Spring已经登录用户的安全性重定向问题

Question

在基于GWT的web应用程序中实现spring安全性。我找到。 一切正常工作正常，除了以下事实：

我打开login.jsp并给出我的有效用户登录凭据。 提交后，它成功重定向到主页。现在，当我在地址栏中编辑login.jsp的URL ...令人惊讶的是，它允许打开我的login.jsp，但据我的理解..它不应该允许回到login.jsp直到&，除非我已登录。

可能是我的security-context.xml文件没有正确配置。

下面是我的安全应用程序的context.xml

<?xml version="1.0" encoding="UTF-8"?> 

<!-- - Sample namespace-based configuration - --> 

<beans:beans xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
         http://www.springframework.org/schema/beans/spring-beans-2.5.xsd 
         http://www.springframework.org/schema/security 
         http://www.springframework.org/schema/security/spring-security-2.0.4.xsd"> 

    <global-method-security secured-annotations="enabled"> 
    </global-method-security> 

    <beans:bean id="customAuthenticationProcessingFilter" 
     class="edu.authentication.CustomAuthenticationProcessingFilter"> 
     <custom-filter position="AUTHENTICATION_PROCESSING_FILTER" /> 
     <beans:property name="defaultTargetUrl" value="/Home.html?gwt.codesvr=127.0.0.1:9997" /> 
     <beans:property name="authenticationFailureUrl" value="/login.jsp?login_error=1" /> 
     <beans:property name="authenticationManager" ref="authenticationManager" /> 
    </beans:bean> 

    <beans:bean id="authenticationProcessingFilterEntryPoint" 
     class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint"> 
     <beans:property name="loginFormUrl" value="/login.jsp" /> 
     <beans:property name="forceHttps" value="false" /> 
    </beans:bean> 

    <beans:bean id="customUserDetailsService" 
     class="edu.authentication.CustomUserDetailsService"> 
     <beans:property name="urmService" ref="urmService" /> 
    </beans:bean> 

    <http auto-config="false" entry-point-ref="authenticationProcessingFilterEntryPoint"> 

    <intercept-url pattern="/login.jsp*" filters="none" /> 
     <intercept-url pattern="/forgot_password.jsp*" filters="none" /> 
     <intercept-url pattern="/forgotPasswordServlet.do*" filters="none" /> 

    <intercept-url pattern="/myApp/**" access="IS_AUTHENTICATED_FULLY"/> 
     <intercept-url pattern="/gwt/**" access="IS_AUTHENTICATED_FULLY"/> 
     <intercept-url pattern="/*.html" access="IS_AUTHENTICATED_FULLY"/> 

    <logout logout-url="/j_spring_security_logout" 
      invalidate-session="true" logout-success-url="/login.jsp?loggedout=true"/> 
    </http> 

    <authentication-manager alias="authenticationManager" /> 

    <authentication-provider user-service-ref="customUserDetailsService"> 
     <password-encoder hash="md5" /> 
    </authentication-provider> 

</beans:beans> 

任何帮助/建议将是非常appriciable ..

Answer 1

没有什么内置到春季安全，以防止您查看登录页面登录后，您可以通过将以下代码添加到登录页面顶部来阻止登录用户登录页面。

<%@ taglib prefix='sec' uri='http://www.springframework.org/security/tags' %> 
<sec:authorize ifNotGranted="ROLE_ANONYMOUS"> 
    <% response.sendRedirect("/mainpage.jsp"); %> 
</sec:authorize> 

的逻辑是，如果用户没有在Spring Security的登录会创建一个匿名Authentication对象为他们，为他们提供ROLE_ANONYMOUS的作用。因此，您只需检查用户是否具有该角色，如果他们不这样做，则可以假定他们已登录并将其重定向到应用程序的主页面。

Answer 2

或者，你可以创建一个Servlet过滤器：

public class LoginPageFilter implements Filter 
{ 
    public void init(FilterConfig filterConfig) throws ServletException { 
    } 

    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException 
    { 
     HttpServletRequest request = (HttpServletRequest) servletRequest; 
     HttpServletResponse response = (HttpServletResponse) servletResponse; 

     if(request.getUserPrincipal() != null){ //If user is already authenticated 
      response.sendRedirect("");// or, forward using RequestDispatcher 
     } else{ 
      filterChain.doFilter(servletRequest, servletResponse); 
     } 
    } 

    public void destroy() { 
    } 
} 

的web.xml：

LoginPageFilter com.xxx.xx.LoginPageFilter

<filter-mapping> 
    <filter-name>LoginPageFilter</filter-name> 
    <url-pattern>/login</url-pattern> 
</filter-mapping>