如何在Spring Security 4中禁用UsernamePasswordAuthenticationFilter

Question

I'm migrating a JSF application from Spring Security 3.2 to 4.0.1. This version changes many default urls, for example the default login url to /login .

The application has its own login page (using JSF AJAX) and it is still displayed when calling /login , but all POST-Requests to this URL (and so all AJAX-Requests from the Login-Page) are captured by the UsernamePasswordAuthenticationFilter and that is trying to process the authentication, causing the request to get redirected to the loginform again.

After looking at the code this url seems to be hard-coded:

public UsernamePasswordAuthenticationFilter() {
    super(new AntPathRequestMatcher("/login", "POST"));
}

So I have to disable this filter completely, or better, avoid it's creation. Can anybody point me how I can do it.

Changing my login page to another url is working, but is not the nice solution.

EDIT: I have created a Bugticket in Spring Security for this: https://jira.spring.io/browse/SEC-2992

EDIT 2: I've found another workaround: If I set the login-processing-url for the form-login to something unused it is working, but seems to be very hacky. There should be a way to disable it completely. Also it should be stated in the migration guide, I lost hours until I found this.

Answer 1

I am going to assume that you are trying to upgrade to Spring Security 4.0.0 (the latest available version is 4.0.1).

Spring Security 3.x used spring_security_login as the default login URL ( source : official documentation ). This could be set to a custom value as <security:form-login login-page="/login"> and mapped to a controller to render a custom page.

Spring Security 4.x has abandoned spring_security_login and switched to login as the default login URL ( source : official Spring Security 4.x migration guide ). Therefore, the URL login now goes to the default Spring Security infrastructure, that displays the default, auto-generated login page.

There was a bug in 4.0.0 due to which the default infrastructure was still getting used in cases where the URL /login was manually mapped to a custom controller method. This bug has been fixed in 4.0.1. Do try upgrading to Spring Security 4.0.1 to see if you can use /login as the login URL.

Answer 2

看来您可以调用setFilterProcessesUrl(String) （或等效地， setRequiresAuthenticationRequestMatcher(RequestMatcher) ）来覆盖/login的默认值。