挣扎于 Spring Security 的基础知识 - 需要启用 sec taglib答案

【问题标题】：Struggling with basics of Spring Security - need to enable sec taglib挣扎于 Spring Security 的基础知识 - 需要启用 sec taglib
【发布时间】：2017-04-11 13:20:12
【问题描述】：

几天来，我一直在努力尝试各种教程以使 Spring Security 正常工作。我正在为一个学校项目自学。我从一个教程中获得了基本的登录功能，现在正在尝试实现 sec taglib，以便我可以使用授权标签根据用户的角色有选择地向用户显示内容。无论我尝试从教程/官方文档中获得何种建议组合，我都无法让它发挥作用（我确信它来自我对 XML 配置的缺乏理解）。将不胜感激。

这是我的 pom.xml：

<project xmlns="http://maven.apache.org/POM/4.0.0" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 
http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.angels</groupId>
<artifactId>ccollier</artifactId>
<version>0.0.1-SNAPSHOT</version>
<packaging>war</packaging>
<dependencies>
    <dependency>
        <groupId>javax</groupId>
        <artifactId>javaee-web-api</artifactId>
        <version>6.0</version>
        <scope>provided</scope>
    </dependency>
    <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
        <version>2.5.3</version>
    </dependency>
     <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-webmvc</artifactId>
        <version>4.2.2.RELEASE</version>
    </dependency>
    <dependency>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-validator</artifactId>
            <version>5.0.2.Final</version>
    </dependency>
    <dependency>
        <groupId>org.webjars</groupId>
        <artifactId>bootstrap</artifactId>
        <version>3.3.6</version>
    </dependency>
    <dependency>
        <groupId>org.webjars</groupId>
        <artifactId>jquery</artifactId>
        <version>1.11.1</version>
    </dependency>



    <dependency>
        <groupId>log4j</groupId>
        <artifactId>log4j</artifactId>
        <version>1.2.17</version>
    </dependency>
    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>jstl</artifactId>
        <version>1.2</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-web</artifactId>
        <version>4.0.1.RELEASE</version>
    </dependency>

   <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-config</artifactId>
        <version>4.0.1.RELEASE</version>
    </dependency>   

    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-taglibs</artifactId>
        <version>3.1.3.RELEASE</version>
    </dependency>

</dependencies>


<build>
    <pluginManagement>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.2</version>
                <configuration>
                    <verbose>true</verbose>
                    <source>1.8</source>
                    <target>1.8</target>
                    <showWarnings>true</showWarnings>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.tomcat.maven</groupId>
                <artifactId>tomcat7-maven-plugin</artifactId>
                <version>2.2</version>
                <configuration>
                    <path>/</path>
                    <contextReloadable>true</contextReloadable>
                </configuration>
            </plugin>
        </plugins>
    </pluginManagement>
</build>

我的 web.xml：

<!-- webapp/WEB-INF/web.xml -->
<web-app xmlns="http://java.sun.com/xml/ns/javaee" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
version="3.0">

<display-name>To do List</display-name>

<welcome-file-list>
    <welcome-file>login.do</welcome-file>
</welcome-file-list>

 <servlet>
        <servlet-name>dispatcher</servlet-name>
        <servlet-class>
            org.springframework.web.servlet.DispatcherServlet
        </servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>/WEB-INF/todo-servlet.xml</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>dispatcher</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <filter>
            <filter-name>springSecurityFilterChain</filter-name>
            <filter-
class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
   </filter>


   <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
            <url-pattern>/*</url-pattern>
   </filter-mapping>

</web-app>

我的应用程序命名空间（todo-servlet.xml）：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:security="http://www.springframework.org/schema/security"
    xmlns:mvc="http://www.springframework.org/schema/mvc"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
    http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.3.xsd">

    <context:component-scan base-package="com.angels" />
    <bean
    class="org.springframework.web.servlet.view.InternalResourceViewResolver">
    <property name="prefix">
        <value>/WEB-INF/views/</value>
    </property>
    <property name="suffix">
        <value>.jsp</value>
    </property>
</bean>
<mvc:resources mapping="/resources/**" location="/resources/"
cache-period="31556926"/>
     <mvc:resources mapping="/webjars/**" location="/webjars/"/>
    <mvc:annotation-driven />
    <http auto-config="true">
        <intercept-url pattern="/**" access="ROLE_USER" />
    </http>

</beans>

现在导致问题的是应用程序命名空间中的这一行。我直接从 Spring 文档http://docs.spring.io/spring-security/site/docs/3.1.x/reference/ns-config.html 中获取。它说这些行是启用网络安全所必需的。

<http auto-config="true">
<intercept-url pattern="/**" access="ROLE_USER" />
</http>

当我在 Eclipse 中将鼠标悬停在它上面时，我得到：

cvc-complex-type.2.4.a: Invalid content was found starting with element 'http'. One of '{"http://
 www.springframework.org/schema/beans":import, "http://www.springframework.org/schema/beans":alias, "http://
 www.springframework.org/schema/beans":bean, WC[##other:"http://www.springframework.org/schema/beans"], "http://
 www.springframework.org/schema/beans":beans}'  is expected.

然后我在尝试运行我的应用程序时遇到类似的错误，导致它无法启动。感谢任何帮助。

【问题讨论】：

标签： java spring spring-security

【解决方案1】：

xml 中的默认命名空间是beans

xmlns="http://www.springframework.org/schema/beans"

但是http 属于spring security，所以你应该在http 元素之前添加命名空间，你已经在你的xml 中添加了命名空间定义

xmlns:security="http://www.springframework.org/schema/security"

所以你只需要把http改成

<security:http auto-config="true">
    <security:intercept-url pattern="/**" access="ROLE_USER" />
</security:http>

有关名称空间的更多信息，请参阅here；

【讨论】：