[英]Spring Security configuration issue with http basic : IllegalArgument
我似乎無法弄清楚為什么此配置提供了IllegalArgumentException。 錯誤是:
Caused by: java.lang.IllegalArgumentException: A universal match pattern ('/**') is defined before other patterns in the filter chain, causing them to be ignored. Please check the ordering in your <security:http> namespace or FilterChainProxy bean configuration
配置為:
<!-- Disable Spring Security for static content -->
<http pattern="/css/**" security="none"/>
<http pattern="/js/**" security="none"/>
<!-- Web app security -->
<http use-expressions="true" authentication-manager-ref="pvDatabase">
<!-- Insecure endpoints -->
<intercept-url pattern="/" access="permitAll"/>
<intercept-url pattern="/spring/login" access="permitAll"/>
<intercept-url pattern="/spring/loginfail" access="permitAll"/>
<intercept-url pattern="/spring/loggedout" access="permitAll"/>
<intercept-url pattern="/insecure/**" access="permitAll"/>
<!-- Secure endpoints -->
<intercept-url pattern="/secure/admin/**" access="hasAnyRole('ADMIN')"/>
<intercept-url pattern="/spring/**" access="hasAnyRole('ADMIN', 'USER')"/>
<intercept-url pattern="/secure/**" access="hasAnyRole('ADMIN', 'USER')"/>
<!-- Authentication Entrypoint is FORM-LOGIN -->
<form-login login-page="/spring/login"
login-processing-url="/spring/login"
authentication-failure-url="/spring/loginfail"
default-target-url="/spring/loginsuccess"
always-use-default-target="true" />
<logout logout-url="/spring/logout" logout-success-url="/spring/loggedout" delete-cookies="JSESSIONID" invalidate-session="true"/>
<csrf/>
<!-- HTTP 403 Access denied custom handling -->
<access-denied-handler ref="pvAccessDeniedHandler"/>
</http>
<!-- Web services security : this section generates an error -->
<http use-expressions="true" create-session="stateless" authentication-manager-ref="pvDatabase">
<!-- Authentication Entrypoint is HTTP-BASIC -->
<http-basic entry-point-ref="PVBasicAuthenticationEntryPoint"/>
<!-- secure endpoints : web services -->
<intercept-url pattern="/services/api/**" access="hasAnyRole('ADMIN', 'WEBSERVICES')"/>
<!-- HTTP 403 Access denied custom handling -->
<access-denied-handler ref="pvAccessDeniedHandler"/>
</http>
如果刪除整個Web服務安全性部分,則安全性很好,我想要的是能夠使用basic-auth 僅保護/ services / api / **模式,並將其限制為僅具有ADMIN和WEBSERVICES角色的用戶。
我不確定我是否理解錯誤,因為沒有定義其他通用匹配的url模式,我沒有在任何地方映射/ **。
我的應用程序包含2個Dispatcher servlet,第一個映射到/ spring / *,第二個映射到/ services / api / *。 Spring Security篩選器鏈映射到/ *
此錯誤是因為還按順序考慮了http塊,並且http塊的默認模式是/ **。 如果除了最后一個http塊之外的所有塊都沒有pattern屬性,則永遠不會看到其他塊。
將模式添加到第一個http塊應該可以解決您的問題。 如果pattern不起作用,則還可以將RequestMatcher的自定義實例與request-matcher-ref一起使用 。
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.