spring - 具有自定义登录表单的 Spring Security 不起作用

问题描述

我有一个带有弹簧安全性的自定义登录表单，登录时我不断收到 404

这是我的网络配置

package coffee.web;

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfig implements WebMvcConfigurer {

    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/").setViewName("/regular/index.html");
    }

}

这是我的安全配置

package coffee.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("peter").password("peter").authorities("ROLE_USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/admin/**").hasRole("USER").antMatchers("/", "/**").permitAll()
        .and().formLogin().loginPage("/regular/login.html").permitAll().defaultSuccessUrl("/admin/adminIndex.html").and().csrf().disable();

    }
}

这是我的登录 html 表单

<head>
    <link href="index.css" type="text/css" rel="stylesheet" />
    <link href="adminIndex.css" type="text/css" rel="stylesheet" />
</head>

<body>
    <div id="page">
        <div id="bar"></div>
        <header>
            <h1><img id="logo" src="resources/logo.png" width="300" height="75" /></h1>
        </header>
        <section id="main">
            <div id="container">
                <div id="loginDiv">
                    <form name="login" id="login" action="login" method="POST">
                        <div id="formDiv">
                            <label for="addUsername" class="title">Username</label>
                            <span id="validateUsername" class="error"></span>
                            <input class="input" type="text" id="addUsername" name="username" />
                            <br />
                            <label for="addPassword" class="title">Password</label>
                            <span id="validatePassword" class="error"></span>
                            <input class="input" type="text" id="addPassword" name="password" />
                            <br />
                            <button id="submit" name="submit" type="submit" class="submit">submit</button>
                        </div>
                    </form>
                </div>
            </div>
        </section>
    </div>
</body>

即使我关闭了授权，并且只打开了身份验证，登录后我仍然会收到 403 错误代码。即使我仍然可以直接进入 admin.adminIndex.html 并且它可以工作..（授权关闭并且只有身份验证上）。

好的，我用“.and().csrf().disable();”更新了我的安全代码现在我在登录时收到 404 not found 错误。

标签： springspring-bootspring-security

spring - 具有自定义登录表单的 Spring Security 不起作用

问题描述

解决方案

推荐阅读