Spring Security对用户进行身份验证以输入管理员

Question

I am using spring security to authenticate users.

AdminController.java

@Controller
@Secured("ROLE_ADMIN")
public class AdminController {

     @RequestMapping("/list")
    public ModelAndView listProductController(@ModelAttribute("pForm") Product product, ModelMap model)
    {

         return new ModelAndView("list", model);
    }
}

I the above code, I want only admins can visit the url http://localhost/Pgga/list , but even without login, I am able to visit this page.

spring-security.xml

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security.xsd">

    <global-method-security secured-annotations="enabled" />

    <!-- enable use-expressions -->
    <http auto-config="true" use-expressions="true">
    <intercept-url pattern="/admin*" access="ROLE_ADMIN" />

        <!-- access denied page -->
        <access-denied-handler error-page="/403" />
        <form-login 
            login-page="/login"
            login-processing-url="/login.do"
            default-target-url="/index"
            authentication-failure-url="/login?error" 
            username-parameter="emailID"
            password-parameter="password" />
        <logout 
            logout-success-url="/login?logout"
            delete-cookies="JSESSIONID"
            invalidate-session="true" />
        <csrf/>
    </http>

    <authentication-manager>
        <authentication-provider user-service-ref="userAuthenticationProvider">
            <password-encoder hash="plaintext" />
        </authentication-provider>
    </authentication-manager>

</beans:beans>

How can I allow only admins to enter admin area?

Answer 1

使用hasRole（'admin'）或设置use-expressions =“ false” ....

Answer 2

Login redirecting to itself because you set:

login-page="/login"

And it keep redirect to user page because spring know the /login its the login page but don't have access to use it, so add this :

<intercept-url pattern="/login" access="permitAll()" />

to make sure the login page is permitted and can give access or assign role to the authenticated user.