Spring安全认证和Ionic / Angular 1.X

Question

一些背景：我有一个使用Spring MVC和html5 / css / jquery构建的现有应用程序。 目前，它已通过Spring安全保护。 使用用户名和密码以及/ cookie / JSESSIONID的登录表单POST到/j_spring_security_check.action都会在浏览器中自动设置。

问题：我们正在使用ionic / Angular.js构建（混合）移动应用，而我在进行简单身份验证时遇到了麻烦。 有没有办法模仿Angular中的行为？

我尝试了以下代码，但没有遇到任何麻烦-Spring安全性表明标头无效。

$http({
    method: 'POST',
    url: 'https://localhost:8080/j_spring_security_check.action',
    withCredentials:true,
    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
    data: 'j_username=test@someemail.com&j_password=abc123',
})
.success(function(){})
.error(function(){});

能够获得Spring Security来识别每个REST调用上的用户会很好，因此我将能够使用Spring Security注释，例如@Role等。

谢谢 ！

Answer 1

将此添加到您的代码

public class CorsFilter extends OncePerRequestFilter {
    static final String ORIGIN = "Origin";

    @Override
    protected void doFilterInternal(HttpServletRequest request,
            HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        System.out.println(request.getHeader(ORIGIN));
        System.out.println(request.getMethod());
        if (request.getHeader(ORIGIN) == null) {
            response.addHeader("Access-Control-Allow-Origin", "*");// * or
                                                                    // origin as
                                                                    // u prefer
            response.addHeader("Access-Control-Allow-Credentials", "false");
            response.addHeader("Access-Control-Allow-Methods",
                    "GET, POST, PUT, DELETE");

            response.addHeader("Access-Control-Allow-Headers",
                    request.getHeader("Access-Control-Request-Headers"));
        } else {
            response.addHeader("Access-Control-Allow-Origin", request.getHeader(ORIGIN));// * or
            // origin as
            // u prefer
            response.addHeader("Access-Control-Allow-Credentials", "true");
            response.addHeader("Access-Control-Allow-Methods",
                    "GET, POST, PUT, DELETE");

            response.addHeader("Access-Control-Allow-Headers",
                    request.getHeader("Access-Control-Request-Headers"));
        }
        if (request.getMethod().equals("OPTIONS")) {
            try {
                response.getWriter().print("OK");
                response.getWriter().flush();
            } catch (IOException e) {
                e.printStackTrace();
            }
        } else {
            filterChain.doFilter(request, response);
        }
    }
}

您也应该在xml网络安全文件中添加

<beans:bean id="CorsFilter" class="com.yourpackagetoyourclass.CorsFilter" />
    <custom-filter ref="CorsFilter" after="PRE_AUTH_FILTER" />