogin().loginPage("/login").permitAll().and().logout()
                    .permitAll();
            http.exceptionHandling().accessDeniedPage("/403");
            http.csrf().disable();
            //disable csrf to allow communication (we also dont need for this fyp as its not live)
        

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception 


           auth.jdbcAuthentication().dataSource(dataSource)
          .usersByUsernameQuery("select user_name,password,user_status from user_login where user_name=?")
          .authoritiesByUsernameQuery("select user_name, password from user_login where user_name=?");         




    

如果您需要更多代码，请告诉我！

【参考方案1】：

您应该将它们配置为被 Spring Security 忽略。 例如，通过将此类方法添加到您的 WebSecurityConfig：

@Override
    public void configure(WebSecurity web) 
        web.ignoring().antMatchers("/fonts/**", "/images/**", "/css/**");
    

如果您请求带有此类链接的图像：

<a> <img src="/images/logo.jpg"> </img></a>