Spring Security 3.2：Servlet <3.0 环境中的 JavaConfig springSecurityFilterChain 设置答案

【问题标题】：Spring Security 3.2: JavaConfig springSecurityFilterChain setup in a Servlet <3.0 environmentSpring Security 3.2：Servlet <3.0 环境中的 JavaConfig springSecurityFilterChain 设置
【发布时间】：2014-01-29 16:06:07
【问题描述】：

我正在尝试在 Servlet 2.5 环境中使用 JavaConfig 设置 Spring Security 3.2。参考 (http://docs.spring.io/spring-security/site/docs/3.2.0.RELEASE/reference/htmlsingle/#jc) 仅涵盖 springSecurityFilterChain 的 Servlet 3.0+ 设置。

感谢提示/链接如何以正确的方式在 Servlet 2.5 环境中设置此过滤器链。

【问题讨论】：

标签： spring-security

【解决方案1】：

Spring Security 3.2 在 Servlet 2.5 环境中使用 JavaConfig 配置在下面的代码中。

web.xml

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private UserDetailsService userDetailsService;

@Override
protected void configure(AuthenticationManagerBuilder registry)
        throws Exception {
    registry.userDetailsService(userDetailsService).passwordEncoder(
            new BCryptPasswordEncoder());
}

@Override
public void configure(WebSecurity webSecurity) throws Exception {
    webSecurity.ignoring().antMatchers("/resources");
}

@Override
protected void configure(HttpSecurity http) throws Exception {

http.csrf().disable()
    .authorizeRequests()
        .antMatchers("/admin.htm")
        .hasAuthority("ROLE_ADMIN")
        .antMatchers("/personal/myPhotos.htm")
        .hasAnyAuthority("ROLE_USER", "ROLE_FAMILY", "ROLE_ADMIN")
        .antMatchers("/personal/familyPhotos.htm")
        .hasAnyAuthority("ROLE_FAMILY", "ROLE_ADMIN")
        .antMatchers("/**").permitAll()
        .anyRequest().authenticated()
    .and()
        .formLogin()
        .usernameParameter("j_username") // default is username
        .passwordParameter("j_password") // default is password
        .loginPage("/login.htm")
        .loginProcessingUrl("/j_spring_security_check")
        .failureUrl("/login.htm?login_error=t")
        .permitAll()
    .and()
        .logout().logoutSuccessUrl("/")
        .logoutUrl("/j_spring_security_logout")
    .and()
        .rememberMe().key("myAppKey").tokenValiditySeconds(864000);
}
}

javaconfig和xml配置有一些相同点和不同点，this blog中有很好的解释

【讨论】：