从版本 3 迁移到版本 4 后，Spring Security 无法正常工作

Question

Recently I migrated from Spring Security 3 to version 4. Everything worked well before but now nothing works.

Here is my spring-security.xml :

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-4.0.xsd">

    <http auto-config="true" use-expressions="true"> 
        <intercept-url pattern="/home.MRCMPU" access="permitAll"/>
        <intercept-url pattern="/loginFailure.MRCMPU" access="permitAll"/>
        <intercept-url pattern="/*.MRCMPU"  access="permitAll"/>
        <intercept-url pattern="/con" access="permitAll"/>

        <form-login 
            login-page="/home.MRCMPU"
            login-processing-url="/login"  authentication-success-handler-ref="AuthenticationSuccess" 
            authentication-failure-handler-ref="AuthenticationFailure" username-parameter="username" password-parameter="password" />
        <logout logout-url="/logout.MRCMPU" success-handler-ref="Logout" invalidate-session="true" delete-cookies="true"/>
    </http>

    <authentication-manager>
        <authentication-provider user-service-ref="Authentication"/>
    </authentication-manager>
</beans:beans>

Can anyone find the conflict from this code?

Answer 1

You are missing many referrenced beans here.

1. user-service-ref="Authentication"
2. success-handler-ref="Logout"
3. authentication-success-handler-ref="AuthenticationSuccess"
4. authentication-failure-handler-ref="AuthenticationFailure"

For the above mentioned references,you should have beans otherwise,like

No bean named 'Logout' is defined

Exception will be thrown.

Add bean class like

<bean id="Authentication"
     class="class which you need to refer">
 </bean>

Answer 2

finally i cleared it myself. by disabling csrf using xml

 <csrf disabled="true"/>

but how can i do it without disabling csrf token