spring security3.1配置比较纠结的2个问题

转自：http://www.iteye.com/topic/1122629

总论
无疑问的，spring security在怎么保护网页应用安全上做得很强很周全，但有些地方还是很差强人意，比如对<http/>这个标签，对auto-config="true"与use-expressions="true"的描述和关系辨析上，就语焉不详。升级到3.1版本后，居然发现有莫名奇妙的错误，比如无法解析'ROLE_ADMIN'这样的标准配置，或者报：

引用 Field or property cannot be found on object of type 'org.springframework.security.web.access.expression.WebSecurityExpressionRoot'

这样摸不着头脑的错误。如果有遇到这类问题，一个要仔细看官方文档，彻底理解use-expressions的含义，比如，

在用use-expressions后，就不能用access="ROLE_USER"这样的配置了;

而且在3.1之后，如果同时用auto-config='true'和use-expression="true"是不行的，就好比撞了两面墙，左右不是，这种问题的确是使用spring security这样的庞然大物时比较令人生畏之处，用好了事情迎刃而解，用不好破敌800自损3000，这是因为安全本身就很复杂，一般只能case by case的实现和解决，也难为了做spring security这群人了。

how to do it？

啃吧，专注深入的学习spring security，从它的手册tutorial一点点看起。

问题解决：

<http use-expressions="true">

　　<logout />

　　<remember-me />

　　<session-management invalid-session-url="/timeout.jsp">

　　　　<concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />

　　</session-management>

　　<!--下边的access="xxxxx" 中的属性加上就报错不知为知-->

　　<intercept-url pattern="/login.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" />

　　<intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" />

　　<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=true" default-target-url="/" />

</http>

报错：

java.lang.IllegalArgumentException: Failed to evaluate expression 'IS_AUTHENTICATED_ANONYMOUSLY'

at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:13)

at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:34)

at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:50)

at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:203)

at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:106)

at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83)

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)

at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:97)

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)

at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:100)

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)

at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:78)

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)

at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:112)

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)

at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)

at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:35)

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)

at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:187)

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)

at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)

at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:79)

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)

at org.springframework.security.web.session.ConcurrentSessionFilter.doFilter(ConcurrentSessionFilter.java:109)

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)

at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:169)

at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)

at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:104)

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:261)

at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)

at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:581)

at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)

at java.lang.Thread.run(Thread.java:619)

Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1008E:(pos 0): Field or property 'IS_AUTHENTICATED_ANONYMOUSLY' cannot be found on object of type 'org.springframework.security.web.access.expression.WebSecurityExpressionRoot'

at org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:206)

at org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:71)

at org.springframework.expression.spel.ast.SpelNodeImpl.getTypedValue(SpelNodeImpl.java:102)

at org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:97)

at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:11)

... 41 more

解决：
改成access="hasRole('ROLE_USER')"就行了

问题2：
今天发现spring全部进级到3.1了，官方网站说是100％与3.0兼容，当然这指的是spring framework，可能没有包含spring security。

按照我之前进级的经验来说，起首xml头上的xsd文件版本要更新一下，从3.0.xsd改为3.1.xsd
别的，碰到了一个问题就是spring security3.1中不再支撑filter="none"了

比如：

<http use-expression="true" auto-config="true">

    <intercept-url pattern="/static/**" filters="none"/>

    <intercept-url pattern="/security/**" access="hasRole（""ROLE_ADMIN""）" />

    <intercept-url pattern="/**" access="hasRole（""ROLE_USER""）"/>

    <http-basic/>

</http>

须要改成：

<http pattern="/static/**" security="none"/>

<http use-expression="true" auto-config="true">

    <intercept-url pattern="/security/**" access="hasRole（""ROLE_ADMIN""）" />

    <intercept-url pattern="/**" access="hasRole（""ROLE_USER""）"/>

    <http-basic/>

</http>

巴特西

spring security3.1配置比较纠结的2个问题

最新文章

热门文章