Spring Security：<security="none"> 路径不可用

Question

我尝试通过为它创建单独的路径来解除某些路径的安全：

<security:http pattern="/rest/**" security="none" />

但是当我尝试访问与此模式匹配的 URL 时，例如

my-host:8080/my-context-root/rest/users

我收到 500 响应异常：

HTTP 状态 500 - 请求处理失败；嵌套异常是 org.springframework.security.authentication.AuthenticationCredentialsNotFoundException： 在 SecurityContext 中找不到 Authentication 对象

这就是问题所在。为什么我会收到这个？为什么不安全模式（应完全禁用所有过滤器和安全功能）等待某些凭据？

我不确定我是否应该提供完整的 .xml conf 文件集，但如果重要的话我可以。

更新我的配置

过滤器和 servlet 映射：

<filter>
    <filter-name>encoding-filter</filter-name>
    <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
    <init-param>
        <param-name>encoding</param-name>
        <param-value>UTF-8</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>encoding-filter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            classpath:spring-db.xml
            classpath:spring-service.xml
            classpath:spring-service-security.xml
            classpath:spring-web-security.xml
            classpath:spring-web-dispatcher.xml
        </param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>dispatcher</servlet-name>
    <url-pattern>*.html</url-pattern>
</servlet-mapping>

<servlet-mapping>
    <servlet-name>dispatcher</servlet-name>
    <url-pattern>/rest/*</url-pattern>
</servlet-mapping>


<!-- welcome file -->
<welcome-file-list>
    <welcome-file>redirect.jsp</welcome-file>
</welcome-file-list>

<!-- session config -->
<session-config>
    <session-timeout>15</session-timeout>
</session-config>

和安全

spring-service-security.xml
    <security:global-method-security
        secured-annotations="enabled" />

    <bean id="authenticationFilter"
        class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"
        p:authenticationManager-ref="customAuthenticationManager" />

    <bean id="customAuthenticationManager" class="org.unidevteam.userstory.service.impl.AuthServiceImpl" />

    <bean id="passwordEncoder"
        class="org.springframework.security.crypto.password.StandardPasswordEncoder" />

    <security:authentication-manager />

和 spring-web-security.xml

<security:http pattern="/rest/**" security="none" />

    <bean id="authenticationEntryPoint"
        class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"
        p:loginFormUrl="/login.html" />

    <security:http auto-config="true" use-expressions="true"
        entry-point-ref="authenticationEntryPoint" access-denied-page="/login.html"
        authentication-manager-ref="customAuthenticationManager">
        <security:intercept-url pattern="/login.html"
            access="permitAll" />
        <security:intercept-url pattern="/home.html"
            access="hasAnyRole('ROLE_ADMIN','ROLE_ORGANIZER')" />
        <security:intercept-url pattern="/users.html"
            access="hasAnyRole('ROLE_ADMIN','ROLE_ORGANIZER')" />
        <security:intercept-url pattern="/rmuser.html"
            access="hasAnyRole('ROLE_ADMIN','ROLE_ORGANIZER')" />
        <security:intercept-url pattern="/user.html"
            access="hasAnyRole('ROLE_ADMIN','ROLE_ORGANIZER')" />
        <security:intercept-url pattern="/notifications.html"
            access="hasAnyRole('ROLE_ADMIN','ROLE_ORGANIZER')" />
        <security:intercept-url pattern="/locations.html"
            access="hasAnyRole('ROLE_ADMIN','ROLE_ORGANIZER')" />
        <security:intercept-url pattern="/rmlocation.html"
            access="hasAnyRole('ROLE_ADMIN','ROLE_ORGANIZER')" />
        <security:intercept-url pattern="/location.html"
            access="hasAnyRole('ROLE_ADMIN','ROLE_ORGANIZER')" />
        <security:intercept-url pattern="/events.html"
            access="hasAnyRole('ROLE_ADMIN','ROLE_ORGANIZER')" />
        <security:logout invalidate-session="true"
            logout-success-url="/logout.html" />
    </security:http>

    <bean id="authenticationFilter"
        class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"
        p:authenticationManager-ref="customAuthenticationManager" />

澄清一下，我想要做什么...... 有一个第三方老的mvc应用代码，现在需要为它实现rest api。所以我决定它将在 /rest/ 路径下可用。我计划稍后添加一些特殊的安全性（可能基于令牌的身份验证）以供休息，但最初我决定完全取消该路径的安全性以进行调试和测试。

Answer 1

我从未将与安全相关的配置放入 servletdispatcher 应用程序容器中。 Spring 安全性基于过滤器，过滤器是在 servlet 上下文级别声明的，根应用程序上下文也是如此。

因此，我建议您将所有 spring 安全配置放在根应用程序上下文中 - 就像参考手册中给出的所有示例一样。根应用程序上下文通常由 spring ContextLoaderListener 以这种方式加载：

<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/daoContext.xml /WEB-INF/applicationContext.xml</param-value>
</context-param>

<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>