Spring Security-j_spring_security_check-HTTP状态403
[英]Spring Security - j_spring_security_check - HTTP status 403
问题描述
Im the new at Spring Security. 
我是Spring Security的新手。 If I press log in, the site: http://localhost:8080/j_spring_security_check occurs with 如果按登录，站点： http：// localhost：8080 / j_spring_security_check与
HTTP Status 403 – Forbidden
Type Status Report
Message Forbidden
Description The server understood the request but refuses to authorize it.
Apache Tomcat/9.0.12
Here is web.xml 这是web.xml
<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/spring/webcontext/security-context.xml
</param-value>
</context-param>
<listener>
<listener-class>
org.springframework.web.context.ContextLoaderListener
</listener-class>
</listener>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<servlet>
<servlet-name>DefaultServlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/webcontext/DispatcherServlet-context.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>DefaultServlet</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
</web-app>
login.jsp
And here: <form action="<c:url value="/j_spring_security_check"></c:url>" method="post"> - /j_spring_security_check is marked on the red with the error: Cannot resolve controller URL '/j_spring_security_check' 在这里： <form action="<c:url value="/j_spring_security_check"></c:url>" method="post"> - /j_spring_security_check被标记为红色，并显示以下错误： Cannot resolve controller URL '/j_spring_security_check'
<%@page pageEncoding="UTF-8" contentType="text/html; charset=UTF-8" %>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
<%@ taglib prefix="spring" uri="http://www.springframework.org/tags" %>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.0.0/css/bootstrap.min.css">
<title>Produkty</title>
</head>
<body>
<section>
<div class="jumbotron">
<div class="container">
<h1>Produkty</h1>
<p>Dodaj produkty</p>
</div>
</div>
</section>
<div class="container">
<div class="row">
<div class="col-md-4 col-md-offset-4">
<div class="panel panel-default">
<div class="panel-heading">
<h3 class="panel-title">Zaloguj się</h3>
</div>
<div class="panel-body">
<c:if test="${not empty error}">
<div class="alert alert-danger">
<spring:message code="AbstractUserDetailsAuthenticationProvider.badCredentials"/><br/>
</div>
</c:if>
<form action="<c:url value="/j_spring_security_check"></c:url>" method="post">
<fieldset>
<div class="form-group">
<input class="form-control" placeholder="Nazwa użytkownika" name='j_username' type="text">
</div>
<div class="form-group">
<input class="form-control" placeholder="Hasło" name='j_password' type="password" value="">
</div>
<input class="btn btn-lg btn-success btn-block" type="submit" value="Zaloguj się">
</fieldset>
</form>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
security-context.xml security-context.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:mvc="http://www.springframework.org/schema/mvc"
xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/mvc
http://www.springframework.org/schema/mvc/spring-mvc-4.3.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-4.2.xsd
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context
http://www.springframework.org/schema/mvc/spring-mvc-4.3.xsd">
<security:http auto-config="true">
<security:intercept-url pattern="/products/add" access="hasRole('ROLE_ADMIN')"/>
<security:form-login login-page="/login" default-target-url="/products/add"
authentication-failure-url="/loginfailed"/>
<security:logout logout-success-url="/logout"/>
</security:http>
<security:authentication-manager>
<security:authentication-provider>
<security:user-service>
<security:user name="Admin" password="Admin123" authorities="ROLE_ADMIN"/>
</security:user-service>
</security:authentication-provider>
</security:authentication-manager>
</beans>
What should I add to make it right? 我应该添加些什么来使其正确？
2 个解决方案
解决方案1
5 2018-10-04 00:43:10
check csrf token 检查csrf令牌
if you use form tag with post url you should send with token parameter 如果您将表单标记与发布网址一起使用，则应使用令牌参数发送
<form>
<input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}"/>
</form>
or 要么
@Configuration
@EnableWebSecurity
@EnableOAuth2Sso
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
http
.csrf().disable()
url should be allowed in security config 网址应在安全配置中允许
@Configuration
@EnableWebSecurity
@EnableOAuth2Sso
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
http
.csrf().disable()
.authorizeRequests()
.antMatchers(HttpMethod.POST, "/j_spring_security_check").permitAll()
解决方案2
1 2018-10-04 05:12:21
Its because request does not contain csrf token, since spring security automatically enables it, csrf token must be sent with request. 它是因为请求不包含csrf令牌，因为spring安全性会自动启用它， csrf令牌必须与请求一起发送。 It is not a good idea to simply disable this, which leaves entire application wide open. 仅禁用此功能不是一个好主意，这会使整个应用程序处于打开状态。
Add following hidden input to your form, 在表单中添加以下隐藏的输入，
<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
If you want to disable csrf support, use this in security-context.xml . 如果要禁用csrf支持，请在security-context.xml使用它。 (Spring 4+) （春季4+）
<http>
<csrf disabled="true"/>
</http>
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.