Spring security的Java配置无法识别/j_Spring_security_检查

我有一个webapp，其中我使用了Java配置来实现Spring安全性。问题是，如果我没有明确指定

/j\u spring\u security\u check

作为登录处理URL，它将失败。我最终在日志中得到以下内容：

DEBUG: [Aug-02 17:16:10,907] security.web.FilterChainProxy - /j_spring_security_check at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
DEBUG: [Aug-02 17:16:10,907] security.web.FilterChainProxy - /j_spring_security_check at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
DEBUG: [Aug-02 17:16:10,907] security.web.FilterChainProxy - /j_spring_security_check at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/login.html'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/auth-failure.html'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/favicon.ico'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/css/**'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/js/**'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/img/**'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/reader/**'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/script/read/**'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/mobile/**'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Request '/j_spring_security_check' matched by universal pattern '/**'
DEBUG: [Aug-02 17:16:10,907] access.intercept.FilterSecurityInterceptor - Secure object: FilterInvocation: URL: /j_spring_security_check; Attributes: [hasRole('ROLE_USER')]
DEBUG: [Aug-02 17:16:10,907] access.intercept.FilterSecurityInterceptor - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@6fa8dbd0: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffdaa08: RemoteIpAddress: 127.0.0.1; SessionId: 715AFC0DB28725B1A882DF649173A566; Granted Authorities: ROLE_ANONYMOUS
DEBUG: [Aug-02 17:16:10,907] access.vote.AffirmativeBased - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@329b7920, returned: -1
DEBUG: [Aug-02 17:16:10,907] web.access.ExceptionTranslationFilter - Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied

如您所见，它根本无法匹配

/j_spring\u security\u check

，因此它表示访问被拒绝，并重定向回登录页面。但是，如果我明确添加

/j\u spring\u security\u check

，如下所示：

http.formLogin()
        .loginProcessingUrl("/j_spring_security_check")
        ...
        ...                   

它起作用了。这对我来说似乎并不正确，因为我从来没有在基于XML的配置中这样做过。此外，我在任何例子中也没有看到这一点。我做错了什么

我的安全配置类如下所示：

@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    public void configure(AuthenticationManagerBuilder builder) throws Exception {
        builder.userDetailsService(new CustomUserDetailsService()).passwordEncoder(new PlaintextPasswordEncoder()); //plaintext is on purpose; this is a toy app
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable() // toy app so I'm just trying to get this to work
            .authorizeRequests()
                .antMatchers(
                        "/login.html",
                        "/auth-failure.html",
                        "/favicon.ico",
                        "/css/**",
                        "/js/**",
                        "/img/**",
                        "/reader/**",
                        "/script/read/**",
                        "/mobile/**").permitAll()
                .antMatchers("/**").hasRole("USER")
                .anyRequest().authenticated();

        http.formLogin()
                .loginProcessingUrl("/j_spring_security_check")
                .loginPage("/login.html")
                .defaultSuccessUrl("/editor/")
                .failureUrl("/auth-failure.html");
    }
}

---

出于安全原因，Java配置和基于XML的配置具有不同的默认URL。有关详细信息，请参阅

它说：

POST/login验证用户身份，而不是/j\u spring\u security\u check