Java Spring安全注释禁用登录表单功能_Java_Spring_Security_Annotations

Java Spring安全注释禁用登录表单功能

java spring security

Java Spring安全注释禁用登录表单功能,java,spring,security,annotations,Java,Spring,Security,Annotations,我正试图通过注释使用SpringSecurity来保护RESTfulWeb服务的一个方法调用。在我的方法上放置@Secured注释时，我遇到了一个奇怪的行为，阻止登录表单被重定向到，相反，我立即得到403响应我把它放在我的配置下面，你能给我解释一下是怎么回事吗 <?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/security"

我正试图通过注释使用SpringSecurity来保护RESTfulWeb服务的一个方法调用。在我的方法上放置@Secured注释时，我遇到了一个奇怪的行为，阻止登录表单被重定向到，相反，我立即得到403响应

我把它放在我的配置下面，你能给我解释一下是怎么回事吗

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
         xmlns:beans="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security-3.1.xsd">

<global-method-security secured-annotations="enabled" />

<http auto-config="true">
    <http-basic/>
    <form-login/>

    <!-- With the following line login form is shown -->
    <!--<intercept-url pattern="/rest/secured/" access="ROLE_USER"/>-->

</http>

<authentication-manager alias="myAuthenticationManager">
    <authentication-provider>
        <user-service>
            <user name="user" password="user" authorities="ROLE_USER"/>
        </user-service>
    </authentication-provider>
</authentication-manager>

</beans:beans>

这是一个实现：

@Path("/")
public class KinoteatrServiceImpl implements KinoteatrService
{
    @Override
    public String testSecuredMethod() {
        return "<html><body>Success, timestamp: " + new Date() + "</body></html>";
    }
}

登录页面仅显示安全URL，而不显示安全方法

安全方法是保护应用程序的附加层，它要求用户已经过身份验证。因此，您必须使用intersept url。。。显示登录页面

附言，以防万一。如Spring安全文档中所述：

@Path("/")
public class KinoteatrServiceImpl implements KinoteatrService
{
    @Override
    public String testSecuredMethod() {
        return "<html><body>Success, timestamp: " + new Date() + "</body></html>";
    }
}

带注释的方法仅对定义为SpringBeans的实例进行保护（在启用方法安全性的同一应用程序上下文中）。如果要保护不是由Spring创建的实例（例如，使用新操作符），则需要使用AspectJ

