如何使用多个登录页面，一个用于管理员，另一个用于用户

Question

I want two different login pages. One for admins and the other one for users.

Using the code below only the class with @Order(1) works when I remove the @Order annotation from the static classes, only the last one works. I used them in two different ConfigSecurity files, and it didn't work.

I m expecting for both of them to work. Yet only one is working.

package com.example.FlightAgency.security;
import com.example.FlightAgency.service.UserService;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Configuration
    @Order(1)
    public static class App1ConfigurationAdapter {
        @Bean
        public UserDetailsService userDetailsService() {
            return new UserService();
        }

        @Bean
        public PasswordEncoder passwordEncoder() {
            return NoOpPasswordEncoder.getInstance();
        }

        @Bean
        public SecurityFilterChain filterChainApp1(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .requestMatchers("/user/**").hasAuthority("USER")
                    .and()
                .formLogin()
                    .loginPage("/user/login")
                    .usernameParameter("email")
                    .loginProcessingUrl("/user/login")
                    .defaultSuccessUrl("/user/")
                    .permitAll()
                    .and()
                .logout()
                    .logoutUrl("/user/logout")
                    .logoutSuccessUrl("/user/login")
                    .deleteCookies("JSESSIONID")
                    .and()
                .exceptionHandling()
                    .accessDeniedPage("/403")
                    .and()
                .csrf().disable();
            return http.build();
        }
    }

    @Configuration
    @Order(2)
    public static class App2ConfigurationAdapter {

        @Bean
        public SecurityFilterChain filterChainApp2(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .requestMatchers("/admin/**").hasAuthority("ADMIN")
                    .and()
                .formLogin()
                    .loginPage("/admin/login")
                    .usernameParameter("email")
                    .loginProcessingUrl("/admin/login")
                    .defaultSuccessUrl("/admin/")
                    .permitAll()
                    .and()
                .logout()
                    .logoutUrl("/admin/logout")
                    .logoutSuccessUrl("/admin/login")
                    .deleteCookies("JSESSIONID")
                    .and()
                .exceptionHandling()
                    .accessDeniedPage("/403")
                    .and()
                .csrf().disable();
            return http.build();
        }
    }
}    `

Answer 1

Both security filter chains are not restricted (default is /** ). You have to restrict the first one with securityMatcher , see Spring Security Reference :

Multiple HttpSecurity Instances

We can configure multiple HttpSecurity instances just as we can have multiple <http> blocks in XML. The key is to register multiple SecurityFilterChain @Beans . The following example has a different configuration for URL's that start with /api/ .

 @Configuration @EnableWebSecurity public class MultiHttpSecurityConfig { @Bean public UserDetailsService userDetailsService() throws Exception { // ensure the passwords are encoded properly UserBuilder users = User.withDefaultPasswordEncoder(); InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager(); manager.createUser(users.username("user").password("password").roles("USER").build()); manager.createUser(users.username("admin").password("password").roles("USER","ADMIN").build()); return manager; } @Bean @Order(1) public SecurityFilterChain apiFilterChain(HttpSecurity http) throws Exception { http.securityMatcher("/api/**").authorizeHttpRequests(authorize -> authorize.anyRequest().hasRole("ADMIN") ).httpBasic(withDefaults()); return http.build(); } @Bean public SecurityFilterChain formLoginFilterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated() ).formLogin(withDefaults()); return http.build(); } }

1. Configure Authentication as usual.
2. Create an instance of SecurityFilterChain that contains @Order to specify which SecurityFilterChain should be considered first.
3. The http.securityMatcher states that this HttpSecurity is applicable only to URLs that start with /api/ .
4. Create another instance of SecurityFilterChain . If the URL does not start with /api/ , this configuration is used. This configuration is considered after apiFilterChain , since it has an @Order value after 1 (no @Order defaults to last).