无法在 url rewrite tucky 中使用 spring security答案

【问题标题】：cannot use spring security within url rewrite tucky无法在 url rewrite tucky 中使用 spring security
【发布时间】：2012-05-04 13:41:04
【问题描述】：

我在 url rewrite tucky 中使用 Spring mvc 以减少扩展的 Urls。一切正常，但我最近在处理 /j_spring_security_check 帖子时遇到了问题。这是我的配置文件

urlrewrite.xml

<rule>
   <from>/$</from>
   <to type="forward">home</to>
</rule>
<rule>
   <from>/signup$</from>
   <to type="forward">/signup</to>
</rule>
<rule>
    <from>/j_spring_security_check(\?.*)</from>
    <to last="true">/j_spring_security_check$1</to>
</rule> 
<rule>
    <from>/logout(\?.*)</from>
    <to last="true">/logout$1</to>
</rule> 
<rule>
    <from>^([^?]*)/([^?/\.]+)(\?.*)?$</from>
    <to last="true">$1/$2.htm$3</to>
</rule>
<outbound-rule>
    <from>^(.*)\.htm(\?.*)?$</from>
    <to last="false">$1$2</to>
</outbound-rule>

弹簧安全`

<!-- This is where we configure Spring-Security -->
<security:http auto-config="true" use-expressions="true" access-denied-page="/denied.htm">
    <security:intercept-url pattern="/**"  access="permitAll" />
    <security:intercept-url pattern="/admin/**"  access="hasRole('ROLE_ADMIN')" />
    <security:intercept-url pattern="/user" access="hasRole('ROLE_USER')" />
    <security:form-login login-page="/signup" authentication-failure-url="/signup?error=authenticate" default-target-url="/" />
    <security:logout invalidate-session="true" logout-success-url="/" logout-url="/logout" />
    <security:remember-me key="springRocks" user-service-ref="userDetailsService"/>
</security:http>


<!-- Declare an authentication-manager to use a custom userDetailsService -->
<security:authentication-manager>
    <security:authentication-provider user-service-ref="userDetailsService">
        <security:password-encoder ref="passwordEncoder" />
    </security:authentication-provider>
</security:authentication-manager>

<!-- Use a Md5 encoder since the user's passwords are stored as Md5 in the 
    database -->
<bean
    class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" id="passwordEncoder" />

<bean id="userDaoService" class="com.dolo.dao.jdbc.JdbcUserDao">
    <property name="dataSource" ref="dataSource" />
</bean>

<bean id="userDetailsService" class="com.dolo.services.impl.UserServiceImpl">
</bean>

<bean id="userDetails" class="com.dolo.model.User">
</bean>

web.xml

      <servlet>
<servlet-name>dolo</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
        </param-value>
    </init-param>
<load-on-startup>1</load-on-startup>

...

<servlet-mapping>
<servlet-name>dolo</servlet-name>
<url-pattern>*.htm</url-pattern>

...

<filter>
    <filter-name>UrlRewriteFilter</filter-name>
    <filter-class>org.tuckey.web.filters.urlrewrite.UrlRewriteFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>UrlRewriteFilter</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
    <dispatcher>FORWARD</dispatcher>
</filter-mapping>

....

  <filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

....

  <filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
<dispatcher>INCLUDE</dispatcher>
<dispatcher>ERROR</dispatcher>

【问题讨论】：

标签： spring model-view-controller spring-security urlrewriter

【解决方案1】：

两者可以毫无问题地一起工作

springSecurityFilterChain 的<filter-mapping> 声明应该在UrlRewriteFilter 之前完成。完成后，您就不需要为j_spring_security_check 编写任何重写规则了。

【讨论】：