从控制器下载安全页面，Spring安全性

Question

I am running Spring web and security 3.1. I need to download another local page from a secure area within a secure area. Given the following code:

@Controller
@RequestMapping("/secure")
public class SecureArea {

    @RequestMapping("/downloadMe.xhtml")
    public String downloadMe(HttpServletRequest request, HttpServletResponse response) throws Exception {
        // do stuff
        return "myJsp";
    }

    @RequestMapping("/viewStuff")
    public void viewStuff(HttpServletRequest request, HttpServletResponse response) throws Exception {
        InputStream in = (new URL("http://"+request.getServerName()+":"+request.getServerPort()+"/secure/downloadMe.xhtml").openStream());
        // read the input stream and do stuff with it, obviously returns my 401 page
    }
}

the viewStuff method cannot see the /downloadMe.xhtml page due to spring security. Is there any way I can place the security credentials from my request into a new request and download the downloadMe.xhtml.

* It must be done this way or a similar way that has the same result. I cannot merely call downloadMe(request, response). I need the data returned from myJsp and all the logic that comes with it.

Answer 1

Solved my own question! I was able to get this to work by passing the JSESSIONID as a cookie in my request. So going from my code in my question, it would look like this:

@Controller
@RequestMapping("/secure")
public class SecureArea {

    @RequestMapping("/downloadMe.xhtml")
    public String downloadMe(HttpServletRequest request, HttpServletResponse response) throws Exception {
        // do stuff
        return "myJsp";
    }

    @RequestMapping("/viewStuff")
    public void viewStuff(HttpServletRequest request, HttpServletResponse response) throws Exception {
        URL url = new URL("http://"+request.getServerName()+":"+request.getServerPort()+"/secure/downloadMe.xhtml");
        URLConnection con = url.openConnection();
        con.setDoOutput(true);
        // attach the session ID in the request
        con.setRequestProperty("Cookie", "JSESSIONID="+request.getSession().getId());
        con.connect();

        InputStream in = con.getInputStream();  
        // read the input stream and do stuff with it, obviously returns my 401 page
    }
}