java - 从 https 登录后自动重定向到 http

Question

你好 StackOverflow 社区！

在登录页面上，Spring Security 将我从 https 自动重定向到 http，导致向用户显示“不安全”消息。我可以避免这种情况并在登录后保持在 https 上吗？请指教。我的配置附在下面：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
@RequiredArgsConstructor
public class SecurityConfiguration extends WebSecurityConfigurerAdapter
{
    private final LoginUrlAuthenticationEntryPoint entryPoint;
    private final SimpleUrlAuthenticationFailureHandler authenticationFailureHandler;
    private final UserAuthenticationSuccessHandler authenticationSuccessHandler;
    private final UserAuthenticationProvider authProvider;

    @Override
    protected void configure( AuthenticationManagerBuilder builder )
    {
        builder.authenticationProvider( authProvider );
    }

    @Override
    protected void configure( HttpSecurity http ) throws Exception
    {
        http.csrf().disable()
            .httpBasic( hb -> hb
                    .authenticationEntryPoint( entryPoint )
            )
            .headers( h -> h
                    .frameOptions().disable()
            )
            .authorizeRequests( ar -> ar
                    .antMatchers(
                            "/newAgreement/*",
                            "/signup/*",
                            "/createStation/*",
                            "/test", "/test.htm",
                            "/iclubCss", "/iclubCss.htm",
                            "/footer", "/footer.htm",
                            "/errorMessage", "/errorMessage.htm",
                            "/favicon.ico",
                            "/eventRemoval",
                            "/trial", "/trial.htm",
                            "/classlist", "/classlist.htm",
                            "/club/getClub", "/club/getClub.htm",
                            "/club/getClubExternal", "/club/getClubExternal.htm"
                    ).permitAll()
                    .antMatchers( "/*" ).hasRole( "USER" )
            )
            .formLogin( fl -> fl
                    .loginProcessingUrl( "/performLogin" )
                    .loginPage( "/members/signin.htm" ).permitAll()
                    .failureHandler( authenticationFailureHandler )
                    .successHandler( authenticationSuccessHandler )
            )
            .logout( l -> l
                    .permitAll()
                    .invalidateHttpSession( true )
                    .logoutSuccessUrl( "/members/signin.htm?signout=1" )
                    .logoutUrl( "/members/signout.htm" )
                    .deleteCookies( "JSESSIONID" )
            )
            .sessionManagement( sm -> sm
                    .sessionFixation().newSession()
            )
        ;
    }
}

我的用户身份验证成功处理程序是

public class UserAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler
{
   @Override
   public void onAuthenticationSuccess( HttpServletRequest request,
                                        HttpServletResponse response, Authentication authentication) throws ServletException, IOException
   {
      String url = getDefaultTargetUrl();
      if (request.getParameter("spring-security-redirect") != null) {
            url = url + request.getParameter("spring-security-redirect");
        }
        getRedirectStrategy().sendRedirect(request, response, url);
   }
}

标签： javaauthenticationredirectspring-security