Java 在控制器中使用@security注释的Spring安全性

我正在使用SpringSecurity并创建一个演示应用程序。它包含一个登录控制器和两个用于登录和成功的jsp页面

我想使用@secure注释在控制器中应用方法级安全性，但它不起作用，当我在我的服务类中应用它时，它工作得很好

谁能帮我找出我做错了什么：(

我的Pom.xml是

    <?xml version="1.0" encoding="UTF-8"?>
        <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
          <modelVersion>4.0.0</modelVersion>
          <groupId>com.concretepage.app</groupId>
            <artifactId>SpringSecurity</artifactId>
            <packaging>war</packaging>
            <version>1.0-SNAPSHOT</version>
            <name>Spring Security App</name>

            <properties>
                <spring.version>3.1.4.RELEASE</spring.version>
            </properties>

            <dependencies>
                <dependency>
                    <groupId>org.springframework</groupId>
                    <artifactId>spring-core</artifactId>
                    <version>${spring.version}</version>
                </dependency>

                <dependency>
                    <groupId>org.springframework</groupId>
                    <artifactId>spring-webmvc</artifactId>
                    <version>${spring.version}</version>
                </dependency>

                <dependency>
                    <groupId>org.springframework</groupId>
                    <artifactId>spring-web</artifactId>
                    <version>${spring.version}</version>
                </dependency>

                <dependency>
                    <groupId>org.springframework.security</groupId>
                    <artifactId>spring-security-core</artifactId>
                    <version>${spring.version}</version>
                </dependency>

                <dependency>
                    <groupId>org.springframework.security</groupId>
                    <artifactId>spring-security-web</artifactId>
                    <version>${spring.version}</version>
                </dependency>

                <dependency>
                    <groupId>org.springframework.security</groupId>
                    <artifactId>spring-security-config</artifactId>
                    <version>${spring.version}</version>
                </dependency>

                <dependency>
                  <groupId>org.springframework</groupId>
                  <artifactId>spring-context</artifactId>
                  <version>${spring.version}</version>
               </dependency>

               <dependency>
                 <groupId>org.springframework.security</groupId>
                 <artifactId>spring-security-taglibs</artifactId>
                  <version>${spring.version}</version>
               </dependency>


                <dependency>
                    <groupId>jstl</groupId>
                    <artifactId>jstl</artifactId>
                    <version>1.2</version>
                </dependency>

                <dependency>
                     <groupId>commons-dbcp</groupId>
                     <artifactId>commons-dbcp</artifactId>
                     <version>1.2.2</version>
                </dependency>

                <dependency>
                     <groupId>mysql</groupId>
                     <artifactId>mysql-connector-java</artifactId>
                     <version>5.1.17</version>
               </dependency>

               <dependency>
                <groupId>log4j</groupId>
                <artifactId>log4j</artifactId>
                <version>1.2.17</version>
               </dependency>

               <dependency>
                 <groupId>org.aspectj</groupId>
                 <artifactId>aspectjweaver</artifactId>
                 <version>1.6.8</version>
              </dependency>

              <dependency>
                <groupId>javax.servlet</groupId>
                <artifactId>servlet-api</artifactId>
                <version>2.5</version>
              </dependency>

              <dependency>
                 <groupId>cglib</groupId>
                 <artifactId>cglib</artifactId>
                 <version>2.2</version>
               </dependency>

            </dependencies>

            <build>
                <finalName>SpringSecurity</finalName>
                <plugins>
                    <plugin>
                        <artifactId>maven-compiler-plugin</artifactId>
                        <configuration>
                            <source>1.6</source>
                            <target>1.6</target>
                        </configuration>
                    </plugin>
                </plugins>
            </build>

        </project>

---

按照

web.xml

的结构，文件

dispatcher servlet.xml

将加载两次-一次是由于

..

标记，另一次是由于

..

标记。您应该从

..

部分删除对

dispatcher servlet.xml

的引用

Spring安全批注不起作用的原因是Spring配置中的任何位置都没有

。由于要保护控制器，应将此行添加到

dispatcher servlet.xml

。修改后的文件如下所示：

<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:context="http://www.springframework.org/schema/context"
   xmlns:security="http://www.springframework.org/schema/security"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
  <context:component-scan base-package="com.concretepage.security.controller"/>

  <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
    <property name="prefix" value="/pages/"/>
    <property name="suffix" value=".jsp"/>
  </bean>

  <security:global-method-security
    jsr250-annotations="enabled"
    pre-post-annotations="enabled"
    secured-annotations="enabled"/>
</beans>

        <?xml version="1.0" encoding="UTF-8"?>
        <beans:beans xmlns="http://www.springframework.org/schema/security"
         xmlns:beans="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
               http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
               http://www.springframework.org/schema/security
               http://www.springframework.org/schema/security/spring-security-3.1.xsd">

        <http auto-config="true">
            <intercept-url pattern="/login" access="ROLE_USER,ROLE_ADMIN" />
            <logout logout-success-url="/login" />
        </http>

        <authentication-manager>
          <authentication-provider>
           <user-service>
            <user name="ram" password="con1234" authorities="ROLE_ADMIN" />
            <user name="rahim" password="con1234" authorities="ROLE_USER" />
          </user-service>
          </authentication-provider>
        </authentication-manager>

       <global-method-security secured-annotations="enabled" />
       <beans:bean name="userService" class="com.concretepage.service.UserService"/>             
    </beans:beans>

<?xml version="1.0" encoding="ISO-8859-1" ?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
    version="2.4">

    <display-name>Spring Security Application</display-name>

    <servlet>
        <servlet-name>dispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>dispatcher</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
           /WEB-INF/dispatcher-servlet.xml,
           /WEB-INF/security-config.xml
        </param-value>
    </context-param>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

      <listener>
    <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
     </listener>

    <!-- Spring Security Configuration -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

</web-app>

        package com.concretepage.security.controller;

    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Controller;
    import org.springframework.ui.ModelMap;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    import org.springframework.security.access.annotation.Secured;
    import com.concretepage.service.IUserService;

    @Controller
    public class LoginController {
        @Autowired
        public IUserService userService;

       @RequestMapping(value="/login", method = RequestMethod.GET)
        public String success(ModelMap map) {       
            return "success"; 
        }  

       @Secured("ROLE_ADMIN")
       @RequestMapping(value="/test", method = RequestMethod.GET)
        public String success1(ModelMap map) {      
            return "success"; 
        } 
    }

<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:context="http://www.springframework.org/schema/context"
   xmlns:security="http://www.springframework.org/schema/security"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
  <context:component-scan base-package="com.concretepage.security.controller"/>

  <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
    <property name="prefix" value="/pages/"/>
    <property name="suffix" value=".jsp"/>
  </bean>

  <security:global-method-security
    jsr250-annotations="enabled"
    pre-post-annotations="enabled"
    secured-annotations="enabled"/>
</beans>