java - Spring-security：登录用户页面时获得http状态405

问题描述

我使用两种不同的 WebSecurityConfigurerAdapter 配置来重定向到 admin 和 user 之间的不同登录页面。

将用户名和密码数据发布到 /login/user 界面时，管理页面工作正常，而用户页面获得 http 状态代码 405 方法不允许

我搜索了很多，有人说需要禁用 csrf ，但我已经禁用了这个。

这是我下面的代码

@EnableWebSecurity
public class MultiHttpSecurityConfig {

    /**
     * intercept user url
     */
    @Configuration
    @Order(1)
    public static class UserWebSecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        CustomAuthenticationSuccessHandler successHandler;

        @Autowired
        CustomAuthenticationFailureHandler failureHandler;

        @Autowired
        private CustomAuthenticationProvider customAuthProvider;

        @Autowired
        private CustomUserDetailsService userDetailsService;

        @Value("${my.cookie.timeout}")
        private int cookieTimeOut;


        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable();
            http.requestMatchers()
                .antMatchers("/bbb/**", "/aaa/**")
                .and()
                .authorizeRequests()
                .antMatchers("/**").hasAnyRole("USER");
            http.formLogin()
                .successHandler(successHandler)
                .failureHandler(failureHandler)
                .loginPage("/login/user").permitAll();
            http.logout().permitAll();

            http.rememberMe().key("uniqueAndSecret").tokenValiditySeconds(cookieTimeOut);
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.authenticationProvider(customAuthProvider);
            auth.userDetailsService(userDetailsService);
        }
    }


    /**
     * intercept admin url
     */
    @Configuration
    public static class AdminWebSecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        CustomAuthenticationSuccessHandler successHandler;

        @Autowired
        CustomAuthenticationFailureHandler failureHandler;

        @Value("${my.cookie.timeout}")
        private int cookieTimeOut;

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable();
            http.authorizeRequests()
                .antMatchers("/ccc/**","/dddd").hasAnyRole("ADMIN");
            http.formLogin()
                .successHandler(successHandler)
                .failureHandler(failureHandler)
                .loginPage("/login/admin").permitAll();
            http.logout().permitAll();

            http.rememberMe().key("uniqueAndSecret").tokenValiditySeconds(cookieTimeOut);
        }

        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication()
                .withUser("test").password("test").roles("ADMIN");
        }
    }
}

更新： 在我将“/login/user”添加到用户模式后，它工作正常。

http.requestMatchers()
                .antMatchers("/dl/**", "/reinstall/**","/login/user/**")
                .and()
                .authorizeRequests()
                .antMatchers("/**").hasAnyRole("USER");
            http.formLogin()
                .successHandler(successHandler)
                .failureHandler(failureHandler)
                .loginPage("/login/user").permitAll();

emmmm，我不太了解 spring-security 中的这种机制

标签： javaspringspring-bootspring-security

java - Spring-security：登录用户页面时获得http状态405

问题描述

解决方案

推荐阅读