java.lang.IllegalStateException:在spring security spring boot中提交响应后，无法调用sendRedirect（）

这是我在springboot应用程序中的安全配置

package com.logan.cricketbeting.security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

import com.logan.cricketbeting.Service.CustomUserDetailsService;
import com.logan.cricketbeting.Service.UserServiceImpl;

//security configuration class for implementing spring security on urls
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomUserDetailsService userDetailsService;
    //for handling user success handler
    @Autowired
    private CustomizeAuthenticationSuccessHandler customizeAuthenticationSuccessHandler;
    @Override
    //this configuration is for handling user requests
    protected void configure(HttpSecurity http) throws Exception {
         http
            .authorizeRequests()
            .antMatchers("/orders").permitAll()
                 .antMatchers("/login").permitAll()
                 .antMatchers("/admin/**").hasAuthority("admin")
                 .antMatchers("/distributor/**").hasAuthority("distributor")
                 .antMatchers("/user/**").hasAuthority("user").anyRequest()
                .authenticated().and().csrf().disable().formLogin().successHandler(customizeAuthenticationSuccessHandler)
                .loginPage("/login").failureUrl("/login?error=true")
                .usernameParameter("username")
                .passwordParameter("password")
                .and().logout()
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                .logoutSuccessUrl("/login").and().exceptionHandling().accessDeniedPage("/403");
    }

    //this method allows static resources to be neglected by spring security
    @Override
    public void configure(WebSecurity web) throws Exception {
        web
            .ignoring()
            .antMatchers("/resources/**", "/static/**", "/css/**", "/js/**", "/images/**","/assets/**","/fonts/**","/vendor/**");
    }

    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        BCryptPasswordEncoder bCryptPasswordEncoder = new BCryptPasswordEncoder();
        return bCryptPasswordEncoder;
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
         //BCryptPasswordEncoder encoder = passwordEncoder();
        //auth.inMemoryAuthentication().withUser("logan@yahoo.com").password(encoder.encode("admin")).roles("user");
    auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}


}

这是我的客户成功处理程序

package com.logan.cricketbeting.security;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.stereotype.Component;


/*
 * This is an Authentication Success handler class for handling what happens after the user is suc
 * successfully logined in the application
 * 
 * 
 * 
 * */
@Component
public class CustomizeAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request,
            HttpServletResponse response, Authentication authentication)
            throws IOException, ServletException {
        //set our response to OK status
        response.setStatus(HttpServletResponse.SC_OK);
//this check granted authorities against the username
        for (GrantedAuthority auth : authentication.getAuthorities()) {
            //if the granted authority is user then it is allowed

            //if its admin it is allowed 

             if("admin".equals(auth.getAuthority())) {
                response.sendRedirect("/admin/home"); //working fine
            }

            else if("distributor".equals(auth.getAuthority())) {
                response.sendRedirect("/distributor/home");//working fine
            }

            else if ("user".equals(auth.getAuthority())) {
                    response.sendRedirect("/user/home");//it is not working
                }

            //else it redirects to the 403 forbidden error
            else {
                response.sendRedirect("/403");
            }
        }
    }


}

我的管理员和分发服务器url在登录后工作正常，但用户1给出了一个错误

java.lang.IllegalStateException:无法在 已作出答复

---

我不知道哪里出了问题，你知道怎么解决吗？

如果用户有多个权限，你的代码会多次调用sendRedirect。在每个发送重定向之后添加一个中断或返回应该可以解决问题。

看一看是的，我看到了，但是除了这个，为什么其他两个重定向都在工作？您的用户有哪些权限？如果一个用户拥有不止一个权限，你的coode应该失败。你已经说过，你读了weizenkeim hugo发布的链接。这就是原因。哦，好的，明白了！！它会检查角色，如果有多个角色，则会发送标题。谢谢不要回答重复的问题，只需标记问题。您已经对复制目标的链接进行了注释。