为什么在 Spring Security 中对“anonymousUser”进行身份验证？

Question

这是我的主要控制器：

package org.demian.demibox.controllers;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;

@Controller
public class MainController {
    private String getUsername() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth.isAuthenticated())
            return auth.getName();
        else
            return null;
    }
    @RequestMapping(value = "/", method = RequestMethod.GET)
    public String showHome() {
        String username = getUsername();
        System.out.println(username);
        if (username == null || username.length() == 0)
            return "welcome";
        return "index";
    }
}

即使我没有登录， auth.isAuthenticated()总是返回true 。 这是为什么？ auth.isAuthenticated()什么时候会返回 false？ 如果我未登录，则经过身份验证的用户的名称为anonymousUser如果我已登录，则为 username。

编辑

这是我的security-context.xml文件：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
    xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <security:authentication-manager>
        <security:authentication-provider>
            <security:jdbc-user-service data-source-ref="dataSource" id="jdbcUserService" />
            <!-- <security:password-encoder ref="passwordEncoder" /> -->
        </security:authentication-provider>
    </security:authentication-manager>
    <security:http use-expressions="true">
        <security:intercept-url pattern="/" access="permitAll" />
        <security:intercept-url pattern="/login" access="permitAll" />
        <security:intercept-url pattern="/redeem" access="permitAll" />
        <security:intercept-url pattern="/redeem_code" access="permitAll" />
        <security:intercept-url pattern="/static/**" access="permitAll" />
        <security:intercept-url pattern="/*" access="isAuthenticated()" />
        <security:intercept-url pattern="/**" access="isAuthenticated()" />
        <security:intercept-url pattern="/**" access="denyAll" />
        <security:form-login login-page="/login" authentication-failure-url="/login?error=true" />
        <security:logout logout-success-url="/" />
        <security:remember-me key="offersAppKey" user-service-ref="jdbcUserService" />
    </security:http>
    <security:global-method-security secured-annotations="enabled" />
    <!-- <bean id="passwordEncoder" class="org.springframework.security.crypto.password.StandardPasswordEncoder" /> -->
</beans>

以下几行在web.xml文件中：

<filter>
    <display-name>springSecurityFilterChain</display-name>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

我通过 Maven 使用 Tomcat 8.0 和所有最新的依赖项。

Answer 1

这就是 spring-security 默认的工作方式。

从文档：

请注意，“经过匿名身份验证”的用户和未经身份验证的用户之间没有真正的概念差异。 Spring Security 的匿名身份验证只是为您提供了一种更方便的方式来配置您的访问控制属性。 例如，调用 servlet API 调用（例如getCallerPrincipal仍将返回 null，即使SecurityContextHolder实际上存在匿名身份验证对象。

在其他情况下匿名身份验证很有用，例如当审计拦截器查询SecurityContextHolder以确定哪个主体负责给定操作时。 如果类知道SecurityContextHolder始终包含一个Authentication对象，并且从不为 null，则可以更健壮地创作这些类。

如果您需要检查它是否是anonymousUser那么您可以检查Authentication对象是否是AnonymousAuthenticationToken实例。