2012-11-12 15:00:56,545 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.ws.policy.PolicyInInterceptor@55d0f2b6 2012-11-12 15:00:56,545 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.transport.https.CertConstraintsInterceptor@78e9282b 2012-11-12 15:00:56,545 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.jaxrs.interceptor.JAXRSInInterceptor@6c29b061 2012-11-12 15:00:56,547 DEBUG [utils.JAXRSUtils] : Trying to select a resource class, request path : /secured/ 2012-11-12 15:00:56,547 DEBUG [utils.JAXRSUtils] : Trying to select a resource operation on the resource class com.kinoteatr.ua.service.KinoteatrServiceImpl ... ... 2012-11-12 15:00:56,558 DEBUG [utils.JAXRSUtils] : Resource operation testSecuredMethod on the resource class com.kinoteatr.ua.service.KinoteatrServiceImpl has been selected 2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Request path is: /secured/ 2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Request HTTP method is: GET 2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Request contentType is: */* 2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Accept contentType is: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Found operation: testSecuredMethod 2012-11-12 15:00:56,559 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.OneWayProcessorInterceptor@2221deec 2012-11-12 15:00:56,559 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.ServiceInvokerInterceptor@8eeb6be 2012-11-12 15:00:56,561 DEBUG [aopalliance.MethodSecurityInterceptor] : Secure object: ReflectiveMethodInvocation: public java.lang.String com.kinoteatr.ua.service.KinoteatrServiceImpl.testSecuredMethod(); target is of class [com.kinoteatr.ua.service.KinoteatrServiceImpl]; Attributes: [ROLE_USER] 2012-11-12 15:00:56,561 DEBUG [aopalliance.MethodSecurityInterceptor] : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055e4a6: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@957e: RemoteIpAddress: 127.0.0.1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS 2012-11-12 15:00:56,562 DEBUG [vote.AffirmativeBased] : Voter: org.springframework.security.access.vote.RoleVoter@13961789, returned: -1 2012-11-12 15:00:56,562 DEBUG [vote.AffirmativeBased] : Voter: org.springframework.security.access.vote.AuthenticatedVoter@62e32d6a, returned: 0 2012-11-12 15:00:56,563 DEBUG [support.DefaultListableBeanFactory] : Returning cached instance of singleton bean 'cxf' 2012-11-12 15:00:56,566 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.OutgoingChainInterceptor@701f7886 2012-11-12 15:00:56,566 DEBUG [interceptor.OutgoingChainInterceptor] : Interceptors contributed by bus: [org.apache.cxf.interceptor.LoggingOutInterceptor@315b222e, org.apache.cxf.ws.policy.PolicyOutInterceptor@56211352] 2012-11-12 15:00:56,566 DEBUG [interceptor.OutgoingChainInterceptor] : Interceptors contributed by service: [] 2012-11-12 15:00:56,566 DEBUG [interceptor.OutgoingChainInterceptor] : Interceptors contributed by endpoint: [org.apache.cxf.interceptor.MessageSenderInterceptor@65640d91, org.apache.cxf.transport.common.gzip.GZIPOutInterceptor@bb6de98] 2012-11-12 15:00:56,566 DEBUG [interceptor.OutgoingChainInterceptor] : Interceptors contributed by binding: [org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor@12cfd32a] 2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Chain org.apache.cxf.phase.PhaseInterceptorChain@a4553e4 was created. Current flow: setup [PolicyOutInterceptor] prepare-send [MessageSenderInterceptor, GZIPOutInterceptor] pre-stream [LoggingOutInterceptor] marshal [JAXRSOutInterceptor] 2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.ws.policy.PolicyOutInterceptor@56211352 2012-11-12 15:00:56,567 DEBUG [policy.PolicyOutInterceptor] : No binding operation info. 2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.MessageSenderInterceptor@65640d91 2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Adding interceptor org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor@43300672 to phase prepare-send-ending 2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Chain org.apache.cxf.phase.PhaseInterceptorChain@a4553e4 was modified. Current flow: setup [PolicyOutInterceptor] prepare-send [MessageSenderInterceptor, GZIPOutInterceptor] pre-stream [LoggingOutInterceptor] marshal [JAXRSOutInterceptor] prepare-send-ending [MessageSenderEndingInterceptor] 2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.transport.common.gzip.GZIPOutInterceptor@bb6de98 2012-11-12 15:00:56,567 DEBUG [gzip.GZIPOutInterceptor] : Response role, checking accept-encoding 2012-11-12 15:00:56,567 DEBUG [gzip.GZIPOutInterceptor] : Accept-Encoding header: [gzip,deflate,sdch] 2012-11-12 15:00:56,567 DEBUG [gzip.GZIPOutInterceptor] : gzip permitted: YES 2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.LoggingOutInterceptor@315b222e 2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor@12cfd32a 2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.MessageSenderInterceptor MessageSenderEndingInterceptor@43300672 2012-11-12 15:00:56,567 INFO [interceptor.LoggingOutInterceptor] : Outbound Message --------------------------- ID: 2 Response-Code: 403 Content-Type: text/xml Headers: {Date=[Mon, 12 Nov 2012 13:00:56 GMT], Content-Length=[0]} -------------------------------------- 2012-11-12 15:00:56,567 DEBUG [gzip.GZIPOutInterceptor] : Message is smaller than compression threshold, not compressing. 2012-11-12 15:00:56,567 DEBUG [context.HttpSessionSecurityContextRepository] : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. 2012-11-12 15:00:56,567 DEBUG [servlet.ServletController] : Finished servicing http request on thread: Thread[http-bio-8080-exec-64,5,main] 2012-11-12 15:00:56,567 DEBUG [access.ExceptionTranslationFilter] : Chain processed normally 2012-11-12 15:00:56,567 DEBUG [context.SecurityContextPersistenceFilter] : SecurityContextHolder now cleared, as request processing completed