0

我有一个使用 JSF 创建的自定义登录页面。但是，一旦我运行应用程序，我就会收到错误消息“Firefox 检测到服务器正在以永远不会完成的方式重定向对该地址的请求。”

这是我的web.xml：

<context-param>
  <param-name>contextConfigLocation</param-name>
  <param-value>
            /WEB-INF/applicationContext.xml
            /WEB-INF/applicationContext-security.xml
  </param-value>
</context-param>


<!-- Enable Spring Security -->
<filter>
 <filter-name>springSecurityFilterChain</filter-name>
 <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<!-- Allow login pages with JSF which redirects to security check,
 therefore we have to add the forward entry here -->
<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>REQUEST</dispatcher>
 </filter-mapping>

和我的applicationContext-security.xml

<http auto-config='true' use-expressions="true" access-denied-page="/index.xhtml">
    <intercept-url pattern="/jsf/admin_*" access="hasRole('ADMIN')"/>
    <intercept-url pattern="/jsf/pm_*" access="hasRole('PM')"/>
    <intercept-url pattern="/jsf/la_*" access="hasRole('ACCOUNT_APPROVER')"/>
    <intercept-url pattern="/jsf/bc_*" access="hasRole('BILLING_CONTACT')"/>
    <intercept-url pattern="/**" access="hasRole('USER') or hasRole('ADMIN') or hasRole('PM')"/> 
    <form-login login-processing-url="/j_spring_security_check" login-page="/login.xhtml" />
</http>

<authentication-manager>
    <authentication-provider user-service-ref='myUserDetailsService'>
        <password-encoder hash="sha"/>
    </authentication-provider>
</authentication-manager>    

<beans:bean id="myUserDetailsService" class="lk.mazarin.wcplus.security.WcUserDetailsServiceWrapper">
    <beans:property name="wcUserDAO" ref="wcUserDAO"/>       
</beans:bean> 

<beans:bean id="wcPasswordEncoder" class="org.springframework.security.authentication.encoding.ShaPasswordEncoder"/>
4

2 回答 2

1

请不要在登录 URL 上添加授权。请将以下内容添加到您的 applicationContext-security.xml：<intercept-url pattern="/login*" filters="none" />

于 2013-04-18T07:02:34.727 回答
1

正如@Michael 所指出的，您需要从登录页面中删除安全限制。该filters属性已被弃用，在最新版本的 Spring Security 中还有另一种方法：

<http ...>
    ....
    <!-- This line goes BEFORE /** pattern -->
    <intercept-url pattern="/login.xhtml*" access="permitAll" />
    ....
    <intercept-url pattern="/**" access="hasRole('USER') or hasRole('ADMIN') or hasRole('PM')"/> 
    ...
</http>
于 2013-04-18T08:22:51.853 回答