验证成功后spring security HttpSession为null答案

【问题标题】：spring security HttpSession is null after Authentication success验证成功后spring security HttpSession为null
【发布时间】：2014-12-11 04:45:14
【问题描述】：

我正在使用 Spring Security 3.0.5.RELEASE。身份验证成功后，用户未通过身份验证我在日志中有此消息

16/10/2014 00:08:17 [http-bio-8080-exec-5] (AbstractAuthenticationProcessingFilter.java:289) 调试 - 认证成功...

16/10/2014 00:08:17 [http-bio-8080-exec-5] (HttpSessionSecurityContextRepository.java:360) 调试 - SecurityContext 存储到 HttpSession： 'org.springframework.security.core.context.SecurityContextImpl@57920877： ... 2014 年 16 月 10 日 00:08:17 [http-bio-8080-exec-5] (SecurityContextPersistenceFilter.java:89) 调试 - SecurityContextHolder 现在已清除，因为请求处理已完成...

16/10/2014 00:08:18 [http-bio-8080-exec-6] (HttpSessionSecurityContextRepository.java:130) 调试 - 没有 HttpSession 目前存在 16/10/2014 00:08:18 [http-bio-8080-exec-6] (HttpSessionSecurityContextRepository.java:88) 调试 - 否 SecurityContext 可从 HttpSession 获得：null。一个新的将被创建。

这是我的会议 web.xml：

<filter>
  <filter-name>springSecurityFilterChain</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

安全性.xml

<security:http auto-config="true" use-expressions="true" access-denied-page="/denied.htm">
<security:intercept-url pattern="/"  access="permitAll" />
<security:intercept-url pattern="/user/login"  access="permitAll" />
<security:intercept-url pattern="/admin/**"  access="hasRole('ROLE_ADMIN')" />
<security:form-login    login-page="/user/login.htm"  authentication-failure-url="/user/login.htm?error=true"   default-target-url="/" />
<security:logout invalidate-session="true" logout-success-url="/index.htm" logout-url="/logout.htm" />

<security:authentication-manager>
    <security:authentication-provider user-service-ref="userDetailsService">
        <security:password-encoder ref="passwordEncoder" />
    </security:authentication-provider>
</security:authentication-manager>

<!-- Use a Md5 encoder since the user's passwords are stored as Md5 in the 
    database -->
<bean
    class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" id="passwordEncoder" />

<bean id="userDaoService" class="com.example.dao.jdbc.JdbcUserDao">
    <property name="dataSource" ref="dataSource" />
</bean>

<bean id="userDetailsService" class="com.cercle.core.services.impl.UserServiceImpl">
</bean>

<bean id="userDetails" class="com.example.model.User">
</bean>

【问题讨论】：

但这只是来自 Spring 的调试消息。它真的会破坏您的业务功能吗？
用户未通过身份验证，在我的 JSP 中返回 false。

标签： java spring security authentication httpsession

【解决方案1】：

我发现了问题。 Spring conf 没问题，但是我的 tomcat 在 apache2 后面运行，我忘记通知 apache2 保存 cookie（使用命令 ProxyPassReverseCookiePath）

【讨论】：