Spring 4 MVC +安全问题

Question

我一直在使用Spring MVC应用程序。 要增加安全性。 一切正常。

根据文档http://docs.spring.io/autorepo/docs/spring-security/4.0.4.RELEASE/reference/htmlsingle/#abstractsecuritywebapplicationinitializer-with-spring-mvc

添加了下一个实现。

1. MessageSecurityWebApplicationInitializer
2. MessageWebApplicationInitializer
3. 安全配置

登录表单有效。

成功授权后，获得-HTTP状态404-

同样，我可以在授权后将方​​法调试到appController中，这意味着下一个方法public String listPatients(ModelMap model) 。

为什么我有404？ 我该怎么解决？

public class MessageSecurityWebApplicationInitializer
        extends AbstractSecurityWebApplicationInitializer {
}


public class MessageWebApplicationInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {

    @Override
    protected Class<?>[] getRootConfigClasses() {
        return new Class[]{AppConfig.class};
    }

    @Override
    protected Class<?>[] getServletConfigClasses() {
        return new Class[]{AppConfig.class};
    }


    @Override
    protected String[] getServletMappings() {
        return new String[] {"/*"};
    }

}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user").password("user").roles("USER");
    }

    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .and()
                .httpBasic();
    }

}

@Controller
@RequestMapping("/")
public class AppController {

    public static final String jsonPage = "json";
    @RequestMapping(value = {"/"}, method = RequestMethod.GET)
    public String listPatients(ModelMap model) {
        model.addAttribute("json", "test"}");
        return jsonPage;
    }

BR！

Answer 1

这是我（正在工作）的内容：

AppInitializer

public class AppInitializer extends
        AbstractAnnotationConfigDispatcherServletInitializer {

    @Override
    protected Class<?>[] getRootConfigClasses() {
        return new Class[] {
                SpringRootConfig.class,
                DatabaseConfig.class,
                SecurityConfig.class,
                SecurityInitializer.class,
                WsdlMarshallerConfig.class
        };
    }

    @Override
    protected Class<?>[] getServletConfigClasses() {
        return new Class[] { SpringWebConfig.class };
    }

    @Override
    protected String[] getServletMappings() {
        return new String[] { "/" };
    }

}

安全初始化器

public class SecurityInitializer extends AbstractSecurityWebApplicationInitializer {
}

安全配置

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private DataSource dataSource;

    @Override
    protected void configure(AuthenticationManagerBuilder auth)
            throws Exception {
        // @formatter:off
        auth
            .jdbcAuthentication()
                .dataSource(dataSource)
                    .usersByUsernameQuery("SELECT username, password, enabled FROM users WHERE username = ?")
                    .authoritiesByUsernameQuery("SELECT username, role FROM user_roles WHERE username = ?");
        // @formatter:on
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        http
            .authorizeRequests()
                .antMatchers("/resources/**").permitAll()
                .antMatchers("/login").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login")
                .and()
            .csrf()
                .disable();
        // @formatter:on
    }

}